If the format string comes from the user, you're sunk. You either have to trust them to get it right (which requires that your users are programmers and well-informed ones at that) or you have to accept or workaround crashes. As to my second comment, ...I can't find the information at MSDN, so I must be confusing it with the
*scanf_s()
family of functions which does have that requirement. So ignore that. —
Jonathan Leffler 1 min ago