diff --git a/lib/checkleakautovar.cpp b/lib/checkleakautovar.cpp
index 551e475ce..0991bfdf0 100644
--- a/lib/checkleakautovar.cpp
+++ b/lib/checkleakautovar.cpp
@@ -465,7 +465,11 @@ void CheckLeakAutoVar::checkScope(const Token * const startToken,
 
                 // Recursively scan variable comparisons in condition
                 std::stack<const Token *> tokens;
-                tokens.push(tok->next()->astOperand2());
+                // Skip expressions before commas
+                const Token * astOperand2AfterCommas = tok->next()->astOperand2();
+                while (Token::simpleMatch(astOperand2AfterCommas, ","))
+                    astOperand2AfterCommas = astOperand2AfterCommas->astOperand2();
+                tokens.push(astOperand2AfterCommas);
                 while (!tokens.empty()) {
                     const Token *tok3 = tokens.top();
                     tokens.pop();
diff --git a/test/testleakautovar.cpp b/test/testleakautovar.cpp
index 7aea76b06..90d5d14ec 100644
--- a/test/testleakautovar.cpp
+++ b/test/testleakautovar.cpp
@@ -134,6 +134,7 @@ private:
         TEST_CASE(ifelse13); // #8392
         TEST_CASE(ifelse14); // #9130 - if (x == (char*)NULL)
         TEST_CASE(ifelse15); // #9206 - if (global_ptr = malloc(1))
+        TEST_CASE(ifelse16); // #9635 - if (p = malloc(4), p == NULL)
 
         // switch
         TEST_CASE(switch1);
@@ -1484,6 +1485,26 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void ifelse16() { // #9635
+        check("void f(void) {\n"
+              "    char *p;\n"
+              "    if(p = malloc(4), p == NULL)\n"
+              "        return;\n"
+              "    free(p);\n"
+              "    return;\n"
+              "}");
+        ASSERT_EQUALS("", errout.str());
+
+        check("void f(void) {\n"
+              "    char *p, q;\n"
+              "    if(p = malloc(4), q = 1, p == NULL)\n"
+              "        return;\n"
+              "    free(p);\n"
+              "    return;\n"
+              "}");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void switch1() {
         check("void f() {\n"
               "    char *p = 0;\n"