ensure string accesses are in bounds

as demonstrated by ooo39541-3.rtf

Change-Id: I995f0250e98a68b1b56da877314c9fd24cf46221