Dear Maintainer,

We found a case where DTD are not correctly handled in some XML files.
Please find in attachment bug.xml and bug.dtd which reproduces the bug:

Result :
$ xmllint --format --noent --loaddtd bug.xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE page SYSTEM "./bug.dtd">
<xml>
  <a b="www.example.org"/>
  <c/>
</xml>

Here, rootDomain is replaces by an empty string instead of "www.example.org".
If both "a" and "c" are reversed, like in good.xml:

$ xmllint --format --noent --loaddtd good.xml
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE page SYSTEM "./bug.dtd">
<xml>
  <c>www.example.org</c>
  <a b="www.example.org"/>
</xml>

rootDomain is well replaced.

Squeeze-lts is also affected.

libxml2 (2.7.8.dfsg-2+squeeze10) is broken
libxml2 (2.7.8.dfsg-2+squeeze8) works well.

Thomas