[Bug libstdc++/92853] std::filesystem::path::operator+=(std::filesystem::path const&) corrupts the heap

[redi at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92853

--- Comment #1 from Jonathan Wakely <redi at gcc dot gnu.org> ---
The problem is that the trailing slash in the right operand gets processed
twice:

977     if (it != last && it->_M_type() == _Type::_Root_dir)
978       {
979         ++it;
980         if (it == last)
981           {
982             // This root-dir becomes a trailing slash
983             auto pos = _M_pathname.length() + p._M_pathname.length();
984             ::new(output++) _Cmpt({}, _Type::_Filename, pos);
985             ++_M_cmpts._M_impl->_M_size;
986           }
987       }
...
999     if (is_dir_sep(_M_pathname.back()))
1000      {
1001        ::new(output++) _Cmpt({}, _Type::_Filename, _M_pathname.length());
1002        ++_M_cmpts._M_impl->_M_size;│
1003      }

Which is easily fixed:

--- a/libstdc++-v3/src/c++17/fs_path.cc
+++ b/libstdc++-v3/src/c++17/fs_path.cc
@@ -975,16 +975,7 @@ path::operator+=(const path& p)
        }

       if (it != last && it->_M_type() == _Type::_Root_dir)
-       {
-         ++it;
-         if (it == last)
-           {
-             // This root-dir becomes a trailing slash
-             auto pos = _M_pathname.length() + p._M_pathname.length();
-             ::new(output++) _Cmpt({}, _Type::_Filename, pos);
-             ++_M_cmpts._M_impl->_M_size;
-           }
-       }
+       ++it;

       while (it != last)
        {