Fix #13367: (crash) nullptr dereference in checkStructMemberUsage() (#7063)

Author: ludviggunne

lib/checkunusedvar.cpp

@@ -1551,7 +1551,7 @@ void CheckUnusedVar::checkStructMemberUsage()
                 }
                 // Member referenced in offsetof
                 if (Token::Match(tok, ("offsetof ( struct| " + scope.className + " , %name%").c_str())) {
-                    tok = tok->astSibling()->astOperand2();
+                    tok = Token::simpleMatch(tok->tokAt(2), "struct") ? tok->tokAt(5) : tok->tokAt(4);
                     if (tok->str() == var.name()) {
                         use = true;
                         break;

test/testunusedvar.cpp

@@ -71,6 +71,7 @@ class TestUnusedVar : public TestFixture {
         TEST_CASE(structmember24); // #10847
         TEST_CASE(structmember25);
         TEST_CASE(structmember26); // #13345
+        TEST_CASE(structmember27); // #13367
         TEST_CASE(structmember_macro);
         TEST_CASE(classmember);
 
@@ -1971,6 +1972,17 @@ class TestUnusedVar : public TestFixture {
         ASSERT_EQUALS("", errout_str());
     }
 
+    void structmember27() { // #13367
+        checkStructMemberUsage("typedef struct pathNode_s {\n"
+                               "    struct pathNode_s*  next;\n"
+                               "} pathNode_t;\n"
+                               "void f() {\n"
+                               "    x<pathNode_t, offsetof( pathNode_t, next )> y;\n"
+                               "}\n");
+        ASSERT_EQUALS("", // don't crash
+                      errout_str());
+    }
+
     void structmember_macro() {
         checkStructMemberUsageP("#define S(n) struct n { int a, b, c; };\n"
                                 "S(unused);\n");