Possible buffer overrun

Worst case scenario should be based on &amp;amp; instead of &amp;gt; or &amp;lt; so it should be 5 bytes per character