--- a/lisp/replace.el	Mon Aug 13 11:25:03 2007 +0200
+++ b/lisp/replace.el	Mon Aug 13 11:26:11 2007 +0200
@@ -679,6 +679,7 @@
 	;; Loop finding occurrences that perhaps should be replaced.
 	(while (and keep-going
 		    (not (eobp))
+		    (or (null limit) (< (point) limit))
 		    (let ((case-fold-search qr-case-fold-search))
 		      (funcall search-function search-string limit))
 		    ;; If the search string matches immediately after
@@ -688,7 +689,8 @@
 			    (and regexp-flag
 				 (eq lastrepl (match-beginning 0))
 				 (not match-again)))
-			(if (eobp)
+			(if (or (eobp)
+				(and limit (>= (point) limit)))
 			    nil
 			  ;; Don't replace the null string 
 			  ;; right after end of previous replacement.