diff --git a/common/rfb/util.cxx b/common/rfb/util.cxx
index 2b3c9f4..aec45f6 100644
--- a/common/rfb/util.cxx
+++ b/common/rfb/util.cxx
@@ -34,6 +34,7 @@
 #include <config.h>
 #endif
 
+#include <stdarg.h>
 #include <stdio.h>
 #include <sys/time.h>
 
@@ -41,6 +42,29 @@
 
 namespace rfb {
 
+  void CharArray::format(const char *fmt, ...) {
+    va_list ap;
+    size_t len;
+
+    va_start(ap, fmt);
+    len = vsnprintf(NULL, 0, fmt, ap);
+    va_end(ap);
+
+    delete [] buf;
+
+    if (len < 0) {
+      buf = new char[1];
+      buf[0] = '\0';
+      return;
+    }
+
+    buf = new char[len+1];
+
+    va_start(ap, fmt);
+    vsnprintf(buf, len+1, fmt, ap);
+    va_end(ap);
+  }
+
   char* strDup(const char* s) {
     if (!s) return 0;
     int l = strlen(s);
diff --git a/common/rfb/util.h b/common/rfb/util.h
index 98ce642..9ad1772 100644
--- a/common/rfb/util.h
+++ b/common/rfb/util.h
@@ -32,6 +32,12 @@
 
 struct timeval;
 
+#ifdef __GNUC__
+#  define __printf_attr(a, b) __attribute__((__format__ (__printf__, a, b)))
+#else
+#  define __printf_attr(a, b)
+#endif // __GNUC__
+
 namespace rfb {
 
   // -=- Class to handle cleanup of arrays of characters
@@ -45,6 +51,7 @@
     ~CharArray() {
       delete [] buf;
     }
+    void format(const char *fmt, ...) __printf_attr(2, 3);
     // Get the buffer pointer & clear it (i.e. caller takes ownership)
     char* takeBuf() {char* tmp = buf; buf = 0; return tmp;}
     void replaceBuf(char* b) {delete [] buf; buf = b;}
diff --git a/win/winvnc/VNCServerService.cxx b/win/winvnc/VNCServerService.cxx
index 1a2a8e9..481df21 100644
--- a/win/winvnc/VNCServerService.cxx
+++ b/win/winvnc/VNCServerService.cxx
@@ -97,9 +97,8 @@
     if (GetSessionUserTokenWin(&hToken))
     {
         ModuleFileName filename;
-        static const char cmdLineFmt[] = "\"%s\" -noconsole -service_run";
-        TCharArray cmdLine(_tcslen(filename.buf) + sizeof(cmdLineFmt)/sizeof(cmdLineFmt[0]));
-        _stprintf(cmdLine.buf, cmdLineFmt, filename.buf);
+        TCharArray cmdLine;
+        cmdLine.format("\"%s\" -noconsole -service_run", filename.buf);
         STARTUPINFO si;
         ZeroMemory(&si, sizeof si);
         si.cb = sizeof si;
diff --git a/win/winvnc/winvnc.cxx b/win/winvnc/winvnc.cxx
index c2abd89..8fba9dc 100644
--- a/win/winvnc/winvnc.cxx
+++ b/win/winvnc/winvnc.cxx
@@ -148,11 +148,11 @@
       } else if (strcasecmp(argv[i], "-status") == 0) {
         printf("Querying service status...\n");
         runServer = false;
+        CharArray result;
         DWORD state = rfb::win32::getServiceState(VNCServerService::Name);
-        CharArray stateStr(rfb::win32::serviceStateName(state));
-        const char* stateMsg = "The %s Service is in the %s state.";
-        CharArray result(strlen(stateStr.buf) + _tcslen(VNCServerService::Name) + strlen(stateMsg) + 1);
-        sprintf(result.buf, stateMsg, (const char*)CStr(VNCServerService::Name), stateStr.buf);
+        result.format("The %s Service is in the %s state.",
+                      (const char*)CStr(VNCServerService::Name),
+                      rfb::win32::serviceStateName(state));
         MsgBoxOrLog(result.buf);
       } else if (strcasecmp(argv[i], "-service") == 0) {
         printf("Run in service mode\n");