Fix zero stripping in %g number formatting.

Reported by pwnhacker0x18. #1149

1 files changed, 2 insertions, 1 deletions

diff --git a/src/lj_strfmt_num.c b/src/lj_strfmt_num.c
index 79ec0263..c6e776aa 100644
--- a/src/lj_strfmt_num.c
+++ b/src/lj_strfmt_num.c
@@ -454,7 +454,8 @@ static char *lj_strfmt_wfnum(SBuf *sb, SFormat sf, lua_Number n, char *p)
             prec--;
             if (!i) {
               if (ndlo == ndhi) { prec = 0; break; }
-              lj_strfmt_wuint9(tail, nd[++ndlo]);
+              ndlo = (ndlo + 1) & 0x3f;
+              lj_strfmt_wuint9(tail, nd[ndlo]);
               i = 9;
             }
           }