Fix zero stripping in %g number formatting.

Reported by pwnhacker0x18. #1149

diff --git a/src/lj_strfmt_num.c b/src/lj_strfmt_num.c
index 79ec0263dd53eeb42c6b2e41d5403c05a95154d4..c6e776aa910d2d375f2e19b6cd4184ca89cd36e4 100644 (file)
--- a/src/lj_strfmt_num.c
+++ b/src/lj_strfmt_num.c
@@ -454,7 +454,8 @@ static char *lj_strfmt_wfnum(SBuf *sb, SFormat sf, lua_Number n, char *p)
            prec--;
            if (!i) {
              if (ndlo == ndhi) { prec = 0; break; }
-             lj_strfmt_wuint9(tail, nd[++ndlo]);
+             ndlo = (ndlo + 1) & 0x3f;
+             lj_strfmt_wuint9(tail, nd[ndlo]);
              i = 9;
            }
          }