While reviewing the undefined behavior issues reported in Bug 752902, I tried changing the declaration of struct _xmlDefAttrs from this:

typedef struct _xmlDefAttrs xmlDefAttrs;
typedef xmlDefAttrs *xmlDefAttrsPtr;
struct _xmlDefAttrs {
    int nbAttrs;	/* number of defaulted attributes on that element */
    int maxAttrs;       /* the size of the array */
    const xmlChar *values[5]; /* array of localname/prefix/values/external */
};

to this:

typedef struct _xmlDefAttrs xmlDefAttrs;
typedef xmlDefAttrs *xmlDefAttrsPtr;
struct _xmlDefAttrs {
    int nbAttrs;	/* number of defaulted attributes on that element */
    int maxAttrs;       /* the size of the array */
    const xmlChar *values[][5]; /* array of localname/prefix/values/external */
};

Then fixed the resulting compiler errors.

The resulted in finding the following bug in xmlParseStartTag2():

		    nsname = xmlGetNamespace(ctxt, attname);
		    if (nsname != defaults->values[2]) {  // Bad offset!
			if (nsPush(ctxt, attname,
			           defaults->values[5 * i + 2]) > 0)
			    nbNs++;
		    }

With the structure change, that should be:

		    nsname = xmlGetNamespace(ctxt, attname);
		    if (nsname != defaults->values[i][2]) {  // Fixed!
			if (nsPush(ctxt, attname,
			           defaults->values[i][2]) > 0)
			    nbNs++;
		    }

If we don't make the structure change, it should be:

		    nsname = xmlGetNamespace(ctxt, attname);
		    if (nsname != defaults->values[5 * i + 2]) {  // Fixed!
			if (nsPush(ctxt, attname,
			           defaults->values[5 * i + 2]) > 0)
			    nbNs++;
		    }