diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 418782a32..a6e3a06f1 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -1369,17 +1369,18 @@ static bool valueFlowForward(Token * const               startToken,
         // If a ? is seen and it's known that the condition is true/false..
         else if (tok2->str() == "?") {
             const Token *condition = tok2->astOperand1();
-            if (!condition) // Ticket #6713
+            const Token *op2 = tok2->astOperand2();
+            if (!condition || !op2) // Ticket #6713
                 continue;
             std::list<ValueFlow::Value>::const_iterator it;
             for (it = values.begin(); it != values.end(); ++it) {
                 const ProgramMemory programMemory(getProgramMemory(tok2, varid, *it));
                 if (conditionIsTrue(condition, programMemory))
-                    valueFlowAST(const_cast<Token*>(tok2->astOperand2()->astOperand1()), varid, *it);
+                    valueFlowAST(const_cast<Token*>(op2->astOperand1()), varid, *it);
                 else if (conditionIsFalse(condition, programMemory))
-                    valueFlowAST(const_cast<Token*>(tok2->astOperand2()->astOperand2()), varid, *it);
+                    valueFlowAST(const_cast<Token*>(op2->astOperand2()), varid, *it);
                 else
-                    valueFlowAST(const_cast<Token*>(tok2->astOperand2()), varid, *it);
+                    valueFlowAST(const_cast<Token*>(op2), varid, *it);
             }
             // Skip conditional expressions..
             while (tok2->astOperand1() || tok2->astOperand2()) {
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index f8c312fd1..cbcf28d56 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -203,7 +203,7 @@ private:
         TEST_CASE(garbageCode152); // travis after 9c7271a5
         TEST_CASE(garbageCode153);
         TEST_CASE(garbageCode154); // #7112
-
+        TEST_CASE(garbageCode155); // #7118
 
         TEST_CASE(garbageValueFlow);
         TEST_CASE(garbageSymbolDatabase);
@@ -1223,6 +1223,10 @@ private:
         checkCode("\"abc\"[];");
     }
 
+    void garbageCode155() { // #7118
+        checkCode("&p(!{}e x){({(0?:?){({})}()})}");
+    }
+
     void garbageValueFlow() {
         // #6089
         const char* code = "{} int foo(struct, x1, struct x2, x3, int, x5, x6, x7)\n"