From 5a964132209c281ae034cf662283d721593e5c46 Mon Sep 17 00:00:00 2001
From: Alexander Mai <amai@users.sf.net>
Date: Thu, 4 Sep 2014 21:27:33 +0200
Subject: [PATCH] #6127 crash on patch(?)-".c" file. Avoid segfault.

---
 lib/valueflow.cpp     | 6 +++---
 test/testtokenize.cpp | 6 +++++-
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 6907d9b25..40fd3ba3d 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -124,8 +124,8 @@ static bool conditionIsTrue(const Token *condition, const std::map<unsigned int,
     if (!condition)
         return false;
     if (condition->str() == "||") {
-        bool result1 = conditionIsTrue(condition->astOperand1(), programMemory);
-        bool result2 = result1 ? true : conditionIsTrue(condition->astOperand2(), programMemory);
+        const bool result1 = conditionIsTrue(condition->astOperand1(), programMemory);
+        const bool result2 = result1 ? true : conditionIsTrue(condition->astOperand2(), programMemory);
         return result2;
     }
     std::map<unsigned int, MathLib::bigint> progmem(programMemory);
@@ -1440,7 +1440,7 @@ static void valueFlowForLoop(TokenList *tokenlist, ErrorLogger *errorLogger, con
             continue;
 
         Token * const bodyStart = tok->linkAt(1)->next();
-        if (!bodyStart->link() || bodyStart->str() != "{")
+        if (!bodyStart || !bodyStart->link() || bodyStart->str() != "{")
             continue;
 
         unsigned int varid(0);
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index 20cf4a06f..2384b300b 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -86,7 +86,7 @@ private:
         TEST_CASE(garbageCode7);
         TEST_CASE(garbageCode8); // #5511
         TEST_CASE(garbageCode9); // #5604
-
+        TEST_CASE(garbageCode10);  // #6127
         TEST_CASE(simplifyFileAndLineMacro);  // tokenize "return - __LINE__;"
 
         TEST_CASE(foreach);     // #3690
@@ -1115,6 +1115,10 @@ private:
         ASSERT_THROW(tokenizeAndStringify("enum { e = { } } ( ) { { enum { } } } { e } ", true), InternalError);
     }
 
+    void garbageCode10() { // #6127
+        tokenizeAndStringify("for( rl=reslist; rl!=NULL; rl=rl->next )", /*simplify=*/true);
+    }
+
     void simplifyFileAndLineMacro() { // tokenize 'return - __LINE__' correctly
         ASSERT_EQUALS("\"test.cpp\"", tokenizeAndStringify("__FILE__"));
         ASSERT_EQUALS("return -1 ;", tokenizeAndStringify("return - __LINE__;"));