diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 4d1f87560..c9589481d 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -1374,6 +1374,8 @@ void Tokenizer::simplifyTypedef()
                 // check for member functions
                 else if (Token::Match(tok2, ") const| {")) {
                     const Token *func = tok2->link()->previous();
+                    if (!func)
+                        continue;
 
                     /** @todo add support for multi-token operators */
                     if (func->previous()->str() == "operator")
diff --git a/test/testsimplifytokens.cpp b/test/testsimplifytokens.cpp
index 7c945badd..ce2a50924 100644
--- a/test/testsimplifytokens.cpp
+++ b/test/testsimplifytokens.cpp
@@ -281,6 +281,7 @@ private:
         TEST_CASE(simplifyTypedef102); // ticket #3004
         TEST_CASE(simplifyTypedef103); // ticket #3007
         TEST_CASE(simplifyTypedef104); // ticket #3070
+        TEST_CASE(simplifyTypedef105); // ticket #3616
 
         TEST_CASE(simplifyTypedefFunction1);
         TEST_CASE(simplifyTypedefFunction2); // ticket #1685
@@ -5732,6 +5733,12 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void simplifyTypedef105() { // ticket #3616 (segmentation fault)
+        const char code[] = "( int typedef char x; ){}\n";
+        sizeof_(code);
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void simplifyTypedefFunction1() {
         {
             const char code[] = "typedef void (*my_func)();\n"