From 05bd396ee66a6d5e72f396e25f89108075a9cedc Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Tue, 14 Jul 2026 10:17:49 +0200
Subject: [PATCH 1/3] Update tokenlist.cpp

---
 lib/tokenlist.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tokenlist.cpp b/lib/tokenlist.cpp
index 594de5c0295..7af49f96172 100644
--- a/lib/tokenlist.cpp
+++ b/lib/tokenlist.cpp
@@ -1946,6 +1946,9 @@ void TokenList::validateAst(bool print) const
         // Syntax error if binary operator only has 1 operand
         if ((tok->isAssignmentOp() || tok->isComparisonOp() || Token::Match(tok,"[|^/%]")) && tok->astOperand1() && !tok->astOperand2())
             throw InternalError(tok, "Syntax Error: AST broken, binary operator has only one operand.", InternalError::AST);
+        
+        if (isC() && !(tok->astOperand1() && tok->astOperand2()) && Token::Match(tok, "&&|%or%|%oror%"))
+            throw InternalError(tok, "Syntax Error: AST broken, binary operator is missing operand(s).", InternalError::AST);
 
         // Syntax error if we encounter "?" with operand2 that is not ":"
         if (tok->str() == "?") {

From 4869ae52e845ecb0f6cbeb309a01372ecfef1419 Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Tue, 14 Jul 2026 10:18:50 +0200
Subject: [PATCH 2/3] Create crash-85cab41781812453dfc8e74e1f0b915225f7a0a1

---
 .../fuzz-crash_c/crash-85cab41781812453dfc8e74e1f0b915225f7a0a1  | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 test/cli/fuzz-crash_c/crash-85cab41781812453dfc8e74e1f0b915225f7a0a1

diff --git a/test/cli/fuzz-crash_c/crash-85cab41781812453dfc8e74e1f0b915225f7a0a1 b/test/cli/fuzz-crash_c/crash-85cab41781812453dfc8e74e1f0b915225f7a0a1
new file mode 100644
index 00000000000..a2e58c69ea7
--- /dev/null
+++ b/test/cli/fuzz-crash_c/crash-85cab41781812453dfc8e74e1f0b915225f7a0a1
@@ -0,0 +1 @@
+n(f=n){n&&,n}

From e1230e10cebc1ff4782e0c9a14f4005df5328e29 Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Tue, 14 Jul 2026 11:22:26 +0200
Subject: [PATCH 3/3] Update tokenlist.cpp

---
 lib/tokenlist.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/tokenlist.cpp b/lib/tokenlist.cpp
index 7af49f96172..53d1c4f94dd 100644
--- a/lib/tokenlist.cpp
+++ b/lib/tokenlist.cpp
@@ -1946,8 +1946,8 @@ void TokenList::validateAst(bool print) const
         // Syntax error if binary operator only has 1 operand
         if ((tok->isAssignmentOp() || tok->isComparisonOp() || Token::Match(tok,"[|^/%]")) && tok->astOperand1() && !tok->astOperand2())
             throw InternalError(tok, "Syntax Error: AST broken, binary operator has only one operand.", InternalError::AST);
-        
-        if (isC() && !(tok->astOperand1() && tok->astOperand2()) && Token::Match(tok, "&&|%or%|%oror%"))
+
+        if (!(tok->astOperand1() && tok->astOperand2()) && ((isC() && tok->str() == "&&") || Token::Match(tok, "%or%|%oror%")))
             throw InternalError(tok, "Syntax Error: AST broken, binary operator is missing operand(s).", InternalError::AST);
 
         // Syntax error if we encounter "?" with operand2 that is not ":"