- valid.c tree.c parserInternals.c parser.c: Stephan Kulow
  provided another failing case found in KDE, the way the
  ctxt->vctxt.nodeTab was allocated and freed changed over
  time but it wasn't completely cleaned up. This should fix it.
Daniel
diff --git a/valid.c b/valid.c
index 07ad05f..e9049e0 100644
--- a/valid.c
+++ b/valid.c
@@ -38,6 +38,7 @@
         if (ctxt->name##Tab == NULL) {					\
 	    xmlGenericError(xmlGenericErrorContext,			\
 		    "malloc failed !\n");				\
+	    ctxt->name##Max = 0;					\
 	    return(0);							\
 	}								\
     }									\
@@ -3699,6 +3700,8 @@
     /*
      * The first entry in the stack is reserved to the current state
      */
+    ctxt->nodeMax = 0;
+    ctxt->nodeNr = 0;
     ctxt->nodeTab = NULL;
     ctxt->vstate = &ctxt->vstateTab[0];
     ctxt->vstateNr = 1;
@@ -3829,6 +3832,7 @@
 	ctxt->vstateTab = NULL;
     }
     ctxt->nodeMax = 0;
+    ctxt->nodeNr = 0;
     if (ctxt->nodeTab != NULL) {
 	xmlFree(ctxt->nodeTab);
 	ctxt->nodeTab = NULL;