ofz#2867 null deref

Change-Id: If856473683685d79d88b024f7fafa2920b403bb7
Reviewed-on: https://gerrit.libreoffice.org/40792Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

sc/qa/unit/data/slk/pass/numfmt-2.slk

+P;P                                                                                         d S0
\ No newline at end of file

svl/source/numbers/zforscan.cxx

@@ -2565,17 +2565,20 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                             nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
                             OUString& rStr = sStrArray[i];
                             i++;
-                            nPos = nPos + sStrArray[i].getLength();
-                            nCounter++;
-                            while (i < nStringsCnt &&
-                                   sStrArray[i][0] == '0')
+                            if (i < nStringsCnt)
                             {
-                                rStr += sStrArray[i];
                                 nPos = nPos + sStrArray[i].getLength();
-                                nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
-                                nResultStringsCnt--;
                                 nCounter++;
-                                i++;
+                                while (i < nStringsCnt &&
+                                       sStrArray[i][0] == '0')
+                                {
+                                    rStr += sStrArray[i];
+                                    nPos = nPos + sStrArray[i].getLength();
+                                    nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+                                    nResultStringsCnt--;
+                                    nCounter++;
+                                    i++;
+                                }
                             }
                         }
                         else