From a5c52d202a2efda6c08f92547ca2f0415ae66409 Mon Sep 17 00:00:00 2001
From: Sebastian Pipping <sebastian@pipping.org>
Date: Wed, 10 Sep 2025 20:01:01 +0200
Subject: [PATCH] Fix freeing of the content model by making use of
 XML_FreeContentModel

This ensures that any wrapping applied to
XML_Memory_Handling_Suite.free_fcn inside of Expat (e.g. adding/
subtracting a constant offset to/from the pointers passed)
is not bypassed but respected.

Related documentation:
- https://libexpat.github.io/doc/api/latest/#XML_SetElementDeclHandler
- https://libexpat.github.io/doc/api/latest/#XML_FreeContentModel
---
 Expat/Expat.xs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Expat/Expat.xs b/Expat/Expat.xs
index dbad380..32fdce5 100644
--- a/Expat/Expat.xs
+++ b/Expat/Expat.xs
@@ -741,7 +741,7 @@ elementDecl(void *data,
 
   cmod = generate_model(model);
 
-  Safefree(model);
+  XML_FreeContentModel(cbv->p, model);
   PUSHMARK(sp);
   EXTEND(sp, 3);
   PUSHs(cbv->self_sv);