If you really hit the pathological edge case of needed sprintf at runtime with runtime-only buffer sizes, you can still work out the size safely, albeit slowly.

If you really hit the pathological edge case of needed sprintf at runtime with runtime-only buffer sizes, you can still work out the size safely, albeit slowly. I've done it to make a "safe" sprintf function that allocates the destination buffer, so that the caller cannot overrun it: https://github.com/lelanthran/libds/blob/56d6e18c8970b84c9fa72945b338320c2d0f4e45/src/ds_str.c#L158 https://github.com/lelanthran/libds/blob/56d6e18c8970b84c9fa...