The trick is to not do any index calculation.

I think that using std::string would prevent the bug, because it would throw length_error on append. string::resize can be used to avoid excessive allocations.

Sanity checks would provide extra safety, but the code should fail cleanly even without them.