i.e. <test><data> </data></test>The xmlDocPtr passed in to the function does contain the entity declarations btw
When the entity is parsed a call to xmlParseBalancedChunkInternal is made with the context created from xmlParseBalancedChunkMemory which has a temporary myDoc property. The content is cretated as being owned by the temporary doc.
The temporary doc from the top level xmlParseBalancedChunkMemory is freed leaving the created list from when the entity was parsed with an invalid pointer which ultimately causes a crash when the structure is freed.
Attached patch just sets the owning doc for the list to the same one that owns the parent entity if not so already. No issues ever with dict as the dict from the original doc is passed along in each of the new contexts.
Rob
Attachment:
parser.c.diff.txt
Description: Text document