diff --git a/src/frontend/numparam/xpressn.c b/src/frontend/numparam/xpressn.c
index 9bbf35e6f..bc1b2f05d 100644
--- a/src/frontend/numparam/xpressn.c
+++ b/src/frontend/numparam/xpressn.c
@@ -1512,7 +1512,7 @@ nupa_subcktcall(dico_t *dico, char *s, char *x, char *inst_name)
       skip over instance name -- fixes bug where instance 'x1' is
       same name as subckt 'x1'
     */
-    while (*x != ' ')
+    while (*x && *x != ' ')
         x++;
 
     /***** first, analyze the subckt definition line */
@@ -1529,7 +1529,7 @@ nupa_subcktcall(dico_t *dico, char *s, char *x, char *inst_name)
         while ((j < ls) && (t_p[j] <= ' '))
             j++;
 
-        while (t_p[j] != ' ') {
+        while ((j < ls) && (t_p[j] != ' ')) {
             cadd(&subname, t_p[j]);
             j++;
         }