[Bug](function) core dump on substr #13007

be/src/vec/functions/function_string.h

@@ -187,6 +187,10 @@ private:
             }
 
             int fixed_pos = start[i];
+            if (fixed_pos < -(int)index.size()) {
+                StringOP::push_empty_string(i, res_chars, res_offsets);
+                continue;
+            }
             if (fixed_pos < 0) {
                 fixed_pos = index.size() + fixed_pos + 1;
             }

regression-test/data/query_p0/sql_functions/string_functions/test_string_function.out

@@ -236,3 +236,24 @@ c1
 -- !sql --
 bc
 
+-- !sql --
+
+
+-- !sql --
+
+
+-- !sql --
+a
+
+-- !sql --
+
+
+-- !sql --
+a
+
+-- !sql --
+
+
+-- !sql --
+
+

regression-test/suites/query_p0/sql_functions/string_functions/test_string_function.groovy

@@ -125,4 +125,11 @@ suite("test_string_function") {
     qt_sql "select substring('abc1', 5);"
     qt_sql "select substring('abc1def', 2, 2);"
 
+    qt_sql "select substr('a',3,1);"
+    qt_sql "select substr('a',2,1);"
+    qt_sql "select substr('a',1,1);"
+    qt_sql "select substr('a',0,1);"
+    qt_sql "select substr('a',-1,1);"
+    qt_sql "select substr('a',-2,1);"
+    qt_sql "select substr('a',-3,1);"
 }