Parse document with entity reference in element contents.
xmlNodeBufGetContent(el) returns NULL instead of entity value.
        //-----------------------------------------------
        xmlNodePtr el = xmlDocGetRootElement(doc);
        xmlNodePtr ref = el->children; // entity reference here 
        xmlChar* r1 = xmlNodeGetContent(el);
        xmlChar* r2 = xmlNodeGetContent(ref);
        // r1 is NULL (if there is only one child),  r2 is the contents of the 
entity reference

XML file used:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE xmluiml SYSTEM "file:///c:/tmp/DTDFile.dtd">
<xmluiml>&hello;</xmluiml>

with DTDFile.dtd:
<!ENTITY hello "Hello">


Explanation:

For element node its children are iterated and for entity reference there is a 
recursive call for getting value for _children_ of the entity reference. On the 
other hand, in the case when function is called for entity reference node, an 
entity node is retrieved by name and function is recursively called for _entity 
node's_ children list. 

How to fix:

Replace in xmlNodeBufGetContent within switch's XML_ELEMENT_NODE branch:
                        ...
                        case XML_ENTITY_REF_NODE:
                            xmlNodeBufGetContent(buffer, tmp->children);
                            break;
                        ...
with
                        case XML_ENTITY_REF_NODE:
                            xmlNodeBufGetContent(buffer, tmp);
                            break;

Function will be recursively called for XML_ENTITY_REF_NODE and same processing 
(the correct one) will be held for getting content from the entity reference.