From e0e8d35b1af33733c41465623ae4d497852c8a93 Mon Sep 17 00:00:00 2001
From: John MacFarlane <jgm@berkeley.edu>
Date: Thu, 4 Jun 2015 10:56:57 +0200
Subject: Clarify that entities resolving to U+0000 are replaced by U+FFFD.

Closes #323.
---
 spec.txt | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/spec.txt b/spec.txt
index c619e9c..6c660bb 100644
--- a/spec.txt
+++ b/spec.txt
@@ -4285,13 +4285,14 @@ corresponding codepoints.
 [Decimal entities](@decimal-entities)
 consist of `&#` + a string of 1--8 arabic digits + `;`. Again, these
 entities need to be recognised and transformed into their corresponding
-unicode codepoints. Invalid unicode codepoints will be written as the
-"unknown codepoint" character (`0xFFFD`)
+unicode codepoints. Invalid unicode codepoints will be replaced by
+the "unknown codepoint" character (`U+FFFD`).  For security reasons,
+the codepoint `U+0000` will also be replaced by `U+FFFD`.
 
 .
-&#35; &#1234; &#992; &#98765432;
+&#35; &#1234; &#992; &#98765432; &#0;
 .
-<p># Ӓ Ϡ �</p>
+<p># Ӓ Ϡ � �</p>
 .
 
 [Hexadecimal entities](@hexadecimal-entities)
-- 
cgit v1.2.3