Resolves: tdf#92993 access violation on particular .docx on glyph layout

Change-Id: I69dfd6747e37ddb1727dd41b99d1b70eaed83425
(cherry picked from commit ae850353)
Reviewed-on: https://gerrit.libreoffice.org/19095Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Miklos Vajna <vmiklos@collabora.co.uk>

vcl/source/gdi/sallayout.cxx

@@ -1720,8 +1720,9 @@ void MultiSalLayout::AdjustLayout( ImplLayoutArgs& rArgs )
         maFallbackRuns[n].ResetPos();
     // get the next codepoint index that needs fallback
     int nActiveCharPos = nCharPos[0];
+    int nActiveCharIndex = nActiveCharPos - mnMinCharPos;
     // get the end index of the active run
-    int nLastRunEndChar = (vRtl[nActiveCharPos - mnMinCharPos])?
+    int nLastRunEndChar = (nActiveCharIndex >= 0 && vRtl[nActiveCharIndex]) ?
         rArgs.mnEndCharPos : rArgs.mnMinCharPos - 1;
     int nRunVisibleEndChar = nCharPos[0];
     // merge the fallback levels
@@ -1870,7 +1871,8 @@ void MultiSalLayout::AdjustLayout( ImplLayoutArgs& rArgs )
             if( !bLTR )
                 nOldRunAdv = -nOldRunAdv;
 #endif
-            if (vRtl[nActiveCharPos - mnMinCharPos])
+            nActiveCharIndex = nActiveCharPos - mnMinCharPos;
+            if (nActiveCharIndex >= 0 && vRtl[nActiveCharIndex])
             {
               if (nRunVisibleEndChar > mnMinCharPos && nRunVisibleEndChar <= mnEndCharPos)
                   nRunAdvance -= aMultiArgs.mpDXArray[nRunVisibleEndChar - 1 - mnMinCharPos];