Fix for issue# 2894085. Removed update to next pointer. It did not seem right to force it to point somewhere between token boundaries, since that could lead the tokenizer to not recognize an end of token.
diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index 9c7ac2b..72488d4 100644
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -3723,7 +3723,6 @@
         return XML_ERROR_NO_ELEMENTS;
       default:
         tok = -tok;
-        next = end;
         break;
       }
     }