From 074b7781b2d08dd9de62d49c66ce077b66c3f58f Mon Sep 17 00:00:00 2001
From: Alexander Mai <amai@users.sf.net>
Date: Thu, 27 Sep 2012 06:35:36 +0200
Subject: [PATCH] Fixed #4239 (segmentation fault of cppcheck (invalid code))

---
 lib/tokenize.cpp      | 22 ++++++++++++----------
 test/testtokenize.cpp |  6 ++++++
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 0e5d7f963..6c779a00d 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -1016,17 +1016,19 @@ void Tokenizer::simplifyTypedef()
                     if (!func)
                         continue;
 
-                    /** @todo add support for multi-token operators */
-                    if (func->previous()->str() == "operator")
-                        func = func->previous();
+                    if (func->previous()) { // Ticket #4239
+                        /** @todo add support for multi-token operators */
+                        if (func->previous()->str() == "operator")
+                            func = func->previous();
 
-                    // check for qualifier
-                    if (func->previous()->str() == "::") {
-                        // check for available and matching class name
-                        if (!spaceInfo.empty() && classLevel < spaceInfo.size() &&
-                            func->strAt(-2) == spaceInfo[classLevel].className) {
-                            memberScope = 0;
-                            inMemberFunc = true;
+                        // check for qualifier
+                        if (func->previous()->str() == "::") {
+                            // check for available and matching class name
+                            if (!spaceInfo.empty() && classLevel < spaceInfo.size() &&
+                                func->strAt(-2) == spaceInfo[classLevel].className) {
+                                memberScope = 0;
+                                inMemberFunc = true;
+                            }
                         }
                     }
                 }
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index 0666c3c9a..b8028e2e2 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -57,6 +57,7 @@ private:
         TEST_CASE(tokenize22);  // special marker $ from preprocessor
         TEST_CASE(tokenize23);  // tokenize "return - __LINE__;"
         TEST_CASE(tokenize24);  // #4195 (segmentation fault)
+        TEST_CASE(tokenize25);  // #4239 (segmentation fault)
 
         // don't freak out when the syntax is wrong
         TEST_CASE(wrong_syntax1);
@@ -651,6 +652,11 @@ private:
         tokenizeAndStringify("enum { int f ( ) { return = } r = f ( ) ; }");
     }
 
+    // #4239 - segfault for "f ( struct { int typedef T x ; } ) { }"
+    void tokenize25() {
+        tokenizeAndStringify("f ( struct { int typedef T x ; } ) { }");
+    }
+
     void wrong_syntax1() {
         {
             const std::string code("TR(kvmpio, PROTO(int rw), ARGS(rw), TP_(aa->rw;))");