diff --git a/instant-xml/src/impls.rs b/instant-xml/src/impls.rs
index ea5e237..c33dd5e 100644
--- a/instant-xml/src/impls.rs
+++ b/instant-xml/src/impls.rs
@@ -490,28 +490,30 @@ pub(crate) fn decode(input: &str) -> Cow<'_, str> {
 
     let mut last_end = 0;
     while input_len - last_end >= 4 {
-        match &input[last_end..(last_end + 4)] {
-            "&lt;" => {
-                result.push('<');
-                last_end += 4;
-                continue;
-            }
-            "&gt;" => {
-                result.push('>');
-                last_end += 4;
-                continue;
-            }
-            _ => (),
-        };
+        if input.is_char_boundary(last_end + 4) {
+            match &input[last_end..(last_end + 4)] {
+                "&lt;" => {
+                    result.push('<');
+                    last_end += 4;
+                    continue;
+                }
+                "&gt;" => {
+                    result.push('>');
+                    last_end += 4;
+                    continue;
+                }
+                _ => (),
+            };
+        }
 
-        if input_len - last_end >= 5 {
+        if input_len - last_end >= 5 && input.is_char_boundary(last_end + 5) {
             if &input[last_end..(last_end + 5)] == "&amp;" {
                 result.push('&');
                 last_end += 5;
                 continue;
             }
 
-            if input_len - last_end >= 6 {
+            if input_len - last_end >= 6 && input.is_char_boundary(last_end + 6) {
                 match &input[last_end..(last_end + 6)] {
                     "&apos;" => {
                         result.push('\'');
diff --git a/instant-xml/tests/direct.rs b/instant-xml/tests/direct.rs
index 931bd32..8b34b1b 100644
--- a/instant-xml/tests/direct.rs
+++ b/instant-xml/tests/direct.rs
@@ -14,9 +14,9 @@ struct Foo {
 fn direct() {
     let v = Foo {
         flag: true,
-        inner: "hello".to_string(),
+        inner: "cbdté".to_string(),
     };
-    let xml = "<Foo flag=\"true\">hello</Foo>";
+    let xml = "<Foo flag=\"true\">cbdté</Foo>";
 
     assert_eq!(to_string(&v).unwrap(), xml);
     assert_eq!(from_str::<Foo>(xml), Ok(v));