fixed a couple of stupid bugs in the state allocation routines which led

* relaxng.c: fixed a couple of stupid bugs in the state allocation
  routines which led to bug #120040 and the ones reported by
  Martijn Faassen
Daniel
diff --git a/relaxng.c b/relaxng.c
index c498c0b..cdcc079 100644
--- a/relaxng.c
+++ b/relaxng.c
@@ -1076,6 +1076,7 @@
 		return (ret);
 	    }
 	    ret->attrs = tmp;
+	    ret->maxAttrs = nbAttrs;
 	}
 	ret->nbAttrs = nbAttrs;
 	if (nbAttrs < MAX_ATTR) {
@@ -1153,6 +1154,7 @@
 		return (ret);
 	    }
 	    ret->maxAttrs = state->maxAttrs;
+	    ret->attrs = tmp;
 	}
 	memcpy(ret->attrs, state->attrs, state->nbAttrs * sizeof(xmlAttrPtr));
     }