Use of vsprintf in Xtensa message formatter

bfd/elf32-xtensa.c contains a helper that grows a heap buffer based on strlen(fmt)+arglen and then calls vsprintf into the tail of that buffer. Because vsprintf ignores the destination size, any miscalculation in arglen or formatting expansion can turn into an overwrite of adjacent heap memory.