From fc48b8ac2b595a8df5ad121b588d8820b3b6941d Mon Sep 17 00:00:00 2001
From: Niels Lohmann <mail@nlohmann.me>
Date: Tue, 28 Feb 2017 11:45:38 +0100
Subject: [PATCH] :bug: fixed a logical error

Treated the size of the range as the number of thousand separators.
This logical error yielded a negative value for written_bytes and
eventually an infinite loop, as written_bytes was converted to an
unsigned value.
---
 src/json.hpp      | 3 ++-
 src/json.hpp.re2c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/json.hpp b/src/json.hpp
index 3e5a45cf..5cf06249 100644
--- a/src/json.hpp
+++ b/src/json.hpp
@@ -6648,7 +6648,8 @@ class basic_json
             {
                 const auto end = std::remove(m_buf.begin(), m_buf.begin() + written_bytes, thousands_sep);
                 std::fill(end, m_buf.end(), '\0');
-                written_bytes -= (m_buf.end() - end);
+                assert((end - m_buf.begin()) <= written_bytes);
+                written_bytes = (end - m_buf.begin());
             }
 
             // convert decimal point to '.'
diff --git a/src/json.hpp.re2c b/src/json.hpp.re2c
index e648b41b..c7784266 100644
--- a/src/json.hpp.re2c
+++ b/src/json.hpp.re2c
@@ -6648,7 +6648,8 @@ class basic_json
             {
                 const auto end = std::remove(m_buf.begin(), m_buf.begin() + written_bytes, thousands_sep);
                 std::fill(end, m_buf.end(), '\0');
-                written_bytes -= (m_buf.end() - end);
+                assert((end - m_buf.begin()) <= written_bytes);
+                written_bytes = (end - m_buf.begin());
             }
 
             // convert decimal point to '.'