Index: game/bg_lib.c
===================================================================
--- game/bg_lib.c	(revision 1250)
+++ game/bg_lib.c	(working copy)
@@ -1255,6 +1255,17 @@
 	return buf_p - buffer;
 }
 
+int vsnprintf( char *buffer, size_t count, const char *fmt, va_list argptr ) {
+	int ret;
+
+	if ( count < 1 )
+		return 0;
+
+	ret = vsprintf( &buffer, fmt, argptr );
+
+	return ret;
+}
+
 /* this is really crappy */
 int sscanf( const char *buffer, const char *fmt, ... ) {
 	int		cmd;
Index: game/bg_lib.h
===================================================================
--- game/bg_lib.h	(revision 1250)
+++ game/bg_lib.h	(working copy)
@@ -99,6 +99,7 @@
 int _atoi( const char **stringPtr );
 
 int vsprintf( char *buffer, const char *fmt, va_list argptr );
+int vsnprintf( char *buffer, size_t count, const char *fmt, va_list argptr );
 int sscanf( const char *buffer, const char *fmt, ... ) __attribute__ ((format (scanf, 2, 3)));
 
 // Memory functions
Index: qcommon/q_shared.c
===================================================================
--- qcommon/q_shared.c	(revision 1250)
+++ qcommon/q_shared.c	(working copy)
@@ -951,20 +951,24 @@
 
 does a varargs printf into a temp buffer, so I don't need to have
 varargs versions of all text functions.
-FIXME: make this buffer size safe someday
 ============
 */
 char	* QDECL va( char *format, ... ) {
 	va_list		argptr;
-	static char		string[2][32000];	// in case va is called by nested functions
-	static int		index = 0;
-	char	*buf;
+	static char string[2][32000]; // in case va is called by nested functions
+	static int	index = 0;
+	char		*buf;
 
 	buf = string[index & 1];
 	index++;
 
 	va_start (argptr, format);
-	vsprintf (buf, format,argptr);
+	//vsprintf (buf, format,argptr); // raynorpat: replaced with vsnprintf
+#ifndef _MSC_VER
+	vsnprintf (buf, 32000, format, argptr);
+#else
+	_vsnprintf (buf, 32000, format, argptr);
+#endif
 	va_end (argptr);
 
 	return buf;