avoid out of bounds string access

as demonstrated by ooo109591-1.doc

Change-Id: I91b4940828038561885e8d3a109c40a668aeb15b

sw/source/core/text/itrform2.cxx

@@ -467,7 +467,11 @@ void SwTxtFormatter::BuildPortions( SwTxtFormatInfo &rInf )
                 }
             }
             else
-                bAllowBehind = rCC.isLetterNumeric( rInf.GetTxt(), rInf.GetIdx() );
+            {
+                const OUString& rTxt = rInf.GetTxt();
+                sal_Int32 nIdx = rInf.GetIdx();
+                bAllowBehind = nIdx < rTxt.getLength() ? rCC.isLetterNumeric(rTxt, nIdx) : false;
+            }
 
             const SwLinePortion* pLast = rInf.GetLast();
             if ( bAllowBehind && pLast )