Crash: Nuklear sometimes encounters an infinite loop with certain geometry

The following has been encountered:
nk_foreach in nk_convert enters an infinite loop. This is because of the following:
nk_command is invalid and has 'next' set to 'u64(0)'. Instead of breaking this off, it goes into the nk__next command, which parses "0" as a relative offset into the buffer. Basically it's a linked list pointing from its tail to its front.
The last (valid) command is NK_COMMAND_TRIANGLE_FILLED and it points to the location 0xf00, which contains an invalid command.
This command has a type code of 0x00000f30 a next of 0x0000000000000000 and user data of { 0x3f80000000000000,0x00000000 }.
This in turn results into a slow but steady rise in memory, until the program crashes.
How would I go about fixing this? I'd guess that NK_COMMAND_TRIANGLE_FILLED either doesn't always properly allocate enough memory or that nk doesn't always properly terminate the command list (by setting the last entry's next to something where nk_foreach would stop looping).

Start by tracing nk_foreach in nk_convert and the nk__next handling of the command buffer, focusing on the invalid command after NK_COMMAND_TRIANGLE_FILLED and its zero next offset. Reproduce the geometry case described in the issue, then verify that malformed or unterminated command data no longer causes an infinite loop or steadily increasing memory usage.

Written by the indexing model from the issue text.