diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index e89fad9e6..6fd1545e3 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -2491,7 +2491,7 @@ static bool isKnown(const Token * tok)
 
 static void valueFlowFunctionReturn(TokenList *tokenlist, ErrorLogger *errorLogger, const Settings *settings)
 {
-    for (Token *tok = tokenlist->front(); tok; tok = tok->next()) {
+    for (Token *tok = tokenlist->back(); tok; tok = tok->previous()) {
         if (tok->str() != "(" || !tok->astOperand1() || !tok->astOperand1()->function())
             continue;
 
diff --git a/test/testvalueflow.cpp b/test/testvalueflow.cpp
index 90ebcd762..08eb19893 100644
--- a/test/testvalueflow.cpp
+++ b/test/testvalueflow.cpp
@@ -1783,6 +1783,15 @@ private:
                "void f() { x = 1 * one(); }";
         ASSERT_EQUALS(1, valueOfTok(code, "*").intvalue);
         ASSERT_EQUALS(true, valueOfTok(code, "*").isKnown());
+
+        code = "int add(int x, int y) {\n"
+               "  return x+y;\n"
+               "}\n"
+               "void f2() {\n"
+               "    x = 1 * add(1,add(2,3));\n"
+               "}";
+        ASSERT_EQUALS(6, valueOfTok(code, "*").intvalue);
+        ASSERT_EQUALS(true, valueOfTok(code, "*").isKnown());
     }
 
     void valueFlowFunctionDefaultParameter() {