Fixed SAX2 validation: grow of internal namespace list, appending of

* xmlschemas.c: Fixed SAX2 validation: grow of internal
  namespace list, appending of element character content.
* xstc/xstc.py: Added "--sax" option for SAX2 validation.
diff --git a/xmlschemas.c b/xmlschemas.c
index 47efede..aea885a 100644
--- a/xmlschemas.c
+++ b/xmlschemas.c
@@ -21942,8 +21942,7 @@
 
 static int
 xmlSchemaValidatorPushElem(xmlSchemaValidCtxtPtr vctxt)
-{
-    vctxt->depth++;
+{    
     vctxt->inode = xmlSchemaGetFreshElemInfo(vctxt);
     if (vctxt->inode == NULL) {
 	VERROR_INT("xmlSchemaValidatorPushElem",
@@ -21995,8 +21994,9 @@
     if ((inode->typeDef == NULL) ||
 	(inode->flags & XML_SCHEMA_NODE_INFO_ERR_BAD_TYPE)) {
 	/*
-	* The type definition might be missing if the element was
-	* error prone.
+	* 1. the type definition might be missing if the element was
+	*    error prone
+	* 2. it might be abstract.
 	*/
 	goto end_elem;
     }
@@ -22747,11 +22747,14 @@
 	* Concat the value.
 	*/	
 	if (vctxt->inode->flags & XML_SCHEMA_NODE_INFO_FLAG_OWNED_VALUES) {
-	    vctxt->inode->value =
-		BAD_CAST xmlStrncatNew(vctxt->inode->value, value, -1);
+	    xmlChar *tmp;
+
+	    tmp = BAD_CAST xmlStrncatNew(vctxt->inode->value, value, len);
+	    xmlFree((xmlChar *) vctxt->inode->value);
+	    vctxt->inode->value = tmp;
 	} else {
 	    vctxt->inode->value =
-		BAD_CAST xmlStrncatNew(vctxt->inode->value, value, -1);
+		BAD_CAST xmlStrncatNew(vctxt->inode->value, value, len);
 	    vctxt->inode->flags |= XML_SCHEMA_NODE_INFO_FLAG_OWNED_VALUES;
 	}
     }	
@@ -22874,7 +22877,7 @@
 	vctxt->inode->flags |= XML_SCHEMA_NODE_INFO_ERR_BAD_TYPE;
 	ret = XML_SCHEMAV_CVC_TYPE_2;
     	    VERROR(ret, NULL,
-    	    "The type definition is abstract");
+    	    "The type definition is abstract");	
 	goto exit;
     }
     /*
@@ -22953,6 +22956,7 @@
 
 	if (nodeType == XML_ELEMENT_NODE) {
 	    
+	    vctxt->depth++;
 	    if (xmlSchemaValidatorPushElem(vctxt) == -1) {
 		VERROR_INT("xmlSchemaVReaderWalk",
 		    "calling xmlSchemaValidatorPushElem()");
@@ -23207,9 +23211,10 @@
     * SAX VAL TODO: What to do with nb_defaulted?
     */
     /*
-    * Skip elements if inside a "skip" wildcard.
+    * Skip elements if inside a "skip" wildcard or invalid.
     */
-    if ((vctxt->skipDepth != -1) && (vctxt->depth > vctxt->skipDepth))
+    vctxt->depth++;
+    if ((vctxt->skipDepth != -1) && (vctxt->depth >= vctxt->skipDepth))
 	return;
     /*
     * Push the element.
@@ -23252,7 +23257,7 @@
 		ielem->nsBindings =
 		    (const xmlChar **) xmlRealloc(
 			(void *) ielem->nsBindings,
-			ielem->nbNsBindings * 2 * sizeof(const xmlChar *));
+			ielem->sizeNsBindings * 2 * sizeof(const xmlChar *));
 		if (ielem->nsBindings == NULL) {
 		    xmlSchemaVErrMemory(vctxt,
 			"re-allocating namespace bindings for SAX validation",
@@ -23328,7 +23333,7 @@
     int res;
 
     /*
-    * Skip elements if inside a "skip" wildcard.
+    * Skip elements if inside a "skip" wildcard or if invalid.
     */
     if (vctxt->skipDepth != -1) {
 	if (vctxt->depth > vctxt->skipDepth) {
@@ -23676,6 +23681,7 @@
 	    /*
 	    * Init the node-info.
 	    */
+	    vctxt->depth++;
 	    if (xmlSchemaValidatorPushElem(vctxt) == -1)
 		goto internal_error;
 	    ielem = vctxt->inode;