Handle sprintf() appending a NUL byte [issues 53 and 54]

[jmoellers]

sprintf() always appends a NUL byte to whatever it writes to the destination string.
If the image dimensions are 0x0, then no image data is written and space is allocated only for the headers in export_tga() and export_tiff(). This will lead to a buffer overflow when the last byte(s) of this header are written to using sprintf().
So, in export_tga() put the data into the buffer using plain pointer operations (*ptr++ = ...),
in export_tiff() allocate one additional byte for the NUL byte.

[samhocevar]

Thanks for taking the time to write this patch, and sorry for not following up sooner. I decided to fix the issue in a slightly different way (ab04483).