diff --git a/src/frontend/numparam/xpressn.c b/src/frontend/numparam/xpressn.c
index 71dd9ff39..171fdcd64 100644
--- a/src/frontend/numparam/xpressn.c
+++ b/src/frontend/numparam/xpressn.c
@@ -1239,13 +1239,12 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
                 continue;
             }
 
-            s++;
-            while ((s < s_end) && (s[-1] <= ' '))
+            while ((s < s_end - 1) && (*s <= ' '))
                 s++;
 
-            if (s[-1] == '(') {
+            if (*s == '(') {
                 /* sub-formula */
-                const char *kptr = s;
+                const char *kptr = ++s;
                 int level = 1;
 
                 for (; kptr < s_end; kptr++) {
@@ -1272,7 +1271,7 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
             } else {
                 /* simple identifier may also be string? */
 
-                const char *kptr = s;
+                const char *kptr = ++s;
                 for (; kptr < s_end; kptr++)
                     if (*kptr <= ' ')
                         break;