Do proper bounds checking in formats (bug #1356)