From 49b39e456da13185374cd8b3fbbd49f50a2a169f Mon Sep 17 00:00:00 2001
From: cutealien <cutealien@dfc29bdd-3216-0410-991c-e03cc46cb475>
Date: Wed, 10 Jun 2020 21:21:57 +0000
Subject: [PATCH] Fix potential reading/writing 1 byte behind it's own buffer
 in PLY loader. Thanks @wolfgang for report and patch
 (http://irrlicht.sourceforge.net/forum/viewtopic.php?f=7&t=52627&p=305573#p305573)

git-svn-id: svn://svn.code.sf.net/p/irrlicht/code/trunk@6113 dfc29bdd-3216-0410-991c-e03cc46cb475
---
 changes.txt                            | 2 ++
 source/Irrlicht/CPLYMeshFileLoader.cpp | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/changes.txt b/changes.txt
index 0e1abae..29aafd9 100644
--- a/changes.txt
+++ b/changes.txt
@@ -1,5 +1,7 @@
 --------------------------
 Changes in 1.9 (not yet released)
+- Fix potential reading/writing 1 byte behind it's own buffer in PLY loader.
+  Thanks @wolfgang for report and patch (http://irrlicht.sourceforge.net/forum/viewtopic.php?f=7&t=52627&p=305573#p305573)
 - ICursorControl::isVisible is now always returning the flag set in setVisible. 
   This changes the behaviour on Win32 somewhat when Windows returned a CURSOR_SUPPRESSED state (touch-screen input).
   Previously we set IsVisible it to false when CURSOR_SUPPRESSED was set.
diff --git a/source/Irrlicht/CPLYMeshFileLoader.cpp b/source/Irrlicht/CPLYMeshFileLoader.cpp
index f154095..94cbace 100644
--- a/source/Irrlicht/CPLYMeshFileLoader.cpp
+++ b/source/Irrlicht/CPLYMeshFileLoader.cpp
@@ -572,7 +572,7 @@ c8* CPLYMeshFileLoader::getNextLine()
 	StartPointer = LineEndPointer + 1;
 
 	// crlf split across buffer move
-	if (*StartPointer == '\n')
+	if (StartPointer<EndPointer && *StartPointer == '\n')
 	{
 		*StartPointer = '\0';
 		++StartPointer;
@@ -583,7 +583,7 @@ c8* CPLYMeshFileLoader::getNextLine()
 	while (pos < EndPointer && *pos && *pos != '\r' && *pos != '\n')
 		++pos;
 
-	if ( pos < EndPointer && ( *(pos+1) == '\r' || *(pos+1) == '\n') )
+	if ( (pos+1) < EndPointer && ( *(pos+1) == '\r' || *(pos+1) == '\n') )
 	{
 		*pos = '\0';
 		++pos;