LINK_OPTIONS: Fix crash on empty LINKER: prefix

Since commit e3895f4a8b (Linking: Preserve nested LINKER: prefixes as
written, 2024-09-17, v3.31.0-rc1~60^2) we may increment an iterator past
the end.  Revise logic to avoid that.

Fixes: #26499

2 files changed, 5 insertions, 3 deletions

diff --git a/Source/cmGeneratorTarget_Options.cxx b/Source/cmGeneratorTarget_Options.cxx
index d8b3eb3..5ac42bf 100644
--- a/Source/cmGeneratorTarget_Options.cxx
+++ b/Source/cmGeneratorTarget_Options.cxx
@@ -551,8 +551,9 @@ std::vector<BT<std::string>>& cmGeneratorTarget::ResolveLinkerWrapper(
   const std::string SHELL{ "SHELL:" };
   const std::string LINKER_SHELL = LINKER + SHELL;
 
-  for (auto entry = result.begin(); entry != result.end(); ++entry) {
+  for (auto entry = result.begin(); entry != result.end();) {
     if (entry->Value.compare(0, LINKER.length(), LINKER) != 0) {
+      ++entry;
       continue;
     }
 
@@ -594,10 +595,10 @@ std::vector<BT<std::string>>& cmGeneratorTarget::ResolveLinkerWrapper(
     if (joinItems) {
       result.insert(
         entry, cmJoin(cmMakeRange(options.begin(), options.end()), " "_s));
-      entry = std::next(result.begin(), index);
+      entry = std::next(result.begin(), index + 1);
     } else {
       result.insert(entry, options.begin(), options.end());
-      entry = std::next(result.begin(), index + options.size() - 1);
+      entry = std::next(result.begin(), index + options.size());
     }
   }
   return result;
diff --git a/Tests/RunCMake/target_link_options/LINKER_expansion.cmake b/Tests/RunCMake/target_link_options/LINKER_expansion.cmake
index 2219218..7a2ffa1 100644
--- a/Tests/RunCMake/target_link_options/LINKER_expansion.cmake
+++ b/Tests/RunCMake/target_link_options/LINKER_expansion.cmake
@@ -26,6 +26,7 @@ endfunction()
 # Use LINKER alone
 add_test_library(linker)
 target_link_options(linker PRIVATE "LINKER:-foo,bar")
+target_link_options(linker PRIVATE "LINKER:") # empty
 
 # Use LINKER with SHELL
 add_test_library(linker_shell)