diff --git a/CHANGES b/CHANGES
index 7038429a..7165be64 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
 This is the changelog for developers, != changelog for the end user 
 that we distribute with the binaries. (see changelog)
 
+19/02/2006
+SPoG
+- Fixed crash when loading invalid ASE models.
+
 11/02/2006
 SPoG
 - Added install.py script.
diff --git a/libs/picomodel/picomodel.c b/libs/picomodel/picomodel.c
index 618cc8a4..240d729b 100644
--- a/libs/picomodel/picomodel.c
+++ b/libs/picomodel/picomodel.c
@@ -295,7 +295,10 @@ picoModel_t	*PicoModuleLoadModelStream( const picoModule_t* module, void* inputS
 		model = PicoModuleLoadModel(module, fileName, buffer, bufSize, frameNum);
 	}
 	
-	_pico_free(buffer);
+  if(model != 0)
+  {
+	  _pico_free(buffer);
+  }
 
 	/* return */
 	return model;
diff --git a/libs/picomodel/pm_ase.c b/libs/picomodel/pm_ase.c
index afcf550f..24500758 100644
--- a/libs/picomodel/pm_ase.c
+++ b/libs/picomodel/pm_ase.c
@@ -755,19 +755,19 @@ static picoModel_t *_ase_load( PM_PARAMS_LOAD )
 			int			index;
 
 			if( numVertices == 0 )
-				_ase_error_return("Vertex parse error");
+				_ase_error_return("Texture Vertex parse error");
 
 			/* get uv vertex index */
-			if (!_pico_parse_int( p,&index ))
-				_ase_error_return("UV vertex parse error");
+			if (!_pico_parse_int( p,&index ) || index >= numTextureVertices)
+				_ase_error_return("Texture vertex parse error");
 
 			/* get uv vertex s */
 			if (!_pico_parse_float( p,&texcoords[index].texcoord[0] ))
-				_ase_error_return("UV vertex parse error");
+				_ase_error_return("Texture vertex parse error");
 
 			/* get uv vertex t */
 			if (!_pico_parse_float( p,&texcoords[index].texcoord[1] ))
-				_ase_error_return("UV vertex parse error");
+				_ase_error_return("Texture vertex parse error");
 			
 			/* ydnar: invert t */
 			texcoords[index].texcoord[ 1 ] = 1.0f - texcoords[index].texcoord[ 1 ];
diff --git a/radiant/GtkRadiant.vcproj b/radiant/GtkRadiant.vcproj
index 09856f9e..461793ef 100644
--- a/radiant/GtkRadiant.vcproj
+++ b/radiant/GtkRadiant.vcproj
@@ -644,7 +644,7 @@ copy "$(TargetDir)$(TargetName).pdb"  "$(SolutionDir)install&quot
 			</File>
 		</Filter>
 		<File
-			RelativePath="..\docs\developer\Changes">
+			RelativePath="..\Changes">
 		</File>
 		<File
 			RelativePath="..\debug.py">
@@ -683,7 +683,7 @@ copy &quot;$(TargetDir)$(TargetName).pdb&quot;  &quot;$(SolutionDir)install&quot
 			RelativePath="..\SConstruct">
 		</File>
 		<File
-			RelativePath="..\docs\developer\Todo">
+			RelativePath="..\Todo">
 		</File>
 		<File
 			RelativePath="..\touch.py">
diff --git a/radiant/console.cpp b/radiant/console.cpp
index df75c61e..5c462405 100644
--- a/radiant/console.cpp
+++ b/radiant/console.cpp
@@ -137,6 +137,22 @@ GtkWidget* Console_constructWindow(GtkWindow* toplevel)
   return scr;
 }
 
+class GtkTextBufferOutputStream : public TextOutputStream
+{
+  GtkTextBuffer* textBuffer;
+  GtkTextIter* iter;
+  GtkTextTag* tag;
+public:
+  GtkTextBufferOutputStream(GtkTextBuffer* textBuffer, GtkTextIter* iter, GtkTextTag* tag) : textBuffer(textBuffer), iter(iter), tag(tag)
+  {
+  }
+  std::size_t write(const char* buffer, std::size_t length)
+  {
+    gtk_text_buffer_insert_with_tags(textBuffer, iter, buffer, gint(length), tag, 0);
+    return length;
+  }
+};
+
 std::size_t Sys_Print(int level, const char* buf, std::size_t length)
 {
   bool contains_newline = strchr(buf, '\n') != 0;
@@ -190,18 +206,16 @@ std::size_t Sys_Print(int level, const char* buf, std::size_t length)
       }
 
 
-      StringOutputStream converted;
+      GtkTextBufferOutputStream textBuffer(buffer, &iter, tag);
       if(!globalCharacterSet().isUTF8())
       {
-        converted << ConvertLocaleToUTF8(StringRange(buf, buf + length));
+        textBuffer << ConvertLocaleToUTF8(StringRange(buf, buf + length));
       }
       else
       {
-        converted << StringRange(buf, buf + length);
+        textBuffer << StringRange(buf, buf + length);
       }
 
-      gtk_text_buffer_insert_with_tags(buffer, &iter, converted.c_str(), gint(string_length(converted.c_str())), tag, 0);
-
       // update console widget immediatly if we're doing something time-consuming
       if(contains_newline)
       {