tree 17a2eb4e65c31f4f3ed863bcc6592525b5a6dd79
parent fc27759d2a5984ecf7a0d3183cafa4e828125ac6
author Nick Wellnhofer <wellnhofer@aevum.de> 1542893338 +0100
committer Nick Wellnhofer <wellnhofer@aevum.de> 1542900526 +0100

Set doc on element obtained from freeElems

In commit 8c9daf79, a call to xmlFreeNode was added in
xmlSAX2StartElementNs. If a node was obtained from the freeElems list,
make sure to set the doc, otherwise xmlFreeNode wouldn't realize that
the node name might be in the dictionary, causing an invalid free.

Note that the issue fixed in commit 8c9daf79 requires commit 0ed6addb
and this one to work properly.

Found by OSS-Fuzz.