All good. Looking at https://developer.valvesoftware.com/wiki/String it seems that string_t is just a typedef for char *, so you need to be careful.
Another thought is that you should replace sprintf with snprintf, which takes a size parameter and will avoid buffer overflows. (I'm tellin ya man, ya gotta look out for them.) You could rewrite the code above to:
#define BUFFER_SIZE 1024
char *buffer = (char*)malloc(BUFFER_SIZE);
int length = snprintf(buffer, BUFFER_SIZE, "%c%d:%d:%s", WSPacket_PlayerDeath, victim, attacker, STRING(weapon));
That way if whatever the string format gets expanded to is greater than BUFFER_SIZE, then the end of the text is truncated. The client getting incomplete data is better than the server crashing.
Also, log the hell out of everything. When you get crashes and need to figure out what happened, they're your only resource. You want to be able to trace what happened up to the crash.
Okay, that's all from me... Good job so far, and good luck!