Fixes for #3480 and #3568.

lib/checkother.cpp

@@ -1974,12 +1974,12 @@ void CheckOther::passedByValueError(const Token *tok, const std::string &parname
 //---------------------------------------------------------------------------
 static bool isChar(const Variable* var)
 {
-    return(var && !var->isPointer() && !var->isArray() && (var->typeEndToken()->str() == "char" || var->typeEndToken()->previous()->str() == "char"));
+    return(var && !var->isPointer() && !var->isArray() && (var->typeEndToken()->str() == "char" || (var->typeEndToken()->previous() && var->typeEndToken()->previous()->str() == "char")));
 }
 
 static bool isSignedChar(const Variable* var)
 {
-    return(isChar(var) && !var->typeEndToken()->isUnsigned() && !var->typeEndToken()->previous()->isUnsigned());
+    return(isChar(var) && !var->typeEndToken()->isUnsigned() && (!var->typeEndToken()->previous() || !var->typeEndToken()->previous()->isUnsigned()));
 }
 
 void CheckOther::checkCharVariable()

lib/executionpath.cpp

@@ -439,6 +439,9 @@ void ExecutionPath::checkScope(const Token *tok, std::list<ExecutionPath *> &che
                 return;
         }
 
+        if (!tok)
+            break;
+
         // return/throw ends all execution paths
         if (tok->str() == "return" ||
             tok->str() == "throw" ||

test/testnullpointer.cpp

@@ -62,8 +62,9 @@ private:
         TEST_CASE(nullpointerDelete);
         TEST_CASE(nullpointerExit);
         TEST_CASE(nullpointerStdString);
-
         TEST_CASE(functioncall);
+
+        TEST_CASE(crash1);
     }
 
     void check(const char code[], bool inconclusive = false, bool cpp11 = false) {
@@ -1873,6 +1874,12 @@ private:
             ASSERT_EQUALS("[test.cpp:2]: (error) Possible null pointer dereference: abc - otherwise it is redundant to check if abc is null at line 4\n", errout.str());
         }
     }
+
+    void crash1() {
+        check("int f() {\n"
+              "    return if\n"
+              "}");
+    }
 };
 
 REGISTER_TEST(TestNullPointer)