The trick is to not do any index calculation. I think that using std::string would prevent the bug, because it would throw length_error on append. string::resi

The trick is to not do any index calculation. I think that using std::string would prevent the bug, because it would throw length_error on append. string::resize can be used to avoid excessive allocations. Sanity checks would provide extra safety, but the code should fail cleanly even without them.