replace trivial malloc + sprintf / strcpy calls with xstrfmt