clang: prevent access to invalid cursor