even if we're returning a safe string, use a format in snprintf calls
Merge branch 'master' into portable