This patch expands on issues raised by Alexander Cherepanov earlier
this year with some concrete fixes. I'm not terribly concerned about
what happens when the format string itself contains out-of-range
numbers (although it would be nice to handle that right), but it is
important to handle correctly cases where the data being printed (e.g.
long strings) would cause the total length to overflow INT_MAX, or
where it would cause internal overflows.

This patch:

1. Returns with an error as soon as EOVERFLOW conditions are detected,
   rather than continuing to produce output.

2. Catches overflows where the format string itself is longer than
   INT_MAX (only possible on 64-bit archs).

3. Catches %s argument strings longer than INT_MAX (likewise).

4. Catches cases where adding a prefix length to a precision would
   overflow.

5. Correctly handles width specifiers that overflow (always an error)
   and precision specifiers that overflow (error for everything but
   strings; for strings they're equivalent to no precision/no limit).

Checking wide strings and floating point conversions for overflows
remains to be done.

As discussed before, none of these overflows are presently dangerous,
but they do lead to mildly wrong results in the relevant corner cases
and really should be fixed.

Rich