SecString
From C
I created a library called secstring years ago when I was still relatively new to C and still thought I was smart. This shows in the code and the history of this page. (You can have the code if you view the history).
SecString was a bad name. It isn't secure from a crypto or memory hiding perspective. It isn't secure from a bugs perspective, either.
What it was has since turned into vstring, which is still available under a 2-clause BSD license, and I believe still targets both hosted and freestanding environments.
Another interesting and somewhat related project is qrintf, a preprocessor hook that compiles sprintf(3)-family format strings.