fix self-append use-after-free in string::append

[Ramya-9353]

Repro: on a heap string with no spare capacity, s += s (equivalently s.append(s) or s.append(s.subview(k))).
Cause: append(string_view) copies from sv after string_impl::append has reallocated and freed the buffer sv points into, so the copy reads freed memory (ASAN heap-use-after-free). insert and replace already guard self-aliasing via detail::ptr_in_range; append was the gap.
Fix: detect the alias before appending and copy from the relocated offset in the resulting buffer.

Regression tests in test/string.cpp cover whole and partial self-append forcing reallocation; they report a use-after-free before the change and pass after.

[cppalliance-bot]

An automated preview of the documentation is available at https://1168.json.prtest2.cppalliance.org/libs/json/doc/html/index.html

If more commits are pushed to the pull request, the docs will rebuild at the same URL.

2026-07-08 12:12:54 UTC

[cppalliance-bot]

GCOVR code coverage report https://1168.json.prtest2.cppalliance.org/gcovr/index.html
LCOV code coverage report https://1168.json.prtest2.cppalliance.org/genhtml/index.html
Coverage Diff Report https://1168.json.prtest2.cppalliance.org/diff-report/index.html

Build time: 2026-07-08 12:21:41 UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.91%. Comparing base (e4cbf87) to head (7dad369).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #1168   +/-   ##
========================================
  Coverage    93.90%   93.91%           
========================================
  Files           91       91           
  Lines         9257     9263    +6     
========================================
+ Hits          8693     8699    +6     
  Misses         564      564           

Files with missing lines	Coverage Δ
include/boost/json/detail/string_impl.hpp	100.00% <ø> (ø)
include/boost/json/impl/string.ipp	100.00% <100.00%> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e4cbf87...7dad369. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cppalliance-bot]

Benchmark test results. More info at https://benchmark.cppalliance.org/jsonbenchmarks-pullrequests/1168/pullrequest.html