If sprintf is provided through a macro wrapper, it can infer buffer size of the first argument, as it's known statically.
See if this circumvents protection:
---
char* dest = h->user_id;
len = sprintf(dest, "%u", om->user_id);
---
Comment #6 by chatelet.guillaume — 2015-02-12T07:41:28Z
There's also a declaration like this:
---
template <size_t size>
int sprintf(
char (&buffer)[size],
const char *format [,
argument] ...
); // C++ only
---
Comment #8 by github-bugzilla — 2015-02-12T21:40:25Z