--- a/src/newgrf.cpp	Sat Dec 13 18:45:37 2008 +0000
+++ b/src/newgrf.cpp	Sat Dec 13 19:43:57 2008 +0000
@@ -3842,7 +3842,7 @@
 		grfmsg(8, "CfgApply: Applying %u bytes from parameter 0x%02X at offset 0x%04X", param_size, param_num, offset);
 
 		bool carry = false;
-		for (i = 0; i < param_size; i++) {
+		for (i = 0; i < param_size && offset + i < num; i++) {
 			uint32 value = GetParamVal(param_num + i / 4, NULL);
 			/* Reset carry flag for each iteration of the variable (only really
 			 * matters if param_size is greater than 4) */