diff --git a/engine/client/cl_screen.c b/engine/client/cl_screen.c
index b82ffabe6..a315a0412 100644
--- a/engine/client/cl_screen.c
+++ b/engine/client/cl_screen.c
@@ -191,7 +191,6 @@ void CopyAndMarkup(conchar_t *dest, qbyte *src, int maxlength)
 	if (maxlength < 0)
 		return;	// ...
 
-	maxlength--;
 	while(*src && maxlength>0)
 	{
 		if (*src == '^')
@@ -220,9 +219,14 @@ void CopyAndMarkup(conchar_t *dest, qbyte *src, int maxlength)
 						ext = ((*src - ('A' - 10)) << CON_BGSHIFT) | (ext&~CON_BGMASK) | CON_NONCLEARBG;
 					else
 						ext = ((*src - '0') << CON_BGSHIFT) | (ext&~CON_BGMASK) | CON_NONCLEARBG;
+					src++;
 					continue;
 				}
-				src--; // else invalid code
+				// else invalid code
+				*dest++ = '^' | ext;
+				maxlength--;
+				if (maxlength <= 0)
+					break; // need an extra check for writing length
 			}
 			else if (*src == 'b') // toggle blink bit
 			{
@@ -269,6 +273,7 @@ void CopyAndMarkup(conchar_t *dest, qbyte *src, int maxlength)
 			*dest++ = *src++;
 		else
 			*dest++ = *src++ | ext;
+		maxlength--;
 	}
 	*dest = 0;
 }
diff --git a/engine/client/sbar.c b/engine/client/sbar.c
index e34f9b568..cd024c971 100644
--- a/engine/client/sbar.c
+++ b/engine/client/sbar.c
@@ -143,6 +143,7 @@ void Draw_FunString(int x, int y, unsigned char *str)
 						ext = ((*str - ('A' - 10)) << CON_BGSHIFT) | (ext&~CON_BGMASK) | CON_NONCLEARBG;
 					else
 						ext = ((*str - '0') << CON_BGSHIFT) | (ext&~CON_BGMASK) | CON_NONCLEARBG;
+					str++;
 					continue;
 				}
 				// else invalid code
diff --git a/engine/server/sv_sys_unix.c b/engine/server/sv_sys_unix.c
index e25e50e32..6d9a44e0c 100644
--- a/engine/server/sv_sys_unix.c
+++ b/engine/server/sv_sys_unix.c
@@ -371,6 +371,7 @@ void Sys_Printf (char *fmt, ...)
 								ext = ((*str - ('A' - 10)) << CON_BGSHIFT) | (ext&~CON_BGMASK) | CON_NONCLEARBG;
 							else
 								ext = ((*str - '0') << CON_BGSHIFT) | (ext&~CON_BGMASK) | CON_NONCLEARBG;
+							str++;
 							continue;
 						}
 						Sys_PrintColouredChar('^' | ext);
diff --git a/engine/server/sv_sys_win.c b/engine/server/sv_sys_win.c
index b1cdcba93..4eb803a47 100644
--- a/engine/server/sv_sys_win.c
+++ b/engine/server/sv_sys_win.c
@@ -579,6 +579,7 @@ void Sys_Printf (char *fmt, ...)
 								ext = ((*str - ('A' - 10)) << CON_BGSHIFT) | (ext&~CON_BGMASK) | CON_NONCLEARBG;
 							else
 								ext = ((*str - '0') << CON_BGSHIFT) | (ext&~CON_BGMASK) | CON_NONCLEARBG;
+							str++;
 							continue;
 						}
 						Sys_PrintColouredChar('^' | ext);