[Bug c++/67913] new expression with negative size not diagnosed

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=67913

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
The following otherwise untested patch makes GCC reject new expressions with
negative numbers of elements:

@@ -3066,6 +3378,14 @@ build_new (vec<tree, va_gc> **placement, tree type, tree
nelts,
           else
             return error_mark_node;
         }
+
+      if (TREE_CONSTANT (nelts) && tree_int_cst_lt (nelts, integer_zero_node))
+       {
+         if (complain & tf_error)
+           error ("number of array elements %qE is less than zero", nelts);
+         return error_mark_node;
+       }
+
       nelts = mark_rvalue_use (nelts);
       nelts = cp_save_expr (cp_convert (sizetype, nelts, complain));
     }