Fix another out-of-bounds read in SSML parsing.

A malformed tag like <foo could cause espeak to read past
the end of the string.

src/libespeak-ng/readclause.c

@@ -614,7 +614,9 @@ int ReadClause(Translator *tr, char *buf, short *charix, int *charix_top, int n_
 						return terminator;
 					}
 					c1 = ' ';
-					c2 = GetC();
+					if (!Eof()) {
+						c2 = GetC();
+					}
 					continue;
 				}
 			}

tests/ssml/malformed-tag1.expected

@@ -0,0 +1 @@
+

tests/ssml/malformed-tag1.ssml

@@ -0,0 +1 @@
+<<foo