[xml] using xmlTextWriterStartAttributeNS causing infinite loop

[Rob Richards <rrichards ctindustries net>]

When using xmlTextWriterStartAttributeNS, I am running into a stack 
overflow as I end up in an infinite loop.
Reduced code down to smallest example and using 
xmlTextWriterEndAttribute makes no difference.

writer = xmlNewTextWriterFilename ("testwriter.xml", 0);
xmlTextWriterStartElement (writer, "element");
xmlTextWriterStartAttributeNS (writer, "prefix", "nameatt", "nsuri");
xmlTextWriterEndElement (writer);
xmlFreeTextWriter (writer);

When xmlTextWriterEndAttribute is hit (in this case from 
xmlTextWriterEndElement), I get stuck in:
while (!xmlListEmpty(writer->nsstack)) {

The nsstack doesnt get popped until after xmlTextWriterWriteAttribute 
call, but in the meantime, xmlTextWriterWriteAttribute calls 
xmlTextWriterEndAttribute. The only way I could figure out how to get 
this to work was to pop it before the xmlTextWriterWriteAttribute call, 
which also meant having to dupe the prefix and uri. On a windows box 
right now so havent been able to run regression tests.

Rob

Index: xmlwriter.c
===================================================================
RCS file: /cvs/gnome/gnome-xml/xmlwriter.c,v
retrieving revision 1.27
diff -u -r1.27 xmlwriter.c
--- xmlwriter.c    9 Nov 2004 16:16:59 -0000    1.27
+++ xmlwriter.c    21 Feb 2005 13:03:09 -0000
@@ -1832,21 +1832,34 @@
            sum += count;

            while (!xmlListEmpty(writer->nsstack)) {
+                xmlChar *namespaceURI = NULL;
+                xmlChar *prefix = NULL;
+
                lk = xmlListFront(writer->nsstack);
                np = (xmlTextWriterNsStackEntry *) xmlLinkGetData(lk);
+
+                if (np != 0) {
+                    namespaceURI = xmlStrdup(np->prefix);
+                    prefix = xmlStrdup(np->uri);
+                }
+
+                xmlListPopFront(writer->nsstack);
+
                if (np != 0) {
                    count =
-                        xmlTextWriterWriteAttribute(writer, np->prefix,
-                                                    np->uri);
+                        xmlTextWriterWriteAttribute(writer, prefix,
+                                                    namespaceURI);
+
+                    xmlFree(namespaceURI);
+                    xmlFree(prefix);
+
                    if (count < 0) {
                        xmlListDelete(writer->nsstack);
-            writer->nsstack = NULL;
+                        writer->nsstack = NULL;
                        return -1;
                    }
                    sum += count;
                }
-
-                xmlListPopFront(writer->nsstack);
            }
            break;