Fix StringFunctions::SubString()

Without this patch, the returned StringValue's ptr would be before the
input pointer if the 'pos' argument was < -input.len

Change-Id: I7bd506f5d1119741a94817c34a017215b67cc26e
Reviewed-on: http://gerrit.ent.cloudera.com:8080/3351
Reviewed-by: Nong Li <nong@cloudera.com>
Tested-by: jenkins