sscanf() prevents overflow