subreader: fix unsafe sscanf calls with "%["