Fformat fails to detect premature end of string

[Johan Bockgård]

(format "%" 0)
 => Invalid format operation %j (where "j" is some random garbage)


The problem is this code in Fformat [editfns.c:3427]:

    while (index ("-0# ", *format))
      ++format;

which is executed before the `if (format == end)' test.

The man page for `index' says

    "The index() function returns a pointer to the first occurrence of
    the character c in the string s. [...] The terminating NULL
    character is considered to be a part of the strings."

So when *format is '\0' the pointer will be incremented past the end
of the string.

-- 
Johan Bockgård