tdf#94008 Crash opening password protected file - CJK UI

This fixes a buffer overflow writing over the end of pCaretXArray,
which can happen e.g. when drawing mnemonics in the password dialog.
Based on a similar calculation of nCurrIdx found in
GenericSalLayout::GetCaretPositions().

Change-Id: I7d723cf8cfaeb66f340c7d9ea5b3bc728c6d6209
Reviewed-on: https://gerrit.libreoffice.org/19385Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: jan iversen <jani@documentfoundation.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit f630b6d5)
Reviewed-on: https://gerrit.libreoffice.org/20031Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>

vcl/win/source/gdi/winlayout.cxx

@@ -1905,7 +1905,7 @@ void UniscribeLayout::GetCaretPositions( int nMaxIdx, long* pCaretXArray ) const
         for(; (i < rVisualItem.mnEndCharPos) && (i < mnEndCharPos); ++i )
         {
             int j = mpLogClusters[ i ] + rVisualItem.mnMinGlyphPos;
-            int nCurrIdx = i * 2;
+            int nCurrIdx = (i - mnMinCharPos) * 2;
             if( !rVisualItem.IsRTL() )
             {
                 // normal positions for LTR case