<format>: crash when formatting a floating-point value with #/L and a large precision

[cpplearner]

Describe the bug

<format> uses a loop to find the beginning of the exponent part in order to insert trailing zeroes. But when _Specs._Alt || _Specs._Localized is true, the position has already been stored in _Exponent_start. The loop actually moves _Exponent_start away from the correct position, and eventually causes a crash due to out-of-bound access.

STL/stl/inc/format

Lines 3108 to 3112 in 3eac329

	if (_Extra_precision != 0) {
	// Trailing zeroes are in front of the exponent
	while (*--_Exponent_start != _Exponent) {
	}
	}

STL/stl/inc/format

Lines 3087 to 3089 in 3eac329

	} else if (*_It == _Exponent) {
	_Exponent_start = _It;
	}

Command-line test case

D:\test>type test-format-3.cpp
#include <format>
#include <iostream>

int main() {
    std::cout << std::format("{:#.1075e}\n", 1.0);
}

D:\test>cl /std:c++20 /EHs /utf-8 test-format-3.cpp
Microsoft (R) C/C++ Optimizing Compiler Version 19.39.33321 for x64
Copyright (C) Microsoft Corporation.  All rights reserved.

test-format-3.cpp
Microsoft (R) Incremental Linker Version 14.39.33321.0
Copyright (C) Microsoft Corporation.  All rights reserved.

/out:test-format-3.exe
test-format-3.obj

D:\test>test-format-3

D:\test>echo %errorlevel%
-1073741819

Expected behavior

no crash

STL version

https://github.com/microsoft/STL/commit/3eac329d1f614ecf138d96c22a3b02f87076bc4a