wasn't there some value in having 'len' passed in to decodeXML previously, to catch overrun of input buffer ('x') in situations like this?