From 645664eced98b1f00b5479da0685f39296fd1c70 Mon Sep 17 00:00:00 2001
From: rubidium <rubidium@openttd.org>
Date: Wed, 5 Aug 2009 23:32:18 +0000
Subject: [PATCH] (svn r17078) [0.7] -Fix [FS#3082]: crash when renaming some
 towns (already fixed in trunk by rewrite of the function)

---
 src/strings.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/strings.cpp b/src/strings.cpp
index 174a2daba2..b597de3eac 100644
--- a/src/strings.cpp
+++ b/src/strings.cpp
@@ -189,7 +189,7 @@ static char *FormatCommaNumber(char *buff, int64 number, const char *last)
 	uint64 tot;
 	uint64 num;
 
-	if (number < 0) {
+	if (number < 0 && buff < last) {
 		*buff++ = '-';
 		number = -number;
 	}
@@ -197,7 +197,7 @@ static char *FormatCommaNumber(char *buff, int64 number, const char *last)
 	num = number;
 
 	tot = 0;
-	for (i = 0; i < 20; i++) {
+	for (i = 0; i < 20 && buff < last; i++) {
 		quot = 0;
 		if (num >= divisor) {
 			quot = num / divisor;
@@ -205,7 +205,7 @@ static char *FormatCommaNumber(char *buff, int64 number, const char *last)
 		}
 		if (tot |= quot || i == 19) {
 			*buff++ = '0' + quot;
-			if ((i % 3) == 1 && i != 19) *buff++ = ',';
+			if ((i % 3) == 1 && i != 19 && buff < last) *buff++ = ',';
 		}
 
 		divisor /= 10;
@@ -233,7 +233,7 @@ static char *FormatNoCommaNumber(char *buff, int64 number, const char *last)
 	num = number;
 
 	tot = 0;
-	for (i = 0; i < 20; i++) {
+	for (i = 0; i < 20 && buff < last; i++) {
 		quot = 0;
 		if (num >= divisor) {
 			quot = num / divisor;