diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 27be2e544a2..57ed921f50c 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -3765,6 +3765,9 @@ void Tokenizer::concatenateNegativeNumberAndAnyPositive()
         if (tok->findOpeningBracket())
             continue;
 
+        if (!tok->tokAt(2) || (tok->tokAt(2)->isOp() && !Token::Match(tok->tokAt(2), "[+-]")))
+            syntaxError(tok);
+
         while (tok->str() != ">" && tok->next() && tok->strAt(1) == "+" && (!Token::Match(tok->tokAt(2), "%name% (|;") || Token::Match(tok, "%op%")))
             tok->deleteNext();
 
diff --git a/test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489 b/test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489
new file mode 100644
index 00000000000..3b81bf6f322
--- /dev/null
+++ b/test/cli/fuzz-crash_c/crash-8a4f047728c598ad00d835c16e7fbef5e43e8489
@@ -0,0 +1 @@
+n(S=n){n*,+&&n}
\ No newline at end of file