Fix segfault in number_to_string when locale uses comma decimal

[GoigA]

Under locales that format floating-point numbers with a comma (such as de_DE or pt_BR), sprintf(tp, "%.*f", ...) outputs numbers like "1234,50".

In number_to_string(), it only searches for a dot via strchr(tp, '.'). When that returns NULL, the pointer subtraction (NULL - tp) underflows into a huge size_t, which makes the while (i < l) loop write thousand separators past the stack frame until triggering a SIGSEGV in memcpy.

This patch checks for both . and , when locating the decimal separator to prevent the underflow.