diff --git a/dlls/xmllite/reader.c b/dlls/xmllite/reader.c
index 7c9f76a4f15..c33d9bf2398 100644
--- a/dlls/xmllite/reader.c
+++ b/dlls/xmllite/reader.c
@@ -2122,6 +2122,7 @@ static HRESULT reader_parse_reference(xmlreader *reader)
             len = buffer->written - ((char*)ptr - buffer->data) - sizeof(WCHAR);
             memmove(start+1, ptr+1, len);
             buffer->cur = cur + 1;
+            buffer->written -= (ptr - start) * sizeof(WCHAR);
 
             *start = ch;
         }
diff --git a/dlls/xmllite/tests/reader.c b/dlls/xmllite/tests/reader.c
index c7108945a92..47192f9a189 100644
--- a/dlls/xmllite/tests/reader.c
+++ b/dlls/xmllite/tests/reader.c
@@ -2241,8 +2241,8 @@ static void test_namespaceuri(void)
 
 static void test_read_charref(void)
 {
-    static const char testA[] = "<a b=\"c\">&#x1f3;&#x103;</a>";
-    static const WCHAR chardataW[] = {0x01f3,0x0103,0};
+    static const char testA[] = "<a b=\"c\">&#x1f3;&#x103;&gt;</a>";
+    static const WCHAR chardataW[] = {0x01f3,0x0103,'>',0};
     const WCHAR *value;
     IXmlReader *reader;
     XmlNodeType type;
@@ -2252,7 +2252,7 @@ static void test_read_charref(void)
     hr = CreateXmlReader(&IID_IXmlReader, (void **)&reader, NULL);
     ok(hr == S_OK, "S_OK, got %08x\n", hr);
 
-    stream = create_stream_on_data(testA, sizeof(testA));
+    stream = create_stream_on_data(testA, sizeof(testA)-1);
     hr = IXmlReader_SetInput(reader, (IUnknown *)stream);
     ok(hr == S_OK, "got %08x\n", hr);
 
@@ -2272,6 +2272,10 @@ static void test_read_charref(void)
     ok(hr == S_OK, "got %08x\n", hr);
     ok(type == XmlNodeType_EndElement, "Unexpected node type %d\n", type);
 
+    hr = IXmlReader_Read(reader, &type);
+    ok(hr == S_FALSE, "got %08x\n", hr);
+    ok(type == XmlNodeType_None, "Unexpected node type %d\n", type);
+
     IXmlReader_Release(reader);
     IStream_Release(stream);
 }