Add missing protection to avoid reading before the start a string.

This fixes ROOT-5353.