diff --git a/common/rfb/util.cxx b/common/rfb/util.cxx
index 2b3c9f4..aec45f6 100644
--- a/common/rfb/util.cxx
+++ b/common/rfb/util.cxx
@@ -34,6 +34,7 @@
 #include <config.h>
 #endif
 
+#include <stdarg.h>
 #include <stdio.h>
 #include <sys/time.h>
 
@@ -41,6 +42,29 @@
 
 namespace rfb {
 
+  void CharArray::format(const char *fmt, ...) {
+    va_list ap;
+    size_t len;
+
+    va_start(ap, fmt);
+    len = vsnprintf(NULL, 0, fmt, ap);
+    va_end(ap);
+
+    delete [] buf;
+
+    if (len < 0) {
+      buf = new char[1];
+      buf[0] = '\0';
+      return;
+    }
+
+    buf = new char[len+1];
+
+    va_start(ap, fmt);
+    vsnprintf(buf, len+1, fmt, ap);
+    va_end(ap);
+  }
+
   char* strDup(const char* s) {
     if (!s) return 0;
     int l = strlen(s);
diff --git a/common/rfb/util.h b/common/rfb/util.h
index 98ce642..9ad1772 100644
--- a/common/rfb/util.h
+++ b/common/rfb/util.h
@@ -32,6 +32,12 @@
 
 struct timeval;
 
+#ifdef __GNUC__
+#  define __printf_attr(a, b) __attribute__((__format__ (__printf__, a, b)))
+#else
+#  define __printf_attr(a, b)
+#endif // __GNUC__
+
 namespace rfb {
 
   // -=- Class to handle cleanup of arrays of characters
@@ -45,6 +51,7 @@
     ~CharArray() {
       delete [] buf;
     }
+    void format(const char *fmt, ...) __printf_attr(2, 3);
     // Get the buffer pointer & clear it (i.e. caller takes ownership)
     char* takeBuf() {char* tmp = buf; buf = 0; return tmp;}
     void replaceBuf(char* b) {delete [] buf; buf = b;}