Fix #14438 fuzzing crash (null-pointer-use) in singleAssignInScope() (danmar#8201)

Author: chrchr-github

lib/tokenize.cpp

@@ -9018,8 +9018,8 @@ void Tokenizer::findGarbageCode() const
             syntaxError(tok);
         if (Token::Match(tok, "? %assign%"))
             syntaxError(tok);
-        if (Token::Match(tok, "!|~ %comp%") &&
-            !(cpp && tok->strAt(1) == ">" && Token::simpleMatch(tok->tokAt(-1), "operator")))
+        if (Token::Match(tok, "[!~+-/] %comp%") &&
+            !(cpp && Token::Match(tok->next(), "[<>]") && Token::simpleMatch(tok->tokAt(-1), "operator")))
             syntaxError(tok);
         if (Token::Match(tok, "%comp% {") && (!cpp || tok->str() != ">"))
             syntaxError(tok);

test/cli/fuzz-crash/crash-c540e04fe675639b7ead821efc2f5c037b6c89e0

@@ -0,0 +1 @@
+o o(){i n;for(i x:v)n=n+<1;}

test/testgarbage.cpp

@@ -848,7 +848,7 @@ class TestGarbage : public TestFixture {
     }
 
     void garbageCode95() { // #6804
-        ASSERT_THROW_INTERNAL(checkCode("{ } x x ; { } h h [ ] ( ) ( ) { struct x ( x ) ; int __attribute__ ( ) f ( ) { h - > first = & x ; struct x * n = h - > first ; ( ) n > } }"), AST); // do not crash
+        ASSERT_THROW_INTERNAL(checkCode("{ } x x ; { } h h [ ] ( ) ( ) { struct x ( x ) ; int __attribute__ ( ) f ( ) { h - > first = & x ; struct x * n = h - > first ; ( ) n > } }"), SYNTAX); // do not crash
     }
 
     void garbageCode96() { // #6807