--- strings/xml.c.ORIG	Mon Oct 18 05:32:34 2004
+++ strings/xml.c	Tue Oct 19 10:47:20 2004
@@ -81,13 +81,22 @@
   a->beg=p->cur;
   a->end=p->cur;
   
-  if (!memcmp(p->cur,"<!--",4))
+  if (p->end - p->cur >= 4 && memcmp(p->cur,"<!--",4) == 0)
   {
-    for( ; (p->cur < p->end) && memcmp(p->cur, "-->", 3); p->cur++);
-    if(!memcmp(p->cur, "-->", 3))
-      p->cur+=3;
-    a->end=p->cur;
     lex=MY_XML_COMMENT;
+    while (p->end - p->cur >= 3)
+    {
+      if(memcmp(p->cur, "-->", 3) == 0)
+      {
+        p->cur+=3;
+        a->end=p->cur;
+        goto ret;
+      }
+      p->cur++;
+    }
+    /* FIXME if we get here the comment was not closed => error */
+    p->cur= p->end;
+    a->end= p->end;
   }
   else if (strchr("?=/<>!",p->cur[0]))
   {
@@ -100,9 +109,11 @@
     p->cur++;
     for(  ; ( p->cur < p->end ) && (p->cur[0] != a->beg[0]); p->cur++)
     {}
-    a->end=p->cur;
-    if (a->beg[0]==p->cur[0])p->cur++;
-    a->beg++;
+    a->end=p->cur;             /* Ponts to string end char, " or ' */
+    /* Could have left loop because p->cur == p->end, don't read */
+    if (p->cur < p->end && a->beg[0]==p->cur[0])
+      p->cur++;
+    a->beg++;                 /* Move start to first char in string */
     my_xml_norm_text(a);
     lex=MY_XML_STRING;
   }