ensure sprintf does not overflow buffer