(svn r22993) [1.1] -Backport from trunk:

- Fix: The savegame description and loading of savegames would crash with savegames from a patched stable (which did not bump the savegame version) [FS#4778] (r22958, r22957)
- Fix: Guard from reading outside the silly name list (r22955)
- Fix: [NewGRF] Properly limit the length of strings in a choice list (r22952)
- Fix: [NewGRF] Do not call CB 32 for disaster, effect vehicles or aircraft shadows/rotors (r22947)

src/newgrf_text.cpp

@@ -371,7 +371,9 @@ struct UnmappedChoiceList : ZeroedMemoryAllocator {
 			for (int i = 0; i < count; i++) {
 				int idx = (this->type == SCC_GENDER_LIST ? lm->GetReverseMapping(i, true) : i + 1);
 				const char *str = this->strings[this->strings.Contains(idx) ? idx : 0];
-				size_t len = strlen(str);
+				/* Limit the length of the string we copy to 0xFE. The length is written above
+				 * as a byte and we need room for the final '\0'. */
+				size_t len = min(0xFE, strlen(str));
 				memcpy(d, str, len);
 				d += len;
 				*d++ = '\0';