diff --git a/xfa/fxfa/fm2js/cxfa_fmlexer.cpp b/xfa/fxfa/fm2js/cxfa_fmlexer.cpp
index 3a69467..f977194 100644
--- a/xfa/fxfa/fm2js/cxfa_fmlexer.cpp
+++ b/xfa/fxfa/fm2js/cxfa_fmlexer.cpp
@@ -304,8 +304,10 @@
 CXFA_FMToken CXFA_FMLexer::AdvanceForNumber() {
   // This will set end to the character after the end of the number.
   int32_t used_length = 0;
-  if (m_cursor)
-    FXSYS_wcstof(const_cast<wchar_t*>(m_cursor), -1, &used_length);
+  if (m_cursor) {
+    FXSYS_wcstof(const_cast<wchar_t*>(m_cursor), m_end - m_cursor,
+                 &used_length);
+  }
 
   const wchar_t* end = m_cursor + used_length;
   if (used_length == 0 || !end || FXSYS_iswalpha(*end)) {