--- a/src/network/core/udp.cpp	Wed Apr 09 12:46:43 2008 +0000
+++ b/src/network/core/udp.cpp	Wed Apr 09 14:05:50 2008 +0000
@@ -221,6 +221,9 @@
 			uint i;
 			uint num_grfs = p->Recv_uint8();
 
+			/* Broken/bad data. It cannot have that many NewGRFs. */
+			if (num_grfs > NETWORK_MAX_GRF_COUNT) return;
+
 			for (i = 0; i < num_grfs; i++) {
 				GRFConfig *c = CallocT<GRFConfig>(1);
 				this->Recv_GRFIdentifier(p, c);