time -f FMT mishandles trailing backslash

[Denys Vlasenko]

Try this:

$ /usr/bin/time -f 'abc\' sleep 1
abc?\sleep

There is a NUL byte after \ above:

$ /usr/bin/time -f 'abc\' sleep 1 2>&1 | hexdump -vC
00000000  61 62 63 3f 5c 00 73 6c  65 65 70 0a              |abc?\.sleep.|
0000000c

The code probably does something like this:
   p = fmt;
   while (*p) {
      ...
      if (*p=='\\') { p++; ...; putchar(*p++); continue; }
      ...
    }

and it forgets to check that *p++ may print and skip over NUL byte.
IF that happens, it runs off FMT and onto next argv[] which lives
on stack directly after FMT.