diff --git a/lib/token.cpp b/lib/token.cpp
index c7bcc6ff7..20bf8fa19 100644
--- a/lib/token.cpp
+++ b/lib/token.cpp
@@ -1211,7 +1211,7 @@ std::string Token::expressionString() const
 
     // move start to lpar in such expression: '(*it).x'
     int par = 0;
-    for (const Token *tok = start; tok != end; tok = tok->next()) {
+    for (const Token *tok = start; tok && tok != end; tok = tok->next()) {
         if (tok->str() == "(")
             ++par;
         else if (tok->str() == ")") {
@@ -1224,7 +1224,7 @@ std::string Token::expressionString() const
 
     // move end to rpar in such expression: '2>(x+1)'
     par = 0;
-    for (const Token *tok = end; tok != start; tok = tok->previous()) {
+    for (const Token *tok = end; tok && tok != start; tok = tok->previous()) {
         if (tok->str() == ")")
             ++par;
         else if (tok->str() == "(") {
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index b89ef5e9b..090632f49 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -171,6 +171,7 @@ private:
         TEST_CASE(garbageCode129); // #7020
         TEST_CASE(garbageCode130); // #7021
         TEST_CASE(garbageCode131); // #7023
+        TEST_CASE(garbageCode132); // #7022
 
         TEST_CASE(garbageValueFlow);
         TEST_CASE(garbageSymbolDatabase);
@@ -989,6 +990,10 @@ private:
         // actually the invalid code should trigger an syntax error...
     }
 
+    void garbageCode132() { // #7022
+        checkCode("() () { } { () () ({}) i() } void i(void(*ptr) ()) { ptr(!) () }");
+    }
+
 
     void garbageValueFlow() {
         // #6089