use xstrfmt to replace xmalloc + strcpy/strcat