Better checking in itoa, also format as long-long, which it is.
 [jmk] --rw-rw-r-- M 786594 glenda sys 20958 Dec  5 12:07 sys/src/cmd/acid/builtin.c
	/n/sourcesdump/2005/1205/plan9/sys/src/cmd/acid/builtin.c:83,88 - 
	/n/sourcesdump/2005/1206/plan9/sys/src/cmd/acid/builtin.c:83,90
	  	0
	  };
	  
	+ char vfmt[] = "aBbcCdDfFgGiIoOqQrRsSuUVWxXYZ";
	+ 
	  void
	  mkprint(Lsym *s)
	  {
	/n/sourcesdump/2005/1205/plan9/sys/src/cmd/acid/builtin.c:678,683 - 
	/n/sourcesdump/2005/1206/plan9/sys/src/cmd/acid/builtin.c:680,731
	  	r->fmt = 'V';
	  }
	  
	+ static char *fmtflags = "-0123456789. #,u";
	+ static char *fmtverbs = "bdox";
	+ 
	+ static int
	+ acidfmt(char *fmt, char *buf, int blen)
	+ {
	+ 	char *r, *w, *e;
	+ 	
	+ 	w = buf;
	+ 	e = buf+blen;
	+ 	for(r=fmt; *r; r++){
	+ 		if(w >= e)
	+ 			return -1;
	+ 		if(*r != '%'){
	+ 			*w++ = *r;
	+ 			continue;
	+ 		}
	+ 		if(*r == '%'){
	+ 			*w++ = *r++;
	+ 			if(*r == '%'){
	+ 				if(w >= e)
	+ 					return -1;
	+ 				*w++ = *r;
	+ 				continue;
	+ 			}
	+ 			while(*r && strchr(fmtflags, *r)){
	+ 				if(w >= e)
	+ 					return -1;
	+ 				*w++ = *r++;
	+ 			}
	+ 			if(*r == 0 || strchr(fmtverbs, *r) == nil)
	+ 				return -1;
	+ 			if(w+3 > e)
	+ 				return -1;
	+ 			*w++ = 'l';
	+ 			*w++ = 'l';
	+ 			*w++ = *r;
	+ 		}
	+ 	}
	+ 	if(w >= e)
	+ 		return -1;
	+ 	*w = 0;
	+ 
	+ 	return 0;
	+ }
	+ 
	  void
	  cvtitoa(Node *r, Node *args)
	  {
	/n/sourcesdump/2005/1205/plan9/sys/src/cmd/acid/builtin.c:684,694 - 
	/n/sourcesdump/2005/1206/plan9/sys/src/cmd/acid/builtin.c:732,742
	  	Node res;
	  	Node *av[Maxarg];
	  	vlong ival;
	- 	char buf[128], *fmt;
	+ 	char buf[128], fmt[32];
	  
	  	if(args == 0)
	  err:
	- 		error("itoa(number [, printformat]): arg count");
	+ 		error("itoa(number [, fmt]): arg count");
	  	na = 0;
	  	flatten(av, args);
	  	if(na == 0 || na > 2)
	/n/sourcesdump/2005/1205/plan9/sys/src/cmd/acid/builtin.c:695,708 - 
	/n/sourcesdump/2005/1206/plan9/sys/src/cmd/acid/builtin.c:743,757
	  		goto err;
	  	expr(av[0], &res);
	  	if(res.type != TINT)
	- 		error("itoa(integer): arg type");
	+ 		error("itoa(number [, fmt]): arg type");
	  	ival = res.ival;
	- 	fmt = "%lld";
	+ 	strncpy(fmt, "%lld", sizeof(fmt));
	  	if(na == 2){
	  		expr(av[1], &res);
	  		if(res.type != TSTRING)
	- 			error("itoa(integer, string): arg type");
	- 		fmt = res.string->string;
	+ 			error("itoa(number [, fmt]): fmt type");
	+ 		if(acidfmt(res.string->string, fmt, sizeof(buf)))
	+ 			error("itoa(number [, fmt]): malformed fmt");
	  	}
	  
	  	snprint(buf, sizeof(buf), fmt, ival);
	/n/sourcesdump/2005/1205/plan9/sys/src/cmd/acid/builtin.c:895,902 - 
	/n/sourcesdump/2005/1206/plan9/sys/src/cmd/acid/builtin.c:944,949
	  	r->ival = regexec(rp, res.string->string, 0, 0);
	  	free(rp);
	  }
	- 
	- char vfmt[] = "aBbcCdDfFgGiIoOqQrRsSuUVWxXYZ";
	  
	  void
	  fmt(Node *r, Node *args)