Plug pub format_... security bug (only on glibc).

Tested it by hand... One of my other pull requests adds support for a better pub test suite; it would be pretty useful here.