Give CharArray a printf style method to ease automatic allocation
diff --git a/win/winvnc/VNCServerService.cxx b/win/winvnc/VNCServerService.cxx
index 1a2a8e9..481df21 100644
--- a/win/winvnc/VNCServerService.cxx
+++ b/win/winvnc/VNCServerService.cxx
@@ -97,9 +97,8 @@
     if (GetSessionUserTokenWin(&hToken))
     {
         ModuleFileName filename;
-        static const char cmdLineFmt[] = "\"%s\" -noconsole -service_run";
-        TCharArray cmdLine(_tcslen(filename.buf) + sizeof(cmdLineFmt)/sizeof(cmdLineFmt[0]));
-        _stprintf(cmdLine.buf, cmdLineFmt, filename.buf);
+        TCharArray cmdLine;
+        cmdLine.format("\"%s\" -noconsole -service_run", filename.buf);
         STARTUPINFO si;
         ZeroMemory(&si, sizeof si);
         si.cb = sizeof si;
diff --git a/win/winvnc/winvnc.cxx b/win/winvnc/winvnc.cxx
index c2abd89..8fba9dc 100644
--- a/win/winvnc/winvnc.cxx
+++ b/win/winvnc/winvnc.cxx
@@ -148,11 +148,11 @@
       } else if (strcasecmp(argv[i], "-status") == 0) {
         printf("Querying service status...\n");
         runServer = false;
+        CharArray result;
         DWORD state = rfb::win32::getServiceState(VNCServerService::Name);
-        CharArray stateStr(rfb::win32::serviceStateName(state));
-        const char* stateMsg = "The %s Service is in the %s state.";
-        CharArray result(strlen(stateStr.buf) + _tcslen(VNCServerService::Name) + strlen(stateMsg) + 1);
-        sprintf(result.buf, stateMsg, (const char*)CStr(VNCServerService::Name), stateStr.buf);
+        result.format("The %s Service is in the %s state.",
+                      (const char*)CStr(VNCServerService::Name),
+                      rfb::win32::serviceStateName(state));
         MsgBoxOrLog(result.buf);
       } else if (strcasecmp(argv[i], "-service") == 0) {
         printf("Run in service mode\n");