Bug fix: UTF->substr() with negative offset and specified length