diff --git a/exec/tests/global/format.js b/exec/tests/global/format.js
index 31610ab51c64e4323ca8fc03ac70a2332841ac2f..9921b92e3b3e11f04c4142ea58ab6a953b7dba38 100644
--- a/exec/tests/global/format.js
+++ b/exec/tests/global/format.js
@@ -1,4 +1,4 @@
-const args = [ 1, 1.1, true, "one", -1, 1e9 ];
+const args = [ 1, 1.1, true, "one", -1, 1e9, null ];
 
 const test = {
 	"%s":		"1",
@@ -18,6 +18,10 @@ const test = {
 	"%5$d":		"-1",
 	"%5$x":		"ffffffff",
 	"%6$u":		"1000000000",
+	"%7$u":		"0",
+	"%7$s":		"null",
+	"%7$s %s":	"null %s",
+	"%8$s":		"%8$s",
 };
 
 for (var i in test) {
diff --git a/src/sbbs3/js_sprintf.c b/src/sbbs3/js_sprintf.c
index dff931d69d2463a5e573c47cfaf21e1cb567d2d1..90a846ea8ff3b5904b4ec16e7546390e60b5ab53 100644
--- a/src/sbbs3/js_sprintf.c
+++ b/src/sbbs3/js_sprintf.c
@@ -48,7 +48,7 @@ js_sprintf(JSContext *cx, uint argn, uintN argc, jsval *argv)
 			cur = next;
 		else
 			cur++;
-		if (cur > argc)
+		if (cur >= argc)
 			break;
 		if (JSVAL_IS_DOUBLE(argv[cur]))
 			p = xp_asprintf_next(p, XP_PRINTF_CONVERT | XP_PRINTF_TYPE_DOUBLE, JSVAL_TO_DOUBLE(argv[cur]));