Fix #13296 nullptr dereference in CheckLeakAutoVar::checkScope() (#6995)

Author: chrchr-github

lib/checkleakautovar.cpp

@@ -455,7 +455,7 @@ bool CheckLeakAutoVar::checkScope(const Token * const startToken,
             bool skipElseBlock = false;
             const Token *condTok = tok->astSibling();
 
-            if (condTok->hasKnownIntValue()) {
+            if (condTok && condTok->hasKnownIntValue()) {
                 skipIfBlock = !condTok->getKnownIntValue();
                 skipElseBlock = !skipIfBlock;
             }

test/testleakautovar.cpp

@@ -151,6 +151,7 @@ class TestLeakAutoVar : public TestFixture {
         TEST_CASE(ifelse26);
         TEST_CASE(ifelse27);
         TEST_CASE(ifelse28); // #11038
+        TEST_CASE(ifelse29);
 
         // switch
         TEST_CASE(switch1);
@@ -2322,6 +2323,18 @@ class TestLeakAutoVar : public TestFixture {
         ASSERT_EQUALS("", errout_str());
     }
 
+    void ifelse29() { // #13296
+        check("struct S {\n"
+              "    typedef int (S::* func_t)(int) const;\n"
+              "    void f(func_t pfn);\n"
+              "    int g(int) const;\n"
+              "};\n"
+              "void S::f(func_t pfn) {\n"
+              "    if (pfn == (func_t)&S::g) {}\n"
+              "}\n", true);
+        ASSERT_EQUALS("", errout_str()); // don't crash
+    }
+
     void switch1() {
         check("void f() {\n"
               "    char *p = 0;\n"