fixed out-of-bounds bug in operator-()