diff --git a/GNUmakefile b/GNUmakefile
index c910817..c60c185 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -31,7 +31,7 @@ CFLAGS += -D_REENTRANT $(WERROR)
 
 # startrip
 ifneq ($(DEBUG),)
-CFLAGS=-pipe -Wall -g
+CFLAGS=-pipe -Wall -g -Og
 endif
 path = $(subst :, ,$(PATH))
 diet_path = $(foreach dir,$(path),$(wildcard $(dir)/diet))
diff --git a/fmt/fmt_xmlescape.c b/fmt/fmt_xmlescape.c
new file mode 100644
index 0000000..b3733f8
--- /dev/null
+++ b/fmt/fmt_xmlescape.c
@@ -0,0 +1,40 @@
+#include "fmt.h"
+
+size_t fmt_xmlescape(char* dest,uint32_t ch) {
+  char* x;
+  size_t n;
+/*
+From http://en.wikipedia.org/wiki/XML#Valid_characters
+
+Unicode code points in the following ranges are valid in XML 1.0 documents:
+  U+0009, U+000A, U+000D: these are the only C0 controls accepted in XML 1.0;
+  U+0020–U+D7FF, U+E000–U+FFFD: this excludes some (not all) non-characters in the BMP (all surrogates, U+FFFE and U+FFFF are forbidden);
+  U+10000–U+10FFFF: this includes all code points in supplementary planes, including non-characters.
+*/
+  if (ch==0 || (ch>=0xd780 && ch<=0xdfff) || ch==0xfffe || ch==0xffff || ch>0x10ffff) return 0;
+  if ((ch&0x7f)<20 && ch!=9 && ch!=0xa && ch!=0xd && ch!=0x85) {
+    char buf[6];
+    buf[0]='&';
+    buf[1]='#';
+    buf[2]='x';
+    n=3+fmt_xlong(buf+3,ch);
+    buf[n++]=';';
+    x=buf;
+  } else
+    switch (ch) {
+    case '&':
+      x="&amp;"; n=5;
+      break;
+    case '<':
+      x="&lt;"; n=4;
+      break;
+    default:
+      return fmt_utf8(dest,ch);
+    }
+  if (dest) {
+    size_t i;
+    for (i=0; i<n; ++i)
+      dest[i]=x[i];
+  }
+  return n;
+}
diff --git a/test/uudecode.c b/test/uudecode.c
index 84862be..4b8d968 100644
--- a/test/uudecode.c
+++ b/test/uudecode.c
@@ -297,7 +297,7 @@ invalidpart:
       if (!(tmp=strstr(line," end="))) goto invalidpart;
       c=tmp[5+scan_ulong(tmp+5,&endoffset)];
       if (c!=' ' && c!=0) goto invalidpart;
-      --offset; --endoffset;
+      if (offset>0) --offset; --endoffset;
       if (endoffset<offset || endoffset>totalsize) goto invalidpart;
       lseek(ofd,offset,SEEK_SET);
       continue;
@@ -315,13 +315,15 @@ invalidpart:
 	gotcrc=1;
       } else if (part==1) {
 	tmp=strstr(line," crc32=");
-	if (!tmp) goto invalidpart;
+	if (!tmp)
+	  goto invalidpart;
 	if (!scan_xlong(tmp+7,&wantedcrc))
 	  goto invalidpart;
 	wantedcrc &= 0xfffffffful;
 	gotcrc=1;
 	endoffset=totalsize;
-      } else goto invalidpart;
+      } else
+	goto invalidpart;
       stralloc_init(&out);
       stralloc_0(&yencpart);
       stralloc_ready(&out,yencpart.len);