diff --git a/pom.xml b/pom.xml
index e99c9a9..76e4a4f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -76,6 +76,12 @@ limitations under the License.
5.9.2
test
+
+ org.hamcrest
+ hamcrest
+ 2.2
+ test
+
diff --git a/src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java b/src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java
index 9f4396b..63fffed 100644
--- a/src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java
+++ b/src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java
@@ -2528,9 +2528,11 @@ private void parsePI() throws XmlPullParserException, IOException {
if ((buf[piTargetStart] == 'x' || buf[piTargetStart] == 'X')
&& (buf[piTargetStart + 1] == 'm' || buf[piTargetStart + 1] == 'M')
&& (buf[piTargetStart + 2] == 'l' || buf[piTargetStart + 2] == 'L')) {
- if (piTargetStart > 3) { // 2) { // nnn";
+
+ MXParser parser = new MXParser();
+ parser.setInput(new StringReader(ws + xml));
+ assertThat(
+ assertThrows(XmlPullParserException.class, parser::next).getMessage(),
+ containsString("XMLDecl is only allowed as first characters in input"));
+
+ parser.setInput(new StringReader(ws + xml));
+ assertEquals(XmlPullParser.IGNORABLE_WHITESPACE, parser.nextToken());
+ assertThat(
+ assertThrows(XmlPullParserException.class, parser::nextToken).getMessage(),
+ containsString("processing instruction can not have PITarget with reserved xml name"));
+ }
}