Index: src/OFXMLParser.h
==================================================================
--- src/OFXMLParser.h
+++ src/OFXMLParser.h
@@ -124,23 +124,16 @@
 		OF_XMLPARSER_EXPECT_DELIM,
 		OF_XMLPARSER_IN_ATTR_VALUE,
 		OF_XMLPARSER_EXPECT_CLOSE,
 		OF_XMLPARSER_EXPECT_SPACE_OR_CLOSE,
 		OF_XMLPARSER_IN_EXCLAMATIONMARK,
-		OF_XMLPARSER_IN_CDATA_OPENING_1,
-		OF_XMLPARSER_IN_CDATA_OPENING_2,
-		OF_XMLPARSER_IN_CDATA_OPENING_3,
-		OF_XMLPARSER_IN_CDATA_OPENING_4,
-		OF_XMLPARSER_IN_CDATA_OPENING_5,
-		OF_XMLPARSER_IN_CDATA_OPENING_6,
+		OF_XMLPARSER_IN_CDATA_OPENING,
 		OF_XMLPARSER_IN_CDATA_1,
 		OF_XMLPARSER_IN_CDATA_2,
-		OF_XMLPARSER_IN_CDATA_3,
 		OF_XMLPARSER_IN_COMMENT_OPENING,
 		OF_XMLPARSER_IN_COMMENT_1,
 		OF_XMLPARSER_IN_COMMENT_2,
-		OF_XMLPARSER_IN_COMMENT_3,
 		OF_XMLPARSER_IN_DOCTYPE,
 		OF_XMLPARSER_NUM_STATES
 	} state;
 	OFMutableString *cache;
 	OFString *name;

Index: src/OFXMLParser.m
==================================================================
--- src/OFXMLParser.m
+++ src/OFXMLParser.m
@@ -93,23 +93,16 @@
 		@selector(_parseExpectDelimiterWithBuffer:i:last:),
 		@selector(_parseInAttributeValueWithBuffer:i:last:),
 		@selector(_parseExpectCloseWithBuffer:i:last:),
 		@selector(_parseExpectSpaceOrCloseWithBuffer:i:last:),
 		@selector(_parseInExclamationMarkWithBuffer:i:last:),
-		@selector(_parseInCDATAOpening1WithBuffer:i:last:),
-		@selector(_parseInCDATAOpening2WithBuffer:i:last:),
-		@selector(_parseInCDATAOpening3WithBuffer:i:last:),
-		@selector(_parseInCDATAOpening4WithBuffer:i:last:),
-		@selector(_parseInCDATAOpening5WithBuffer:i:last:),
-		@selector(_parseInCDATAOpening6WithBuffer:i:last:),
+		@selector(_parseInCDATAOpeningWithBuffer:i:last:),
 		@selector(_parseInCDATA1WithBuffer:i:last:),
 		@selector(_parseInCDATA2WithBuffer:i:last:),
-		@selector(_parseInCDATA3WithBuffer:i:last:),
 		@selector(_parseInCommentOpeningWithBuffer:i:last:),
 		@selector(_parseInComment1WithBuffer:i:last:),
 		@selector(_parseInComment2WithBuffer:i:last:),
-		@selector(_parseInComment3WithBuffer:i:last:),
 		@selector(_parseInDoctypeWithBuffer:i:last:),
 	};
 	memcpy(selectors, sels, sizeof(sels));
 
 	for (i = 0; i < OF_XMLPARSER_NUM_STATES; i++) {
@@ -363,14 +356,13 @@
 			     last: (size_t*)last
 {
 	const char *cache_c, *tmp;
 	size_t len, cache_len;
 
-	if (buf[*i] != ' ' && buf[*i] != '\n' && buf[*i] != '\r' &&
-	    buf[*i] != '>' && buf[*i] != '/')
+	if (buf[*i] != ' ' && buf[*i] != '\t' && buf[*i] != '\n' &&
+	    buf[*i] != '\r' && buf[*i] != '>' && buf[*i] != '/')
 		return;
-
 
 	if ((len = *i - *last) > 0)
 		[cache appendCStringWithoutUTF8Checking: buf + *last
 						 length: len];
 
@@ -457,12 +449,12 @@
 	OFAutoreleasePool *pool;
 	const char *cache_c, *tmp;
 	size_t len, cache_len;
 	OFString *ns;
 
-	if (buf[*i] != ' ' && buf[*i] != '\n' && buf[*i] != '\r' &&
-	    buf[*i] != '>')
+	if (buf[*i] != ' ' && buf[*i] != '\t' && buf[*i] != '\n' &&
+	    buf[*i] != '\r' && buf[*i] != '>')
 		return;
 
 	if ((len = *i - *last) > 0)
 		[cache appendCStringWithoutUTF8Checking: buf + *last
 						 length: len];
@@ -525,13 +517,13 @@
 	OFAutoreleasePool *pool;
 	OFString *ns;
 	OFXMLAttribute **attrs_c;
 	size_t j, attrs_cnt;
 
