[2.1.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat.format().

      Thanks Sjoerd Job Postmus for the report and initial patch.
Thanks Michael Manfre, Tim Graham, and Florian Apolloner for review.

Backport of 402c0caa851e265410fbcaa55318f22d2bf22ee2 from master