Use gcc's format attribute

Gives useful warnings for incorrect string formatting