Added sanity check for underflow of size_t