--- a/engine.c	Mon Nov 22 20:49:42 2004 +0000
+++ b/engine.c	Mon Nov 22 21:41:25 2004 +0000
@@ -601,7 +601,8 @@
 {
 	if (!_engine_custom_names[engine])
 		return _engine_name_strings[engine];
-	strcpy(_userstring, _engine_custom_names[engine]);
+	strncpy(_userstring, _engine_custom_names[engine], USERSTRING_LEN);
+	_userstring[USERSTRING_LEN - 1] = '\0';
 	return STR_SPEC_USERSTRING;
 }
 

--- a/misc_gui.c	Mon Nov 22 20:49:42 2004 +0000
+++ b/misc_gui.c	Mon Nov 22 21:41:25 2004 +0000
@@ -53,7 +53,7 @@
 		}
 		DrawStringCentered(140, 38, str, 0);
 
-		sprintf(_userstring, "%.4X", lid->tile);
+		snprintf(_userstring, USERSTRING_LEN, "%.4X", lid->tile);
 		SET_DPARAM16(0, GET_TILE_X(lid->tile));
 		SET_DPARAM16(1, GET_TILE_Y(lid->tile));
 		SET_DPARAM16(2, STR_SPEC_USERSTRING);

--- a/station_gui.c	Mon Nov 22 20:49:42 2004 +0000
+++ b/station_gui.c	Mon Nov 22 21:41:25 2004 +0000
@@ -375,6 +375,8 @@
 		b += 3;
 
 		for(i=0; i!=NUM_CARGO; i++) {
+			if (b + 5 > USERSTRING_LEN - 1)
+				break;
 			if (st->goods[i].waiting_acceptance & 0x8000) {
 				b[0] = 0x81;
 				WRITE_LE_UINT16(b+1, _cargoc.names_s[i]);

--- a/variables.h	Mon Nov 22 20:49:42 2004 +0000
+++ b/variables.h	Mon Nov 22 21:41:25 2004 +0000
@@ -431,7 +431,8 @@
 /* misc */
 VARDEF byte str_buffr[512];
 VARDEF char _screenshot_name[128];
-VARDEF char _userstring[128];
+#define USERSTRING_LEN 128
+VARDEF char _userstring[USERSTRING_LEN];
 VARDEF byte _vehicle_design_names;
 
 VARDEF SignStruct _sign_list[40];