447899 potential double free in xmlFreeTextReader
* xmlreader.c: a document may still be referenced by fakenode,
just free fakenode before freeing the document.
diff --git a/xmlreader.c b/xmlreader.c
index eda32f3..1e562c2 100644
--- a/xmlreader.c
+++ b/xmlreader.c
@@ -2214,6 +2214,9 @@
xmlFree(reader->patternTab);
}
#endif
+ if (reader->faketext != NULL) {
+ xmlFreeNode(reader->faketext);
+ }
if (reader->ctxt != NULL) {
if (reader->dict == reader->ctxt->dict)
reader->dict = NULL;
@@ -2235,9 +2238,6 @@
xmlFree(reader->sax);
if ((reader->input != NULL) && (reader->allocs & XML_TEXTREADER_INPUT))
xmlFreeParserInputBuffer(reader->input);
- if (reader->faketext != NULL) {
- xmlFreeNode(reader->faketext);
- }
if (reader->buffer != NULL)
xmlBufferFree(reader->buffer);
if (reader->entTab != NULL)