diff --git a/tests/networkxml2argvtest.c b/tests/networkxml2argvtest.c
index 03d2097d38b6bfd435f2ac524cbbc0cbfd9a457d..1ed5fada3196601fda9d48aea02f5cd1989720f5 100644
--- a/tests/networkxml2argvtest.c
+++ b/tests/networkxml2argvtest.c
@@ -18,18 +18,19 @@
 /* Replace all occurrences of @token in @buf by @replacement and adjust size of
  * @buf accordingly. Returns 0 on success and -1 on out-of-memory errors. */
 static int replaceTokens(char **buf, const char *token, const char *replacement) {
-    char *token_start, *token_end;
+    size_t token_start, token_end;
     size_t buf_len, rest_len;
     const size_t token_len = strlen(token);
     const size_t replacement_len = strlen(replacement);
     const int diff = replacement_len - token_len;
 
     buf_len = rest_len = strlen(*buf) + 1;
-    token_end = *buf;
+    token_end = 0;
     for (;;) {
-        token_start = strstr(token_end, token);
-        if (token_start == NULL)
+        char *match = strstr(*buf + token_end, token);
+        if (match == NULL)
             break;
+        token_start = match - *buf;
         rest_len -= token_start + token_len - token_end;
         token_end = token_start + token_len;
         buf_len += diff;
@@ -37,8 +38,8 @@ static int replaceTokens(char **buf, const char *token, const char *replacement)
             if (VIR_REALLOC_N(*buf, buf_len) < 0)
                 return -1;
         if (diff != 0)
-            memmove(token_end + diff, token_end, rest_len);
-        memcpy(token_start, replacement, replacement_len);
+            memmove(*buf + token_end + diff, *buf + token_end, rest_len);
+        memcpy(*buf + token_start, replacement, replacement_len);
         token_end += diff;
     }
     /* if diff < 0, we could shrink the buffer here... */