diff --git a/src/frontend/numparam/xpressn.c b/src/frontend/numparam/xpressn.c
index 2e59b22d6..f745b17b8 100644
--- a/src/frontend/numparam/xpressn.c
+++ b/src/frontend/numparam/xpressn.c
@@ -1199,11 +1199,9 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
             const char *kptr = s;
             int nnest = 1;
 
-            for (;; kptr++) {
+            for (; *kptr; kptr++) {
 
                 char d = *kptr;
-                if (d == '\0')
-                    break;
 
                 if (d == '{')
                     nnest++;
@@ -1251,13 +1249,9 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
                 const char *kptr = s;
                 int level = 1;
 
-                for (;; kptr++) {
+                for (; kptr < s_end; kptr++) {
 
-                    char d;
-                    if (kptr >= s_end) {
-                        break;
-                    }
-                    d = *kptr;
+                    char d = *kptr;
 
                     if (d == '(')
                         level++;
@@ -1281,11 +1275,9 @@ nupa_substitute(dico_t *dico, const char *s, char *r)
                 /* simple identifier may also be string? */
 
                 const char *kptr = s;
-                for (;; kptr++) {
+                for (; kptr < s_end; kptr++) {
 
                     char d;
-                    if (kptr >= s_end)
-                        break;
                     d = *kptr;
 
                     if (d <= ' ') {