diff --git a/src/frontend/numparam/xpressn.c b/src/frontend/numparam/xpressn.c
index 9e67f0102..fdf1821fe 100644
--- a/src/frontend/numparam/xpressn.c
+++ b/src/frontend/numparam/xpressn.c
@@ -1200,9 +1200,9 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
             const char *kptr = s;
             int nnest = 1;
 
-            for (;;) {
+            for (;; kptr++) {
 
-                d = *kptr++;
+                d = *kptr;
 
                 if (d == '{')
                     nnest++;
@@ -1210,9 +1210,11 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
                     nnest--;
 
                 if (nnest == 0) {
+                    kptr++;
                     break;
                 }
                 if (d == '\0') {
+                    kptr++;
                     break;
                 }
             }
@@ -1253,24 +1255,24 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
                 const char *kptr = s;
                 int level = 1;
 
-                for (;;) {
+                for (;; kptr++) {
 
                     if (kptr >= s_end)
                         d = '\0';
                     else
                         d = *kptr;
 
-                    kptr++;
-
                     if (d == '(')
                         level++;
                     else if (d == ')')
                         level--;
 
-                    if (kptr > s_end) {
+                    if (kptr >= s_end) {
+                        kptr++;
                         break;
                     }
                     if ((d == ')') && (level <= 0)) {
+                        kptr++;
                         break;
                     }
                 }
@@ -1287,19 +1289,19 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
                 /* simple identifier may also be string? */
 
                 const char *kptr = s;
-                for (;;) {
+                for (;; kptr++) {
 
                     if (kptr >= s_end)
                         d = '\0';
                     else
                         d = *kptr;
 
-                    kptr++;
-
-                    if (kptr > s_end) {
+                    if (kptr >= s_end) {
+                        kptr++;
                         break;
                     }
                     if (d <= ' ') {
+                        kptr++;
                         break;
                     }
                 }