Index: main/say.c
===================================================================
--- main/say.c	(revision 233576)
+++ main/say.c	(working copy)
@@ -3560,7 +3560,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -3807,7 +3807,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -4009,7 +4009,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -4212,7 +4212,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -4406,7 +4406,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -4546,7 +4546,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				snprintf(nextmsg, sizeof(nextmsg), "%s", sndfile);
@@ -4735,7 +4735,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -4930,7 +4930,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -5160,7 +5160,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -5363,7 +5363,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset = 0;
-				for (sndoffset = 0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -5582,7 +5582,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				snprintf(nextmsg, sizeof(nextmsg), "%s", sndfile);
@@ -5874,7 +5874,7 @@
 			case '\'':
 				/* Literal name of a sound file */
 				sndoffset=0;
-				for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+				for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 					sndfile[sndoffset] = format[offset];
 				sndfile[sndoffset] = '\0';
 				res = wait_file(chan, ints, sndfile, lang);
@@ -7363,7 +7363,7 @@
 		case '\'':
 			/* Literal name of a sound file */
 			sndoffset=0;
-			for (sndoffset=0 ; (format[++offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
+			for (sndoffset=0 ; (format[++offset] != '\0') && (format[offset] != '\'') && (sndoffset < sizeof(sndfile) - 1) ; sndoffset++)
 				sndfile[sndoffset] = format[offset];
 			sndfile[sndoffset] = '\0';
 			res = wait_file(chan, ints, sndfile, lang);