From 55017d46268424c2a7bd8ca195c298e26e57c354 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Mon, 23 Aug 2010 20:06:36 +0200
Subject: [PATCH] Fix formatting of canonicalized number to string conversions.

---
 src/lib_string.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/lib_string.c b/src/lib_string.c
index 528b3d0e..c1b584d8 100644
--- a/src/lib_string.c
+++ b/src/lib_string.c
@@ -739,14 +739,17 @@ LJLIB_CF(string_format)
 	tv.n = lj_lib_checknum(L, arg);
 	if (LJ_UNLIKELY((tv.u32.hi << 1) >= 0xffe00000)) {
 	  /* Canonicalize output of non-finite values. */
-	  size_t len = lj_str_bufnum(buff, &tv);
+	  char *p, nbuf[LUAI_MAXNUMBER2STR];
+	  size_t len = lj_str_bufnum(nbuf, &tv);
 	  if (strfrmt[-1] == 'E' || strfrmt[-1] == 'G') {
-	    buff[len-3] = buff[len-3] - 0x20;
-	    buff[len-2] = buff[len-2] - 0x20;
-	    buff[len-1] = buff[len-1] - 0x20;
+	    nbuf[len-3] = nbuf[len-3] - 0x20;
+	    nbuf[len-2] = nbuf[len-2] - 0x20;
+	    nbuf[len-1] = nbuf[len-1] - 0x20;
 	  }
-	  luaL_addlstring(&b, buff, len);
-	  continue;
+	  for (p = form; *p < 'e' && *p != '.'; p++) ;
+	  *p++ = 's'; *p = '\0';
+	  sprintf(buff, form, nbuf);
+	  break;
 	}
 	sprintf(buff, form, (double)tv.n);
 	break;