fix: check size before substr()