clamp count in string_impl::replace_unchecked

[Ramya-9353]

Repro: boost::json::string("hello").replace(0, 100, 0, 'x') — the count exceeds size() - pos.
Cause: string_impl::replace_unchecked doesn't clamp n1 to size() - pos, so curr_size - pos - n1 + 1 underflows and the memmove runs a near-SIZE_MAX length out of bounds (ASAN: negative-size-param at string_impl.ipp:409). Overload (4) string::replace(pos, count, count2, ch) forwards count unchanged, though it is documented to replace std::min(count, size() - pos) characters. The string_view overload already clamps via string_impl::replace.
Fix: clamp n1 to size() - pos, matching string_impl::replace.

[cppalliance-bot]

An automated preview of the documentation is available at https://1166.json.prtest2.cppalliance.org/libs/json/doc/html/index.html

If more commits are pushed to the pull request, the docs will rebuild at the same URL.

2026-07-06 09:58:51 UTC

[cppalliance-bot]

GCOVR code coverage report https://1166.json.prtest2.cppalliance.org/gcovr/index.html
LCOV code coverage report https://1166.json.prtest2.cppalliance.org/genhtml/index.html
Coverage Diff Report https://1166.json.prtest2.cppalliance.org/diff-report/index.html

Build time: 2026-07-06 10:10:21 UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.90%. Comparing base (9e0d94d) to head (e4cbf87).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #1166   +/-   ##
========================================
  Coverage    93.90%   93.90%           
========================================
  Files           91       91           
  Lines         9256     9257    +1     
========================================
+ Hits          8692     8693    +1     
  Misses         564      564           

Files with missing lines	Coverage Δ
include/boost/json/detail/impl/string_impl.ipp	99.11% <100.00%> (+<0.01%)	⬆️

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9e0d94d...e4cbf87. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cppalliance-bot]

Benchmark test results. More info at https://benchmark.cppalliance.org/jsonbenchmarks-pullrequests/1166/pullrequest.html

[grisumbras]

Thank you for catching this.

[Ramya-9353]

Thanks for the quick merge, glad it was straightforward to land.