diff --git a/ChangeLog b/ChangeLog
index d613161b..34b02364 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Wed Jul  6 15:45:48 PDT 2005 William Brack <wbrack@mmm.com.hk>
+
+	* parser.c: fixed problem with free on dupl attribute in
+	  dtd (bug309637).
+	* test/errors/attr3.xml, result/errors/attr3.*: added
+	  regression test for this
+
 Wed Jul  6 13:11:35 PDT 2005 William Brack <wbrack@mmm.com.hk>
 
 	* win32/Makefile.msvc: try again to fix file format for Windows
diff --git a/result/errors/attr3.xml b/result/errors/attr3.xml
new file mode 100644
index 00000000..de1f9285
--- /dev/null
+++ b/result/errors/attr3.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<!DOCTYPE doc [
+<!ELEMENT doc (#PCDATA)>
+<!ATTLIST doc a1 CDATA "v1">
+]>
+<doc/>
diff --git a/result/errors/attr3.xml.err b/result/errors/attr3.xml.err
new file mode 100644
index 00000000..a628ca79
--- /dev/null
+++ b/result/errors/attr3.xml.err
@@ -0,0 +1,3 @@
+./test/errors/attr3.xml:4: validity warning : Attribute a1 of element doc: already defined
+<!ATTLIST doc a1 CDATA "z1">
+                           ^
diff --git a/result/errors/attr3.xml.str b/result/errors/attr3.xml.str
new file mode 100644
index 00000000..a628ca79
--- /dev/null
+++ b/result/errors/attr3.xml.str
@@ -0,0 +1,3 @@
+./test/errors/attr3.xml:4: validity warning : Attribute a1 of element doc: already defined
+<!ATTLIST doc a1 CDATA "z1">
+                           ^
diff --git a/test/errors/attr3.xml b/test/errors/attr3.xml
new file mode 100644
index 00000000..e2567f53
--- /dev/null
+++ b/test/errors/attr3.xml
@@ -0,0 +1,6 @@
+<!DOCTYPE doc [
+<!ELEMENT doc (#PCDATA)>
+<!ATTLIST doc a1 CDATA "v1">
+<!ATTLIST doc a1 CDATA "z1">
+]>
+<doc></doc>
diff --git a/valid.c b/valid.c
index 96e3de6e..ed89c6ca 100644
--- a/valid.c
+++ b/valid.c
@@ -2063,6 +2063,12 @@ xmlAddAttributeDecl(xmlValidCtxtPtr ctxt,
      * fill the structure.
      */
     ret->atype = type;
+    /*
+     * doc must be set before possible error causes call
+     * to xmlFreeAttribute (because it's used to check on
+     * dict use)
+     */
+    ret->doc = dtd->doc;
     if (dict) {
 	ret->name = xmlDictLookup(dict, name, -1);
 	ret->prefix = xmlDictLookup(dict, ns, -1);
@@ -2150,7 +2156,6 @@ xmlAddAttributeDecl(xmlValidCtxtPtr ctxt,
      * Link it to the DTD
      */
     ret->parent = dtd;
-    ret->doc = dtd->doc;
     if (dtd->last == NULL) {
 	dtd->children = dtd->last = (xmlNodePtr) ret;
     } else {