Convince Coverity that s = format (0, ...) is OK