This paper goes into great detail describing how to utilize format string attacks with limited buffer space.
You can download it from the following link: https://packetstormsecurity.com/files/download/31214/bufferpaper.txt
Source: https://packetstormsecurity.com/files/31214/bufferpaper.txt.html