-
 	if (buf[*i] != '>' && buf[*i] != '/') {
-		if (buf[*i] != ' ' && buf[*i] != '\n' && buf[*i] != '\r') {
+		if (buf[*i] != ' ' && buf[*i] != '\t' && buf[*i] != '\n' &&
+		    buf[*i] != '\r') {
 			*last = *i;
 			state = OF_XMLPARSER_IN_ATTR_NAME;
 			(*i)--;
 		}
 
@@ -577,11 +569,10 @@
 		[namespaces removeNObjects: 1];
 	} else if (prefix != nil) {
 		OFString *str = [OFString stringWithFormat: @"%s:%s",
 							    [prefix cString],
 							    [name cString]];
-
 		[previous addObject: str];
 	} else
 		[previous addObject: name];
 
 	[pool release];
@@ -657,11 +648,10 @@
 	size_t len;
 
 	if (buf[*i] != delim)
 		return;
 
-
 	if ((len = *i - *last) > 0)
 		[cache appendCStringWithoutUTF8Checking: buf + *last
 						 length: len];
 
 	pool = [[OFAutoreleasePool alloc] init];
@@ -710,11 +700,12 @@
 				      last: (size_t*)last
 {
 	if (buf[*i] == '>') {
 		*last = *i + 1;
 		state = OF_XMLPARSER_OUTSIDE_TAG;
-	} else if (buf[*i] != ' ' && buf[*i] != '\n' && buf[*i] != '\r')
+	} else if (buf[*i] != ' ' && buf[*i] != '\t' && buf[*i] != '\n' &&
+	    buf[*i] != '\r')
 		@throw [OFMalformedXMLException newWithClass: isa];
 }
 
 /* In <! */
 - (void)_parseInExclamationMarkWithBuffer: (const char*)buf
@@ -721,127 +712,65 @@
 					i: (size_t*)i
 				     last: (size_t*)last
 {
 	if (buf[*i] == '-')
 		state = OF_XMLPARSER_IN_COMMENT_OPENING;
-	else if (buf[*i] == '[')
-		state = OF_XMLPARSER_IN_CDATA_OPENING_1;
-	else if (buf[*i] == 'D') {
+	else if (buf[*i] == '[') {
+		state = OF_XMLPARSER_IN_CDATA_OPENING;
+		level = 0;
+	} else if (buf[*i] == 'D') {
 		state = OF_XMLPARSER_IN_DOCTYPE;
 		level = 0;
 	} else
 		@throw [OFMalformedXMLException newWithClass: isa];
 
 	*last = *i + 1;
 }
 
 /* CDATA */
-- (void)_parseInCDATAOpening1WithBuffer: (const char*)buf
-				      i: (size_t*)i
-				   last: (size_t*)last
-{
-	if (buf[*i] == 'C')
-		state = OF_XMLPARSER_IN_CDATA_OPENING_2;
-	else
-		@throw [OFMalformedXMLException newWithClass: isa];
-
-	*last = *i + 1;
-}
-
-- (void)_parseInCDATAOpening2WithBuffer: (const char*)buf
-				      i: (size_t*)i
-				   last: (size_t*)last
-{
-	if (buf[*i] == 'D')
-		state = OF_XMLPARSER_IN_CDATA_OPENING_3;
-	else
-		@throw [OFMalformedXMLException newWithClass: isa];
-
-	*last = *i + 1;
-}
-
-- (void)_parseInCDATAOpening3WithBuffer: (const char*)buf
-				      i: (size_t*)i
-				   last: (size_t*)last
-{
-	if (buf[*i] == 'A')
-		state = OF_XMLPARSER_IN_CDATA_OPENING_4;
-	else
-		@throw [OFMalformedXMLException newWithClass: isa];
-
-	*last = *i + 1;
-}
-
-- (void)_parseInCDATAOpening4WithBuffer: (const char*)buf
-				      i: (size_t*)i
-				   last: (size_t*)last
-{
-	if (buf[*i] == 'T')
-		state = OF_XMLPARSER_IN_CDATA_OPENING_5;
-	else
-		@throw [OFMalformedXMLException newWithClass: isa];
-
-	*last = *i + 1;
-}
-
-- (void)_parseInCDATAOpening5WithBuffer: (const char*)buf
-				      i: (size_t*)i
-				   last: (size_t*)last
-{
-	if (buf[*i] == 'A')
-		state = OF_XMLPARSER_IN_CDATA_OPENING_6;
-	else
-		@throw [OFMalformedXMLException newWithClass: isa];
-
-	*last = *i + 1;
-}
-
-- (void)_parseInCDATAOpening6WithBuffer: (const char*)buf
-				      i: (size_t*)i
-				   last: (size_t*)last
-{
-	if (buf[*i] == '[')
-		state = OF_XMLPARSER_IN_CDATA_1;
-	else
-		@throw [OFMalformedXMLException newWithClass: isa];
+- (void)_parseInCDATAOpeningWithBuffer: (const char*)buf
+				     i: (size_t*)i
+				  last: (size_t*)last
+{
+	if (buf[*i] != "CDATA["[level])
+		@throw [OFMalformedXMLException newWithClass: isa];
+
+	if (++level == 6) {
+		state = OF_XMLPARSER_IN_CDATA_1;
+		level = 0;
+	}
 
