crashtesting: ooo95537-1.xls fails with a fAnz that is nan

so it happily passes the pre-cast string bounds check and blows
up in the post-cast string access

Change-Id: Ifd4d087b37e8a84d886e2f7833dfc773b8bf1343
(cherry picked from commit 5d826db1)
Reviewed-on: https://gerrit.libreoffice.org/19280Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>

sc/source/core/tool/interpr1.cxx

@@ -7830,17 +7830,17 @@ void ScInterpreter::ScFind()
     sal_uInt8 nParamCount = GetByte();
     if ( MustHaveParamCount( nParamCount, 2, 3 ) )
     {
-        double fAnz;
+        sal_Int32 nAnz;
         if (nParamCount == 3)
-            fAnz = GetDouble();
+            nAnz = GetDouble();
         else
-            fAnz = 1.0;
+            nAnz = 1;
         OUString sStr = GetString().getString();
-        if( fAnz < 1.0 || fAnz > (double) sStr.getLength() )
+        if (nAnz < 1 || nAnz > sStr.getLength())
             PushNoValue();
         else
         {
-            sal_Int32 nPos = sStr.indexOf(GetString().getString(), static_cast<sal_Int32>(fAnz - 1));
+            sal_Int32 nPos = sStr.indexOf(GetString().getString(), nAnz - 1);
             if (nPos == -1)
                 PushNoValue();
             else