diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
index 6ac77d7cc174638ea1cb974d57057aac9a67234b..5c2f527c102c0809ec7c70bbc52e7561063e4411 100644
--- a/libiberty/ChangeLog
+++ b/libiberty/ChangeLog
@@ -1,3 +1,11 @@
+2007-03-15  Geoffrey Keating  <geoffk@apple.com>
+
+	* cp-demangle.c (d_encoding): Exit early on error.
+	(d_pointer_to_member_type): Exit early if cplus_demangle_type
+	returns NULL.
+	(cplus_demangle_type): Likewise.
+	* testsuite/demangle-expected: New testcase.
+
 2007-03-01  Brooks Moses  <brooks.moses@codesourcery.com>
 
 	* Makefile.in: Add install-pdf target as copied from
diff --git a/libiberty/cp-demangle.c b/libiberty/cp-demangle.c
index 1e775d9a9c1d8c4df4ece5724797ea86e0d3e181..5c930c6ab3f2045dc8c10d4e5b40f43bad0e851c 100644
--- a/libiberty/cp-demangle.c
+++ b/libiberty/cp-demangle.c
@@ -1067,7 +1067,7 @@ d_encoding (struct d_info *di, int top_level)
 	}
 
       peek = d_peek_char (di);
-      if (peek == '\0' || peek == 'E')
+      if (dc == NULL || peek == '\0' || peek == 'E')
 	return dc;
       return d_make_comp (di, DEMANGLE_COMPONENT_TYPED_NAME, dc,
 			  d_bare_function_type (di, has_return_type (dc)));
@@ -1780,7 +1780,7 @@ cplus_demangle_type (struct d_info *di)
       if (pret == NULL)
 	return NULL;
       *pret = cplus_demangle_type (di);
-      if (! d_add_substitution (di, ret))
+      if (! *pret || ! d_add_substitution (di, ret))
 	return NULL;
       return ret;
     }
@@ -2135,6 +2135,8 @@ d_pointer_to_member_type (struct d_info *di)
   if (pmem == NULL)
     return NULL;
   *pmem = cplus_demangle_type (di);
+  if (*pmem == NULL)
+    return NULL;
 
   if (pmem != &mem && (*pmem)->type != DEMANGLE_COMPONENT_FUNCTION_TYPE)
     {
diff --git a/libiberty/testsuite/demangle-expected b/libiberty/testsuite/demangle-expected
index 56d9f8991557f004dab06c1be2554aaf27f1fba2..471819e26c0fae971ac54c96098d8123e456c7b5 100644
--- a/libiberty/testsuite/demangle-expected
+++ b/libiberty/testsuite/demangle-expected
@@ -3838,3 +3838,7 @@ _ZNSA
 --format=gnu-v3
 _ZNT
 _ZNT
+# Dereferencing NULL in d_pointer_to_member_type
+--format=gnu-v3
+_Z1aMark
+_Z1aMark