diff --git a/changes.txt b/changes.txt
index 0e1abae7..29aafd92 100644
--- a/changes.txt
+++ b/changes.txt
@@ -1,5 +1,7 @@
 --------------------------
 Changes in 1.9 (not yet released)
+- Fix potential reading/writing 1 byte behind it's own buffer in PLY loader.
+  Thanks @wolfgang for report and patch (http://irrlicht.sourceforge.net/forum/viewtopic.php?f=7&t=52627&p=305573#p305573)
 - ICursorControl::isVisible is now always returning the flag set in setVisible. 
   This changes the behaviour on Win32 somewhat when Windows returned a CURSOR_SUPPRESSED state (touch-screen input).
   Previously we set IsVisible it to false when CURSOR_SUPPRESSED was set.
diff --git a/source/Irrlicht/CPLYMeshFileLoader.cpp b/source/Irrlicht/CPLYMeshFileLoader.cpp
index f1540956..94cbaceb 100644
--- a/source/Irrlicht/CPLYMeshFileLoader.cpp
+++ b/source/Irrlicht/CPLYMeshFileLoader.cpp
@@ -572,7 +572,7 @@ c8* CPLYMeshFileLoader::getNextLine()
 	StartPointer = LineEndPointer + 1;
 
 	// crlf split across buffer move
-	if (*StartPointer == '\n')
+	if (StartPointer<EndPointer && *StartPointer == '\n')
 	{
 		*StartPointer = '\0';
 		++StartPointer;
@@ -583,7 +583,7 @@ c8* CPLYMeshFileLoader::getNextLine()
 	while (pos < EndPointer && *pos && *pos != '\r' && *pos != '\n')
 		++pos;
 
-	if ( pos < EndPointer && ( *(pos+1) == '\r' || *(pos+1) == '\n') )
+	if ( (pos+1) < EndPointer && ( *(pos+1) == '\r' || *(pos+1) == '\n') )
 	{
 		*pos = '\0';
 		++pos;