fix string access out of bounds

Could happen with a malformed subformat string like "[<0-0".

Change-Id: I8eaab2bcb469d91432a41dc349060c273a6575a4
(cherry picked from commit f52aa4d1)
Reviewed-on: https://gerrit.libreoffice.org/16939Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

svl/source/numbers/zformat.cxx

@@ -697,7 +697,7 @@ SvNumberformat::SvNumberformat(OUString& rString,
                     {
                         fLimit2 = fNumber;
                     }
-                    if ( sBuff[nPos] == ']' )
+                    if ( nPos < sBuff.getLength() && sBuff[nPos] == ']' )
                     {
                         nPos++;
                     }