member access within null pointer of type 'struct ListNode'

You only make sure that runner->next is not null, however after assignment

runner = runner->next->next;

runner can become null.