makes sure that the size of the user-supplied data is no greater
than the size of the destination buffer. In our experience,
developers will associate this check with a failure to code
defensively around the call to sprintf(). We classify this