OSV-2026-514 Heap-buffer-overflow in format_expand1

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=498472071 Crash type: Heap-buffer-overflow READ 1 Crash state: formatexpand1 formatexpand format-fuzzer.c...