xmlIO.c, around line 165 (functions xmlCleanupInputCallbacks() and
xmlCleanupOutputCallbacks()):
for (i = xmlOutputCallbackNr - 1; i <= 0; i--) {
I take it that should be '>= 0'.
robert