 	*last = *i + 1;
 }
 
 - (void)_parseInCDATA1WithBuffer: (const char*)buf
 			       i: (size_t*)i
 			    last: (size_t*)last
 {
 	if (buf[*i] == ']')
+		level++;
+	else
+		level = 0;
+
+	if (level == 2)
 		state = OF_XMLPARSER_IN_CDATA_2;
 }
 
 - (void)_parseInCDATA2WithBuffer: (const char*)buf
 			       i: (size_t*)i
-			    last: (size_t*)last
-{
-	if (buf[*i] == ']')
-		state = OF_XMLPARSER_IN_CDATA_3;
-	else
-		state = OF_XMLPARSER_IN_CDATA_1;
-}
-
-- (void)_parseInCDATA3WithBuffer: (const char*)buf
-			       i: (size_t*)i
 			    last: (size_t*)last
 {
 	OFAutoreleasePool *pool;
 	OFMutableString *cdata;
 	size_t len;
 
 	if (buf[*i] != '>') {
-		if (buf[*i] != ']')
-			state = OF_XMLPARSER_IN_CDATA_1;
+		state = OF_XMLPARSER_IN_CDATA_1;
+		level = (buf[*i] == ']' ? 1 : 0);
 
 		return;
 	}
-
 
 	pool = [[OFAutoreleasePool alloc] init];
 
 	[cache appendCStringWithoutUTF8Checking: buf + *last
 					 length: *i - *last];
@@ -875,40 +804,36 @@
 	if (buf[*i] != '-')
 		@throw [OFMalformedXMLException newWithClass: isa];
 
 	*last = *i + 1;
 	state = OF_XMLPARSER_IN_COMMENT_1;
+	level = 0;
 }
 
 - (void)_parseInComment1WithBuffer: (const char*)buf
 				 i: (size_t*)i
 			      last: (size_t*)last
 {
 	if (buf[*i] == '-')
+		level++;
+	else
+		level = 0;
+
+	if (level == 2)
 		state = OF_XMLPARSER_IN_COMMENT_2;
 }
 
 - (void)_parseInComment2WithBuffer: (const char*)buf
 				 i: (size_t*)i
-			      last: (size_t*)last
-{
-	state = (buf[*i] == '-' ?
-	    OF_XMLPARSER_IN_COMMENT_3 :
-	    OF_XMLPARSER_IN_COMMENT_1);
-}
-
-- (void)_parseInComment3WithBuffer: (const char*)buf
-				 i: (size_t*)i
 			      last: (size_t*)last
 {
 	OFAutoreleasePool *pool;
 	OFMutableString *comment;
 	size_t len;
 
 	if (buf[*i] != '>')
 		@throw [OFMalformedXMLException newWithClass: isa];
-
 
 	pool = [[OFAutoreleasePool alloc] init];
 
 	[cache appendCStringWithoutUTF8Checking: buf + *last
 					 length: *i - *last];

Index: tests/OFXMLParserTests.m
==================================================================
--- tests/OFXMLParserTests.m
+++ tests/OFXMLParserTests.m
@@ -54,11 +54,11 @@
 		break;
 	case 2:
 		TEST(msg, et == STRING && [string isEqual: @"\n "])
 		break;
 	case 3:
-		TEST(msg, et == CDATA && [string isEqual: @"f<oo"])
+		TEST(msg, et == CDATA && [string isEqual: @"f<]]]oo"])
 		break;
 	case 4:
 		TEST(msg, et == TAG_START && [name isEqual: @"bar"] &&
 		    prefix == nil && ns == nil && attrs == nil)
 		break;
@@ -301,11 +301,11 @@
 - (void)XMLParserTests
 {
 	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
 	OFXMLParser *parser;
 	const char *str = "<?xml version='1.0'?><!DOCTYPE <<><<>>>><root>\n"
-	    " <![CDATA[f<oo]]><bar/>\n"
+	    " <![CDATA[f<]]]oo]]><bar/>\n"
 	    " <foobar xmlns='urn:objfw:test:foobar'>\n"
 	    "  <qux xmlns:foo='urn:objfw:test:foo'>\n"
 	    "   <foo:bla foo:bla='&#x62;&#x6c;&#x61;' blafoo='foo'>\n"
 	    "    <blup foo:qux='asd' quxqux='test'/>\n"
 	    "    <bla:bla\r\rxmlns:bla=\"urn:objfw:test:bla\" qux='qux'\r\n"