sw: fix string accesses in SwScanner::NextWord() (related: tdf#109081)

getWordBoundary() can return bounds that do not include the starting
nPos, if there are ZWSP characters at the starting position.

This happens in the bugdoc of tdf#109081 where paragraph starts with 3
ZWSP and then 5 dashes, SwScanner is created from 0 to 1 and bounds are
3 to 8.

Change-Id: I5fc41b98568a7211fc7d5f29bb87840371a4c005

sw/source/core/txtnode/txtedt.cxx

@@ -941,8 +941,16 @@ bool SwScanner::NextWord()
     {
         aBound.startPos = std::max( aBound.startPos, nStartPos );
         aBound.endPos = std::min( aBound.endPos, nEndPos );
-        nBegin = aBound.startPos;
-        nLen = aBound.endPos - nBegin;
+        if (aBound.endPos < aBound.startPos)
+        {
+            nBegin = nEndPos;
+            nLen = 0; // found word is outside of search interval
+        }
+        else
+        {
+            nBegin = aBound.startPos;
+            nLen = aBound.endPos - nBegin;
+        }
     }
 
     if( ! nLen )