Greg Steuck authored Nov 22, 2021 and Matthew Pickering committed May 10, 2022

This format has been used as a security exploit vector for decades
now.  Some operating systems (OpenBSD, Android, MSVC). It is targeted
for removal in C2X standard:
http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2834.htm

This requires extending the debug message function to return the
number of bytes written (like printf(3)), to permit %n format
specifier in one in one invocation of statsPrintf() in
report_summary().

Implemented by Matthias Kilian (kili<AT>outback.escape.de)

(cherry picked from commit e2c48b98)