Problem p00769 (C++) — buggy submission, verdict: Runtime Error

#include <algorithm>
#include <cstdlib>
#include <cstring>
#include <iostream>
#include <sstream>
#include <string>
using namespace std;
int list[1000000];
stringstream sss;
void dfs(string str, int max);
int main() {
  int n, max, no, cnt, j;
  string str, ss;
  cin >> n;
  while (n--) {
    sss.str("");
    max = cnt = 0;
    cin >> str;
    for (int i = 0; i < str.size(); i++) {
      if (str[i] == '[') {
        cnt++;
        if (max < cnt)
          max = cnt;
      } else if (str[i] == ']')
        cnt--;
      else {
        for (j = i; str[j] != ']'; j++)
          ;
        ss = str.substr(i, j - i);
        no = atoi(ss.c_str());
        sss << (no / 2 + 1);
        ss = sss.str();
        str.erase(i, j - i);
        str.insert(i, ss);
        i = i + ss.size() - 1;
        sss.str("");
      }
    }
    dfs(str, max);
  }
}
void dfs(string str, int max) { // 文字列,段階
  int len = 0, cnt, x, l = str.size(), j, sum = 0;
  string ss;
  for (x = cnt = 0; cnt != max && x < l; x++) {
    if (str[x] == '[')
      cnt++;
    else if (str[x] == ']')
      cnt--;
  }
  if (x == l) {
    dfs(str, max - 1);
    return;
  }
  x--;
  for (int i = x, flg = 0; i < l; i++) {
    if (str[i] >= '0' && str[i] <= '9') {
      for (j = i; str[j] != ']'; j++)
        ;
      ss = str.substr(i, j - i);
      list[len] = atoi(ss.c_str());
      i = j, len++;
    } else if (str[i] == ']')
      flg--;
    if (flg == -1) {
      str.erase(x, i - x);
      break;
    }
  }
  sort(list, list + len);
  for (int i = 0; i < len / 2 + 1; i++)
    sum += list[i];
  sss << sum;
  ss = sss.str();
  str.insert(x, ss);
  sss.str("");
  if (max == 2) {
    l = str.size();
    for (int i = 1; i < l - 1; i++)
      cout << str[i];
    cout << endl;
    return;
  }
  dfs(str, max);
}

Error: -11

Fixed submission:

#include <algorithm>
#include <cstdlib>
#include <cstring>
#include <iostream>
#include <sstream>
#include <string>
using namespace std;
stringstream sss;
void dfs(string str, int max);
int main() {
  int n, max, no, cnt, j;
  string str, ss;
  cin >> n;
  while (n--) {
    sss.str("");
    max = cnt = 0;
    cin >> str;
    for (int i = 0; i < str.size(); i++) {
      if (str[i] == '[') {
        cnt++;
        if (max < cnt)
          max = cnt;
      } else if (str[i] == ']')
        cnt--;
      else {
        for (j = i; str[j] != ']'; j++)
          ;
        ss = str.substr(i, j - i);
        no = atoi(ss.c_str());
        sss << (no / 2 + 1);
        ss = sss.str();
        str.erase(i, j - i);
        str.insert(i, ss);
        i = i + ss.size() - 1;
        sss.str("");
      }
    }
    dfs(str, max);
  }
}
void dfs(string str, int max) { // 文字列,段階
  int list[1000000], len = 0, cnt, x, l = str.size(), j, sum = 0;
  string ss;
  for (x = cnt = 0; cnt != max && x < l; x++) {
    if (str[x] == '[')
      cnt++;
    else if (str[x] == ']')
      cnt--;
  }
  if (x == l) {
    dfs(str, max - 1);
    return;
  }
  x--;
  for (int i = x, flg = 0; i < l; i++) {
    if (str[i] >= '0' && str[i] <= '9') {
      for (j = i; str[j] != ']'; j++)
        ;
      ss = str.substr(i, j - i);
      list[len] = atoi(ss.c_str());
      i = j, len++;
    } else if (str[i] == ']')
      flg--;
    if (flg == -1) {
      str.erase(x, i - x);
      break;
    }
  }
  sort(list, list + len);
  for (int i = 0; i < len / 2 + 1; i++)
    sum += list[i];
  sss << sum;
  ss = sss.str();
  str.insert(x, ss);
  sss.str("");
  if (max == 2) {
    l = str.size();
    for (int i = 1; i < l - 1; i++)
      cout << str[i];
    cout << endl;
    return;
  }
  dfs(str, max);
}