Unlink node before freeing it in xmlSAX2StartElement

The node may have been added to the document already, so it must be
unlinked first. Thanks to David Kilzer for spotting this.

1 files changed, 2 insertions, 0 deletions

diff --git a/SAX2.c b/SAX2.c
index 49ce566c..ac3ab19a 100644
--- a/SAX2.c
+++ b/SAX2.c
@@ -1666,6 +1666,7 @@ xmlSAX2StartElement(void *ctx, const xmlChar *fullname, const xmlChar **atts)
     xmlGenericError(xmlGenericErrorContext, "pushing(%s)\n", name);
 #endif
     if (nodePush(ctxt, ret) < 0) {
+        xmlUnlinkNode(ret);
         xmlFreeNode(ret);
         return;
     }
@@ -2340,6 +2341,7 @@ xmlSAX2StartElementNs(void *ctx,
      * We are parsing a new node.
      */
     if (nodePush(ctxt, ret) < 0) {
+        xmlUnlinkNode(ret);
         xmlFreeNode(ret);
         return;
     }