Seg-fault in format(text)

Testing 9.1beta:

select format('Hello %s, %2147483648$s', 'World');
server closed the connection unexpectedly
This probably means the server terminated abnormally
before or while processing the request.
The connection to the server was lost. Attempting reset: Failed.

The problem is that the test for overflow of the arg position doesn't
catch all cases. The simplest solution is to just tweak the comparison
at varlena.c:3840 (patch attached) although maybe there are neater
ways...

Regards,
Dean