Increment source pointer even if token length is exceeded

diff --git a/MagickCore/token.c b/MagickCore/token.c
index 381459fab32e469a6fd32d32e6d7ac267fd3561c..a3a3c2e065cf4305aebbe7be6f92b897561ef30a 100644 (file)
--- a/MagickCore/token.c
+++ b/MagickCore/token.c
@@ -231,10 +231,14 @@ MagickExport void GetNextToken(const char *start,const char **end,
     case '/':
     {
       if (i < (ssize_t) (extent-1))
-        token[i++]=(*p++);
+        token[i++]=(*p);
+      p++;
       if ((*p == '>') || (*p == '/'))
-        if (i < (ssize_t) (extent-1))
-          token[i++]=(*p++);
+        {
+          if (i < (ssize_t) (extent-1))
+            token[i++]=(*p);
+          p++;
+        }
       break;
     }
     default:
@@ -254,15 +258,19 @@ MagickExport void GetNextToken(const char *start,const char **end,
               break;
           }
           if (*p == '%')
-            if (i < (ssize_t) (extent-1))
-              token[i++]=(*p++);
+            {
+              if (i < (ssize_t) (extent-1))
+                token[i++]=(*p);
+              p++;
+            }
           break;
         }
       if ((*p != '\0') && (isalpha((int) ((unsigned char) *p)) == 0) &&
           (*p != *DirectorySeparator) && (*p != '#') && (*p != '<'))
         {
           if (i < (ssize_t) (extent-1))
-            token[i++]=(*p++);
+            token[i++]=(*p);
+          p++;
           break;
         }
       for ( ; *p != '\0'; p++)