It's pretty easy to avoid. Just use a string class. Or check buffer length for things like URLs. For format printing, I wrote a custom lsprintf (limit string p

It's pretty easy to avoid. Just use a string class. Or check buffer length for things like URLs. For format printing, I wrote a custom lsprintf (limit string printf) which has as its first argument, the maximum length of the string. lsprintf will never overwrite past that. I'm surprised sprintf isn't mentioned in this.