Don't use npos as an index. But passing it to substr() and doing
arithmetic with it is safe.

Remove unnecessary use of c_str() for extra safety.

Issue: cmake/cmake#26667