[xml] Segmentation fault in xmlFreeDoc

["Chidanand Gangur" <chidanand gangur gmail com>]

Hi,

I am encountering a segmentation fault in xmlFreeDoc function. I have
gone through your example code on xmlsoft.org for reference. I have
googled on this issue and found many such reporters but did not find a
proper solution on this.

I am using 
libxml2-2.6.10 version 
linux redhat 9

I have following function which is called many times. The test runs for
number of times without any problem and crashes all of a sudden in
xmlFreeDoc function. Can some one tell me where am i going wrong? 
Or please give me some pointers to read more. One more point to not is
the process from where i call this function is multi-threaded. 
Any special care to be taken in multi-threading.

INT4 getXMLReqType(INT1 *xmlstr, INT1 *msgtype)
{
    xmlDocPtr  doc;
    xmlNodePtr cur;
    INT1       *pXmlProp=NULL;

    if(NULL == (doc = xmlParseMemory(xmlstr, strlen(xmlstr))))
    {
        DPRINTF("\nError: xmlParseMemory Failed \n");
        xmlCleanupParser();
        return 1;
    }
    cur = xmlDocGetRootElement(doc);

    if (cur == NULL)
    {
        DPRINTF("\nError: Empty Document\n");
        xmlFreeDoc(doc);
        xmlCleanupParser();
        return 1;
    }

    if((!xmlStrcmp(cur->name, (const xmlChar*)ROOT_RESPONSE)) ||
            (!xmlStrcmp(cur->name, (const xmlChar*)ROOT_REQUEST)))
    {
        cur = cur->xmlChildrenNode;
        if(cur != NULL)
        {
            if((!xmlStrcmp(cur->name, (const xmlChar*)REQUEST)) ||
               
(!xmlStrcmp(cur->name, (const xmlChar*)RESPONSE)))
            {
                 /*get type information*/
               
pXmlProp = (INT1 *)xmlGetProp(cur, TYPE);
                if(pXmlProp != NULL )
                {
                   
strncpy(msgtype, (const INT1 *)pXmlProp, REQTYPE_LEN-1);
                   
xmlFree(pXmlProp);
                }
            }
        }
    }
    xmlFreeDoc(doc);   /*crash happens here*/ 
    xmlCleanupParser();
    return SUCCESS;
}

the backtrace of the crash is as follows:

0x27a24f43 in xmlFreeNodeList () from /usr/local/lib/libxml2.so.2
#1  0x27a24fa9 in xmlFreeNodeList () from
/usr/local/lib/libxml2.so.2
#2  0x27a24fa9 in xmlFreeNodeList () from
/usr/local/lib/libxml2.so.2
#3  0x27a22be9 in xmlFreeDoc () from /usr/local/lib/libxml2.so.2
#4  0x080546b9 in getXMLReqType (
    xmlstr=0x27f52f48 "<?xml version=\"1.0\"



-- 
Chidanand Gangur
Pune.