Do not read over buffer if format is a single #, and do not loop forever

if UTF-8 is unfinished in a format. Reported by Giorgi Kobakhia im
GitHub issue 4735.

format-draw.c

@@ -1104,8 +1104,6 @@ format_width(const char *expanded)
 				more = utf8_append(&ud, *cp);
 			if (more == UTF8_DONE)
 				width += ud.width;
-			else
-				cp -= ud.have;
 		} else if (*cp > 0x1f && *cp < 0x7f) {
 			width++;
 			cp++;

format.c

@@ -5545,7 +5545,8 @@ format_expand1(struct format_expand_state *es, const char *fmt)
 			buf[off++] = *fmt++;
 			continue;
 		}
-		fmt++;
+		if (*fmt++ == '\0')
+			break;
 
 		ch = (u_char)*fmt++;
 		switch (ch) {