[xml] Crash in xmlFreeParserInputBuffer

[Kail <kaildio gmail com>]

I've a crash during the free of a InputBuffer. I want to know if i've
done a mistake with the API or if there is a bug in the library. A
simplified esample code is this:

int Validate(xmlDocPtr doc)
{
        xmlValidCtxtPtr ctx;
        xmlDtdPtr dtd;
        xmlParserInputBufferPtr buf;
        const char *mem =
"<!ELEMENT slair (docum+)><!ELEMENT docum ((category)*, title,
body)><!ELEMENT category (entry)*><!ELEMENT entry (#PCDATA)><!ELEMENT
title (#PCDATA)><!ELEMENT body (#PCDATA)><!ATTLIST category catname
CDATA #REQUIRED>";
        
        buf = xmlParserInputBufferCreateStatic  (mem, strlen(mem),
XML_CHAR_ENCODING_ASCII);
        if (buf == NULL)
        {
                ERRORSTREAM << "Fatal error creating dtd buffer.\n" ;
                return 0;
        }

        dtd = xmlIOParseDTD (NULL, buf, XML_CHAR_ENCODING_ASCII);
        //xmlFreeParserInputBuffer(buf);   <--- HERE
        if(dtd == NULL)
        {
                ERRORSTREAM << "Dtd parse failed.\n" ;
                return 0;
        }
        ctx = xmlNewValidCtxt();
        //Is valid?
        if( xmlValidateDtd(ctx, doc, dtd) )
        {
                //Yes
                xmlFreeValidCtxt(ctx);
                xmlFreeDtd(dtd);
                return 1;
        }
        //No!
        return 0;
}

The input doc is the result of a successfull xslt transform.
Following the chrash for a bit, i've found it in buf->content pointer
during the free function.
I've compiled in /MD, static to the bin.
I'm using v .24 but i've tried also .26 (the last). In the last
version this function do not chrash, but destroys (alters) the doc
tree and ruins my data (i don't know in witch way, sorry); in this
last version i've not followed the error (matter of time). Actually i
simple don't free the buffer, the memory leak is small and is now only
a minor problem for my application.
But maybe could be a problem for other or maybe the mistake is mine
(in the use of the API).

Thanks for support in advance.
Andrea Cuneo