Add missing protection to avoid reading before the start a string.

This fixes ROOT-5353.
(cherry picked from v5-34-00-patches commit 249bf475cdf220978e428e57f95b1cfea693cba9)