_itoa_s doesn't return a pointer to the buffer like _itoa does. So you can't do something like

sub += _itoa(CONVDEC(i), num, 10);
you have to do it in two parts

_itoa_s(CONVDEC(i), num, 10, 10);
sub += num;
The way I'm using _itoa is OK but I'll change usage of _itoa to the above form to make changing it to _itoa_s easy if required.