replace unchecked snprintf calls with heap buffers