libxml2 does not call a cleanup callback registered via xmlDeregisterNodeDefault(...) for XML_ENTITY_DECL nodes which may lead to memory leaks if the xmlNode::_private member is used for allocating user data.

Steps to reproduce:
1. Create test XML file with the following content, say leak.xml:
<!DOCTYPE root SYSTEM "leak.dtd" [
<!ENTITY myname "Peter">
]>
<root>&myname;</root>

2. C code to highlight the problem:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <libxml/xmlmemory.h>
#include <libxml/parser.h>

void clenup( xmlNodePtr  xmlnode )
{
    printf( "Cleanup POINTER: %p TYPE: %d\n", xmlnode, xmlnode->type );
}

void printXMLNode( xmlNodePtr  node )
{
    xmlNodePtr  current;
    for ( current = node; current; current = current->next )
    {
        printf( "POINTER: %p TYPE: %d\n", node, current->type );
        printXMLNode( current->children );
    }
}

int  main( int argc, char **  argv )
{
    xmlDocPtr       doc;
    xmlNodePtr      current;

    if (argc != 2)
    {
        fprintf( stdout, "Usage: %s <xml doc>\n", argv[0] );
        return 1;
    }

    xmlDeregisterNodeDefault( clenup );
    doc = xmlParseFile( argv[1] );
    if (doc == NULL )
    {
        fprintf( stderr, "Cannot parse the document\n" );
        return 2;
    }

    printf( "DOC POINTER: %p TYPE: %d\n", doc, doc->type );
    if ( doc->intSubset != NULL )
        printf( "INTSUBSET POINTER: %p TYPE: %d\n", doc->intSubset,
                                                    doc->intSubset->type );
    if ( doc->extSubset != NULL )
        printf( "EXTSUBSET POINTER: %p TYPE: %d\n", doc->extSubset,
                                                    doc->extSubset->type );
    printXMLNode( xmlDocGetRootElement( doc ) );

    xmlFreeDoc( doc );
    return 0;
}


Example of the output:

[satskyse@iebdev3 libxml2bug]$ ./leak leak.xml
Cleanup POINTER: 0x61ded40 TYPE: 1
DOC POINTER: 0x61db550 TYPE: 9
INTSUBSET POINTER: 0x61db710 TYPE: 14
POINTER: 0x61db810 TYPE: 1
POINTER: 0x61db8b0 TYPE: 5
POINTER: 0x61de980 TYPE: 17
POINTER: 0x61dede0 TYPE: 3
Cleanup POINTER: 0x61db550 TYPE: 9
Cleanup POINTER: 0x61db710 TYPE: 14
Cleanup POINTER: 0x61dede0 TYPE: 3
Cleanup POINTER: 0x61db810 TYPE: 1
Cleanup POINTER: 0x61db8b0 TYPE: 5


The output line
POINTER: 0x61de980 TYPE: 17
shows that one of the nodes is allocated at the address 0x61de980 and has the type 17 i.e. XML_ENTITY_DECL. The cleanup callback is not called for this node.