Fix #14917 fuzzing crash (null-pointer-use) in ReverseTraversal::traverse()

Author: web-flow

lib/tokenize.cpp

@@ -3764,6 +3764,9 @@ void Tokenizer::concatenateNegativeNumberAndAnyPositive()
 
         if (tok->findOpeningBracket())
             continue;
+        
+        if (!tok->tokAt(2) || (tok->tokAt(2)->isOp() && !Token::Match(tok->tokAt(2), "[+-]")))
+            syntaxError(tok);
 
         while (tok->str() != ">" && tok->next() && tok->strAt(1) == "+" && (!Token::Match(tok->tokAt(2), "%name% (|;") || Token::Match(tok, "%op%")))
             tok->deleteNext();

test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489

@@ -0,0 +1 @@
+n(S=n){n*,+&&n}