diff --git a/ChangeLog b/ChangeLog
index 0ce3358a..b4a2ffae 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2013-02-28  Jay Berkenbilt  <ejb@ql.org>
+
+	* Remove all calls to sprintf
+
+	* New method QUtil::int_to_string_base to convert to octal or
+	hexademical (or decimal) strings without using sprintf
+
 2013-02-26  Jay Berkenbilt  <ejb@ql.org>
 
 	* Rewrite QUtil::int_to_string and QUtil::double_to_string to
diff --git a/include/qpdf/QUtil.hh b/include/qpdf/QUtil.hh
index 5b71a362..02d98876 100644
--- a/include/qpdf/QUtil.hh
+++ b/include/qpdf/QUtil.hh
@@ -22,6 +22,8 @@ namespace QUtil
     QPDF_DLL
     std::string int_to_string(long long, int length = 0);
     QPDF_DLL
+    std::string int_to_string_base(long long, int base, int length = 0);
+    QPDF_DLL
     std::string double_to_string(double, int decimal_places = 0);
 
     QPDF_DLL
diff --git a/libqpdf/QPDF_String.cc b/libqpdf/QPDF_String.cc
index b4d6b630..96736613 100644
--- a/libqpdf/QPDF_String.cc
+++ b/libqpdf/QPDF_String.cc
@@ -95,7 +95,6 @@ QPDF_String::unparse(bool force_binary)
     else
     {
 	result += "(";
-	char num[5];
 	for (unsigned int i = 0; i < this->val.length(); ++i)
 	{
 	    char ch = this->val[i];
@@ -140,8 +139,9 @@ QPDF_String::unparse(bool force_binary)
 		}
 		else
 		{
-		    sprintf(num, "\\%03o", static_cast<unsigned char>(ch)); // XXXX
-		    result += num;
+		    result += "\\" + QUtil::int_to_string_base(
+                        static_cast<int>(static_cast<unsigned char>(ch)),
+                        8, 3);
 		}
 		break;
 	    }
diff --git a/libqpdf/QUtil.cc b/libqpdf/QUtil.cc
index 5c92613a..f186389d 100644
--- a/libqpdf/QUtil.cc
+++ b/libqpdf/QUtil.cc
@@ -24,11 +24,23 @@
 std::string
 QUtil::int_to_string(long long num, int length)
 {
-    // Backward compatibility -- this function used to use sprintf
-    // with %0*d, so we interpret length such that a negative value
-    // appends spaces and a positive value prepends zeroes.
+    return int_to_string_base(num, 10, length);
+}
+
+std::string
+QUtil::int_to_string_base(long long num, int base, int length)
+{
+    // Backward compatibility -- int_to_string, which calls this
+    // function, used to use sprintf with %0*d, so we interpret length
+    // such that a negative value appends spaces and a positive value
+    // prepends zeroes.
+    if (! ((base == 8) || (base == 10) || (base == 16)))
+    {
+        throw std::logic_error(
+            "int_to_string_base called with unsupported base");
+    }
     std::ostringstream buf;
-    buf << num;
+    buf << std::setbase(base) << std::nouppercase << num;
     std::string result;
     if ((length > 0) &&
         (buf.str().length() < static_cast<size_t>(length)))
@@ -152,16 +164,13 @@ QUtil::copy_string(std::string const& str)
 std::string
 QUtil::hex_encode(std::string const& input)
 {
-    size_t input_size = input.length();
-    size_t hex_size = 1 + (2 * input_size);
-    PointerHolder<char> bufp(true, new char[hex_size]);
-    char* buf = bufp.getPointer();
-    buf[hex_size - 1] = '\0';
-    for (unsigned int i = 0; i < input_size; ++i)
+    std::string result;
+    for (unsigned int i = 0; i < input.length(); ++i)
     {
-        sprintf(buf + i * 2, "%02x", static_cast<unsigned char>(input[i])); // XXXX
+        result += QUtil::int_to_string_base(
+            static_cast<int>(static_cast<unsigned char>(input[i])), 16, 2);
     }
-    return buf;
+    return result;
 }
 
 void
diff --git a/libtests/qtest/qutil/qutil.out b/libtests/qtest/qutil/qutil.out
index 737e4c72..ebbf97b5 100644
--- a/libtests/qtest/qutil/qutil.out
+++ b/libtests/qtest/qutil/qutil.out
@@ -8,6 +8,9 @@
 0.00012
 0.12346
 0.00012
+16059
+37273
+3ebb
 one
 7
 compare okay
diff --git a/libtests/qutil.cc b/libtests/qutil.cc
index 8d9c2383..dedd73d1 100644
--- a/libtests/qutil.cc
+++ b/libtests/qutil.cc
@@ -23,7 +23,10 @@ void string_conversion_test()
               << QUtil::double_to_string(.1234, 5) << std::endl
               << QUtil::double_to_string(.0001234, 5) << std::endl
               << QUtil::double_to_string(.123456, 5) << std::endl
-              << QUtil::double_to_string(.000123456, 5) << std::endl;
+              << QUtil::double_to_string(.000123456, 5) << std::endl
+              << QUtil::int_to_string_base(16059, 10) << std::endl
+              << QUtil::int_to_string_base(16059, 8) << std::endl
+              << QUtil::int_to_string_base(16059, 16) << std::endl;
 
     std::string embedded_null = "one";
     embedded_null += '\0';
@@ -86,10 +89,8 @@ void getenv_test()
 
 static void print_utf8(unsigned long val)
 {
-    char t[20];
-    sprintf(t, "%lx", val);   // XXXX
     std::string result = QUtil::toUTF8(val);
-    std::cout << "0x" << t << " ->";
+    std::cout << "0x" << QUtil::int_to_string_base(val, 16) << " ->";
     if (val < 0xfffe)
     {
 	std::cout << " " << result;
@@ -102,9 +103,8 @@ static void print_utf8(unsigned long val)
 	for (std::string::iterator iter = result.begin();
 	     iter != result.end(); ++iter)
 	{
-	    char t[3];
-	    sprintf(t, "%02x", static_cast<unsigned char>(*iter)); // XXXX
-	    std::cout << " " << t;
+	    std::cout << " " << QUtil::int_to_string_base(
+                static_cast<int>(static_cast<unsigned char>(*iter)), 16, 2);
 	}
     }
     std::cout << std::endl;