c++地址越界错误求解

问题遇到的现象和发生背景

给定一个数组 ，将该数组中的每个元素替换为其右侧元素中最大的元素，并将最后一个元素替换为-1，执行此操作后，返回数组。
Input:
arr = [17,18,5,4,6,1]
Output: [18,6,6,6,1,-1]

问题相关代码，请勿粘贴截图

class Solution {
public:
    vector<int> replaceElements(vector<int>& arr) {
        int slow=0;
        int max=0;
        for(int j=0;j<=arr.size()-3;j++){
           for(int i=j+1;i<=arr.size()-1;i++){
               if(max<arr[i]){
                   max=arr[i];
               }                 
           }
            arr[j]=max; 
            max=0;
        }
        slow=arr.size();
        arr[slow-2]=arr[slow-1];
        arr[slow-1]=-1;
        return arr;
    }
};

运行结果及报错内容

=================================================================
==31==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000134 at pc 0x000000345b46 bp 0x7ffd1e168350 sp 0x7ffd1e168348
WRITE of size 4 at 0x602000000134 thread T0
    #2 0x7fc24e5160b2  (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
0x602000000134 is located 0 bytes to the right of 4-byte region [0x602000000130,0x602000000134)
allocated by thread T0 here:
    #6 0x7fc24e5160b2  (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
Shadow bytes around the buggy address:
  0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff8000: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8010: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
=>0x0c047fff8020: fa fa fd fa fa fa[04]fa fa fa fa fa fa fa fa fa
  0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==31==ABORTING

我的解答思路和尝试过的方法

将两个for循环中的<换为<=

我想要达到的结果

在不改变思路逻辑的条件下找出找出错误并解决问题

class Solution {
public:
    vector<int> replaceElements(vector<int>& arr) {
        int slow=0;
        int max=0;
        for(int j=0;j<=arr.size()-3;j++){
           for(int i=j+1;i<=arr.size()-1;i++){
               if(max<arr[i]){
                   max=arr[i];
               }                 
           }
            arr[j]=max; 
            max=0;
        }
        slow=arr.size();
        if (slow > 1) {
          arr[slow-2]=arr[slow-1];
        }
        if (slow > 0) {
            arr[slow-1]=-1;
        }
        return arr;
    }
};
 

在示例数据下是没有问题的

问题可能的原因： vector 的长度没有到2

class Solution {
public:
    vector<int> replaceElements(vector<int>& arr) {
        int slow=arr.size();
        if(slow ==1){
          return -1;
        }
        if(slow ==2){
          return arr[0];
        }
        int max=0;
        for(int j=0;j<=arr.size()-3;j++){
           for(int i=j+1;i<=arr.size()-1;i++){
               if(max<arr[i]){
                   max=arr[i];
               }                 
           }
            arr[j]=max; 
            max=0;
        }
        arr[slow-2]=arr[slow-1];
        arr[slow-1]=-1;
        return arr;
    }
};