Fix '**' parsing within a PathPattern segment

Prior to this commit, a regexp path segment ending with a double wilcard
(like "/path**") would be incorrectly parsed as a double wildcard
segment ("/**").

This commit fixes the incorrect parsing.

Fixes gh-35339

Author: bclozel

spring-web/src/main/java/org/springframework/web/util/pattern/InternalPathPatternParser.java

@@ -234,14 +234,22 @@ else if (ch == '}' && !previousBackslash) {
 	}
 
 	private boolean isDoubleWildcard(char separator) {
+		// next char is present
 		if ((this.pos + 1) >= this.pathPatternLength) {
 			return false;
 		}
+		// current char and next char are '*'
 		if (this.pathPatternData[this.pos] != '*' || this.pathPatternData[this.pos + 1] != '*') {
 			return false;
 		}
-		if ((this.pos + 2) < this.pathPatternLength) {
-			return this.pathPatternData[this.pos + 2] == separator;
+		// previous char is a separator, if any
+		if ((this.pos - 1 >= 0) && (this.pathPatternData[this.pos - 1] != separator)) {
+			return false;
+		}
+		// next char is a separator, if any
+		if (((this.pos + 2) < this.pathPatternLength) &&
+				this.pathPatternData[this.pos + 2] != separator) {
+			return false;
 		}
 		return true;
 	}

spring-web/src/test/java/org/springframework/web/util/pattern/PathPatternParserTests.java

@@ -85,9 +85,14 @@ void wildcardSegmentEndOfPathPatterns() {
 
 		@Test
 		void regexpSegmentIsNotWildcardSegment() {
-			// this is not double wildcard, it's / then **acb (an odd, unnecessary use of double *)
 			pathPattern = checkStructure("/**acb");
 			assertPathElements(pathPattern, SeparatorPathElement.class, RegexPathElement.class);
+
+			pathPattern = checkStructure("/a**bc");
+			assertPathElements(pathPattern, SeparatorPathElement.class, RegexPathElement.class);
+
+			pathPattern = checkStructure("/abc**");
+			assertPathElements(pathPattern, SeparatorPathElement.class, RegexPathElement.class);
 		}
 
 		@Test