diff --git a/lib/checkbufferoverrun.cpp b/lib/checkbufferoverrun.cpp
index d28ac7c64f7..246d428802e 100644
--- a/lib/checkbufferoverrun.cpp
+++ b/lib/checkbufferoverrun.cpp
@@ -575,7 +575,7 @@ ValueFlow::Value CheckBufferOverrunImpl::getBufferSize(const Token *bufTok, cons
         if (const ValueFlow::Value *value = getBufferSizeValue(bufTok)) {
             if (value->isBufferSizeValue())
                 return *value;
-            if (value->isContainerSizeValue() && bufTok->valueType() && bufTok->valueType()->container) {
+            if (value->isContainerSizeValue() && bufTok->valueType() && bufTok->valueType()->containerTypeToken) {
                 const ValueType vtElement = ValueType::parseDecl(bufTok->valueType()->containerTypeToken, settings);
                 const size_t elementSize = vtElement.getSizeOf(settings, ValueType::Accuracy::ExactOrZero, ValueType::SizeOf::Pointer);
                 if (elementSize > 0) {
diff --git a/test/testbufferoverrun.cpp b/test/testbufferoverrun.cpp
index f9e55910c01..b44fd742ab1 100644
--- a/test/testbufferoverrun.cpp
+++ b/test/testbufferoverrun.cpp
@@ -3551,6 +3551,12 @@ class TestBufferOverrun : public TestFixture {
               "    std::memset(&buf[0], 0, 26);\n"
               "}\n");
         ASSERT_EQUALS("[test.cpp:3:17]: (error) Buffer is accessed out of bounds: &buf[0] [bufferAccessOutOfBounds]\n", errout_str());
+
+        check("void f(FILE *fp) {\n" // #14929
+              "    std::string s;\n"
+              "    fwrite(&s, 1, 1, fp);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout_str()); // don't crash
     }
 
     void buffer_overrun_errorpath() {