diff --git a/ChangeLog b/ChangeLog
index ff3c1c0c2f..a7e0c62683 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Wed Nov 18 07:51:01 2009  Tanaka Akira  <akr@fsij.org>
+
+	* io.c (parse_mode_enc): fix invalid access.
+
 Tue Nov 17 23:50:06 2009  Shugo Maeda  <shugo@ruby-lang.org>
 
 	* vm_method.c (rb_alias): should raise TypeError if klass is nil.
diff --git a/io.c b/io.c
index 17ee292f5b..dc3a796587 100644
--- a/io.c
+++ b/io.c
@@ -4155,8 +4155,10 @@ parse_mode_enc(const char *estr, rb_encoding **enc_p, rb_encoding **enc2_p)
 	if (len == 0 || len > ENCODING_MAXNAMELEN)
 	    idx = -1;
 	else {
-	    if (io_encname_bom_p(estr, len))
+	    if (io_encname_bom_p(estr, len)) {
 		estr += 4;
+                len -= 4;
+            }
 	    memcpy(encname, estr, len);
 	    encname[len] = '\0';
 	    estr = encname;
@@ -4167,6 +4169,7 @@ parse_mode_enc(const char *estr, rb_encoding **enc_p, rb_encoding **enc2_p)
 	long len = strlen(estr);
 	if (io_encname_bom_p(estr, len)) {
 	    estr += 4;
+            len -= 4;
 	    memcpy(encname, estr, len);
 	    encname[len] = '\0';
 	    estr = encname;