Fix AMBIGUOUS_AMPERSAND state

Author: sideshowbarker

src/nu/validator/htmlparser/impl/Tokenizer.java

@@ -3546,13 +3546,14 @@ private void ensureBufferSpace(int inputLength) throws SAXException {
                         } else if ((c >= '0' && c <= '9')
                                 || (c >= 'A' && c <= 'Z')
                                 || (c >= 'a' && c <= 'z')) {
+                            if (++pos == endPos) {
+                                break stateloop;
+                            }
+                            appendCharRefBuf(c);
                             emitOrAppendCharRefBuf(returnState);
                             if ((returnState & DATA_AND_RCDATA_MASK) == 0) {
                                 cstart = pos;
                             }
-                            if (++pos == endPos) {
-                                break stateloop;
-                            }
                             c = checkChar(buf, pos);
                             continue;
                         }