Fix #861: use safer sprintf formatting