diff --git a/lib/checkvaarg.cpp b/lib/checkvaarg.cpp
index 4b8f8b2d7..522daa631 100644
--- a/lib/checkvaarg.cpp
+++ b/lib/checkvaarg.cpp
@@ -92,7 +92,7 @@ void CheckVaarg::va_list_usage()
         bool exitOnEndOfStatement = false;
 
         const Token* tok = var->nameToken()->next();
-        for (; tok != var->scope()->classEnd; tok = tok->next()) {
+        for (;  tok && tok != var->scope()->classEnd; tok = tok->next()) {
             if (Token::Match(tok, "va_start ( %varid%", var->declarationId())) {
                 if (open)
                     va_start_subsequentCallsError(tok, var->name());
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index 0adae02f2..fbaaae122 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -84,6 +84,7 @@ private:
         TEST_CASE(garbageCode43); // #6703
         TEST_CASE(garbageCode44); // #6704
         TEST_CASE(garbageCode45); // #6608
+        TEST_CASE(garbageCode46); // #6705
 
         TEST_CASE(garbageValueFlow);
         TEST_CASE(garbageSymbolDatabase);
@@ -485,6 +486,10 @@ private:
         checkCode("struct true template < > { = } > struct Types \"s\" ; static_assert < int > ;");
     }
 
+    void garbageCode46() { // #6705
+        checkCode(" { bar(char *x); void foo (int ...) { struct } va_list ap; va_start(ap, size); va_arg(ap, (d)); }");
+    }
+
     void garbageValueFlow() {
         // #6089
         const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n"