`format` leaks memory

[iacore]

> (format "%d%d" 1)
1-1900850528
> (format "%d %d" 1)
1 279724704

[hellerve]

Thanks for reporting!

For a safe multi-argument version, please use fmt. format is a thin wrapper around the C APIs for single arguments and doesn’t do any checking. fmt is vararg, and does compile-time checking to see that the number of formatting primitives and arguments checks out.

We could and should probably still add a (compile-time) check that ensures that there is only one formatting expression in the first argument to format.