Fix potential buffer overrun

This would only break for malformed format strings but should be fixed anyway.