diff --git a/src/game/bg_lib.c b/src/game/bg_lib.c
index b6294f0..987648e 100644
--- a/src/game/bg_lib.c
+++ b/src/game/bg_lib.c
@@ -1044,7 +1044,7 @@ double fabs( double x ) {
 #define is_digit(c)		((unsigned)to_digit(c) <= 9)
 #define to_char(n)		((n) + '0')
 
-void AddInt( char **buf_p, int val, int width, int flags ) {
+void AddInt( char **buf_p, const char *buf_e, int val, int width, int flags ) {
 	char	text[32];
 	int		digits;
 	int		signedVal;
@@ -1067,19 +1067,19 @@ void AddInt( char **buf_p, int val, int width, int flags ) {
 	buf = *buf_p;
 
 	if( !( flags & LADJUST ) ) {
-		while ( digits < width ) {
+		while ( digits < width && buf < buf_e ) {
 			*buf++ = ( flags & ZEROPAD ) ? '0' : ' ';
 			width--;
 		}
 	}
 
-	while ( digits-- ) {
+	while ( digits-- && buf < buf_e ) {
 		*buf++ = text[digits];
 		width--;
 	}
 
 	if( flags & LADJUST ) {
-		while ( width-- ) {
+		while ( width-- && buf < buf_e ) {
 			*buf++ = ( flags & ZEROPAD ) ? '0' : ' ';
 		}
 	}
@@ -1087,7 +1087,7 @@ void AddInt( char **buf_p, int val, int width, int flags ) {
 	*buf_p = buf;
 }
 
-void AddFloat( char **buf_p, float fval, int width, int prec ) {
+void AddFloat( char **buf_p, const char *buf_e, float fval, int width, int prec ) {
 	char	text[32];
 	int		digits;
 	float	signedVal;
@@ -1114,12 +1114,12 @@ void AddFloat( char **buf_p, float fval, int width, int prec ) {
 
 	buf = *buf_p;
 
-	while ( digits < width ) {
+	while ( digits < width && buf < buf_e ) {
 		*buf++ = ' ';
 		width--;
 	}
 
-	while ( digits-- ) {
+	while ( digits-- && buf < buf_e ) {
 		*buf++ = text[digits];
 	}
 
@@ -1129,17 +1129,17 @@ void AddFloat( char **buf_p, float fval, int width, int prec ) {
 		prec = 6;
 	// write the fraction
 	digits = 0;
-	while (digits < prec) {
+	while (digits < prec && digits < sizeof(text)) {
 		fval -= (int) fval;
 		fval *= 10.0;
 		val = (int) fval;
 		text[digits++] = '0' + val % 10;
 	}
 
-	if (digits > 0) {
+	if (digits > 0 && buf < buf_e) {
 		buf = *buf_p;
 		*buf++ = '.';
-		for (prec = 0; prec < digits; prec++) {
+		for (prec = 0; prec < digits && buf < buf_e; prec++) {
 			*buf++ = text[prec];
 		}
 		*buf_p = buf;
@@ -1147,7 +1147,7 @@ void AddFloat( char **buf_p, float fval, int width, int prec ) {
 }
 
 
-void AddString( char **buf_p, char *string, int width, int prec ) {
+void AddString( char **buf_p, const char *buf_e, char *string, int width, int prec ) {
 	int		size;
 	char	*buf;
 
@@ -1171,11 +1171,11 @@ void AddString( char **buf_p, char *string, int width, int prec ) {
 
 	width -= size;
 
-	while( size-- ) {
+	while( size-- && buf < buf_e ) {
 		*buf++ = *string++;
 	}
 
-	while( width-- > 0 ) {
+	while( width-- > 0 && buf < buf_e ) {
 		*buf++ = ' ';
 	}
 
@@ -1183,16 +1183,18 @@ void AddString( char **buf_p, char *string, int width, int prec ) {
 }
 
 /*
-vsprintf
+vsnprintf
+
+240228 Cgg: vsprintf -> vsnprintf
 
 I'm not going to support a bunch of the more arcane stuff in here
 just to keep it simpler.  For example, the '*' and '$' are not
 currently supported.  I've tried to make it so that it will just
 parse and ignore formats we don't support.
 */
-int vsprintf( char *buffer, const char *fmt, va_list argptr ) {
+int vsnprintf( char *buffer, int size, const char *fmt, va_list argptr ) {
 	int		*arg;
-	char	*buf_p;
+	char	*buf_p, *buf_e;
 	char	ch;
 	int		flags;
 	int		width;
@@ -1201,13 +1203,17 @@ int vsprintf( char *buffer, const char *fmt, va_list argptr ) {
 	char	sign;
 
 	buf_p = buffer;
+	buf_e = buffer+size-1;
 	arg = (int *)argptr;
 
 	while( qtrue ) {
 		// run through the format string until we hit a '%' or '\0'
-		for ( ch = *fmt; (ch = *fmt) != '\0' && ch != '%'; fmt++ ) {
+		for ( ch = *fmt; (ch = *fmt) != '\0' && ch != '%' && buf_p < buf_e; fmt++ ) {
 			*buf_p++ = ch;
 		}
+		if ( buf_p == buf_e ) {
+			goto done;
+		}
 		if ( ch == '\0' ) {
 			goto done;
 		}
@@ -1260,11 +1266,11 @@ reswitch:
 			break;
 		case 'd':
 		case 'i':
-			AddInt( &buf_p, *arg, width, flags );
+			AddInt( &buf_p, buf_e, *arg, width, flags );
 			arg++;
 			break;
 		case 'f':
-			AddFloat( &buf_p, *(double *)arg, width, prec );
+			AddFloat( &buf_p, buf_e, *(double *)arg, width, prec );
 #ifdef __LCC__
 			arg += 1;	// everything is 32 bit in my compiler
 #else
@@ -1272,7 +1278,7 @@ reswitch:
 #endif
 			break;
 		case 's':
-			AddString( &buf_p, (char *)*arg, width, prec );
+			AddString( &buf_p, buf_e, (char *)*arg, width, prec );
 			arg++;
 			break;
 		case '%':