From ca0c13e27de6179d7dd155faca3d6bd2297a0e68 Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Thu, 26 Jan 2023 22:25:49 +0100
Subject: [PATCH] Fix crash in iscpp11init_impl() (#4743)

---
 lib/tokenlist.cpp     | 2 +-
 test/testtokenize.cpp | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/tokenlist.cpp b/lib/tokenlist.cpp
index 4cc7ce3b6..e449a2379 100644
--- a/lib/tokenlist.cpp
+++ b/lib/tokenlist.cpp
@@ -677,7 +677,7 @@ static bool iscpp11init_impl(const Token * const tok)
         return false; // trailing return type. The only function body that can contain no semicolon is a void function.
     if (Token::simpleMatch(nameToken->previous(), "namespace") || Token::simpleMatch(nameToken, "namespace") /*anonymous namespace*/)
         return false;
-    if (endtok != nullptr && !Token::Match(nameToken, "return|:")) {
+    if (precedes(nameToken->next(), endtok) && !Token::Match(nameToken, "return|:")) {
         // If there is semicolon between {..} this is not a initlist
         for (const Token *tok2 = nameToken->next(); tok2 != endtok; tok2 = tok2->next()) {
             if (tok2->str() == ";")
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index 2887352e2..f49a18244 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -7654,6 +7654,9 @@ private:
                         "};\n",
                         "{ } }",
                         TokenImpl::Cpp11init::NOINIT);
+
+        ASSERT_NO_THROW(tokenizeAndStringify("template<typename U> struct X {};\n" // don't crash
+                                             "template<typename T> auto f(T t) -> X<decltype(t + 1)> {}\n"));
         #undef testIsCpp11init
     }
 };