Fix #14917 fuzzing crash (null-pointer-use) in ReverseTraversal::traverse() (#8800)

Co-authored-by: chrchr-github <noreply@github.com>

Author: chrchr-github

lib/tokenize.cpp

@@ -3768,6 +3768,9 @@ void Tokenizer::concatenateNegativeNumberAndAnyPositive()
         if (tok->findOpeningBracket())
             continue;
 
+        if (!tok->tokAt(2) || (tok->tokAt(2)->isOp() && !Token::Match(tok->tokAt(2), "[+-]")))
+            syntaxError(tok);
+
         while (tok->str() != ">" && tok->next() && tok->strAt(1) == "+" && (!Token::Match(tok->tokAt(2), "%name% (|;") || Token::Match(tok, "%op%")))
             tok->deleteNext();
 

test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489

@@ -0,0 +1 @@
+n(S=n){n*,+&&n}