md_is_entity_str(): Fix using bad offset and buffer overflow situation. Fixes #47.
diff --git a/md4c/md4c.c b/md4c/md4c.c
index b93aa19..2435d6c 100644
--- a/md4c/md4c.c
+++ b/md4c/md4c.c
@@ -1335,9 +1335,9 @@ md_is_entity_str(MD_CTX* ctx, const CHAR* text, OFF beg, OFF max_end, OFF* p_end
MD_ASSERT(text[off] == _T('&'));
off++;
- if(off+1 < max_end && text[off] == _T('#') && (text[off+1] == _T('x') || text[off+1] == _T('X')))
+ if(off+2 < max_end && text[off] == _T('#') && (text[off+1] == _T('x') || text[off+1] == _T('X')))
is_contents = md_is_hex_entity_contents(ctx, text, off+2, max_end, &off);
- else if(off < max_end && CH(off) == _T('#'))
+ else if(off+1 < max_end && text[off] == _T('#'))
is_contents = md_is_dec_entity_contents(ctx, text, off+1, max_end, &off);
else
is_contents = md_is_named_entity_contents(ctx, text, off, max_end, &off);