1 files changed, 63 insertions, 0 deletions
diff --git a/contrib/llvm/patches/patch-r261680-clang-r200899-fix-security-quantis.diff b/contrib/llvm/patches/patch-r261680-clang-r200899-fix-security-quantis.diff
new file mode 100644
index 0000000..be81051
--- /dev/null
+++ b/contrib/llvm/patches/patch-r261680-clang-r200899-fix-security-quantis.diff
@@ -0,0 +1,63 @@
+Pull in r200899 from upstream clang trunk (by Serge Pavlov):
+
+  Allow transformation of VariableArray to ConstantArray.
+
+  In the following code:
+
+      struct A { static const int sz; };
+      template<class T> void f() { T arr[A::sz]; }
+
+  the array 'arr' is represented as a variable size array in the template.
+  If 'A::sz' gets value below in the translation unit, the array in
+  instantiation can turn into constant size array.
+
+  This change fixes PR18633.
+
+  Differential Revision: http://llvm-reviews.chandlerc.com/D2688
+
+Introduced here: http://svn.freebsd.org/changeset/base/261680
+
+Index: tools/clang/test/SemaCXX/c99-variable-length-array.cpp
+===================================================================
+--- tools/clang/test/SemaCXX/c99-variable-length-array.cpp
++++ tools/clang/test/SemaCXX/c99-variable-length-array.cpp
+@@ -140,3 +140,24 @@ namespace PR11744 {
+   }
+   int test = f<int>(0); // expected-note {{instantiation of}}
+ }
++
++namespace pr18633 {
++  struct A1 {
++    static const int sz;
++    static const int sz2;
++  };
++  const int A1::sz2 = 11;
++  template<typename T>
++  void func () {
++    int arr[A1::sz]; // expected-warning{{variable length arrays are a C99 feature}}
++  }
++  template<typename T>
++  void func2 () {
++    int arr[A1::sz2];
++  }
++  const int A1::sz = 12;
++  void func2() {
++    func<int>();
++    func2<int>();
++  }
++}
+Index: tools/clang/lib/Sema/TreeTransform.h
+===================================================================
+--- tools/clang/lib/Sema/TreeTransform.h
++++ tools/clang/lib/Sema/TreeTransform.h
+@@ -3966,7 +3966,9 @@ TreeTransform<Derived>::TransformVariableArrayType
+       return QualType();
+   }
+ 
+-  VariableArrayTypeLoc NewTL = TLB.push<VariableArrayTypeLoc>(Result);
++  // We might have constant size array now, but fortunately it has the same
++  // location layout.
++  ArrayTypeLoc NewTL = TLB.push<ArrayTypeLoc>(Result);
+   NewTL.setLBracketLoc(TL.getLBracketLoc());
+   NewTL.setRBracketLoc(TL.getRBracketLoc());
+   NewTL.setSizeExpr(Size);