Fix potential buffer overflow in `sprintf.c`.

mrbgems/mruby-sprintf/src/sprintf.c

@@ -842,7 +842,7 @@ retry:
       case 'B':
       case 'u': {
         mrb_value val = GETARG();
-        char nbuf[68], *s;
+        char nbuf[69], *s;
         const char *prefix = NULL;
         int sign = 0, dots = 0;
         char sc = 0;
@@ -914,7 +914,7 @@ retry:
             width--;
           }
           mrb_assert(base == 10);
-          mrb_int2str(nbuf, sizeof(nbuf), v);
+          mrb_int2str(nbuf, sizeof(nbuf)-1, v);
           s = nbuf;
           if (v < 0) s++;       /* skip minus sign */
         }
@@ -927,7 +927,7 @@ retry:
           else {
             val = mrb_fixnum_to_str(mrb, mrb_fixnum_value(v), base);
           }
-          strncpy(++s, RSTRING_PTR(val), sizeof(nbuf)-1);
+          strncpy(++s, RSTRING_PTR(val), sizeof(nbuf)-2);
           if (v < 0) {
             char d;