Fixed #3618 (segmentation fault of cppcheck)

lib/tokenize.cpp

@@ -487,6 +487,9 @@ static Token *processFunc(Token *tok2, bool inOperator)
                 while (Token::Match(tok2, "%var% ::"))
                     tok2 = tok2->tokAt(2);
 
+                if (!tok2)
+                    return NULL;
+
                 if (tok2->str() == "(" &&
                     tok2->link()->next()->str() == "(") {
                     tok2 = tok2->link();
@@ -1198,6 +1201,9 @@ void Tokenizer::simplifyTypedef()
                         if (!inCast)
                             tok2 = processFunc(tok2, inOperator);
 
+                        if (!tok2)
+                            break;
+
                         tok2->insertToken(")");
                         tok2 = tok2->next();
                         Token::createMutualLinks(tok2, tok3);

test/testtokenize.cpp

@@ -61,6 +61,7 @@ private:
         TEST_CASE(wrong_syntax1);
         TEST_CASE(wrong_syntax2);
         TEST_CASE(wrong_syntax3); // #3544
+        TEST_CASE(wrong_syntax4); // #3618
         TEST_CASE(wrong_syntax_if_macro);  // #2518 - if MACRO()
 
         TEST_CASE(minus);
@@ -671,6 +672,12 @@ private:
         tokenizeAndStringify(code);
     }
 
+    void wrong_syntax4() {   // #3618
+        const char code[] = "typedef void (x) (int);    return x&";
+
+        tokenizeAndStringify(code);
+    }
+
     void wrong_syntax_if_macro() {
         // #2518
         const std::string code("void f() { if MACRO(); }");