Possible buffer overrun

Worst case scenario should be based on &amp; instead of &gt; or &lt; so it should be 5 bytes per character