diff -urp mxml-2.6.orig/mxml-string.c mxml-2.6/mxml-string.c
--- mxml-2.6.orig/mxml-string.c	2009-04-18 17:05:52.000000000 +0000
+++ mxml-2.6/mxml-string.c	2010-06-25 05:46:10.000000000 +0000
@@ -430,6 +430,9 @@ _mxml_vstrdupf(const char *format,	/* I
   * needed...
   */
 
+  va_list ap2;
+  va_copy(ap2, ap);
+
   bytes = vsnprintf(temp, sizeof(temp), format, ap);
 
   if (bytes < sizeof(temp))
@@ -438,6 +441,7 @@ _mxml_vstrdupf(const char *format,	/* I
     * Hey, the formatted string fits in the tiny buffer, so just dup that...
     */
 
+    va_end(ap2);
     return (strdup(temp));
   }
 
@@ -447,7 +451,8 @@ _mxml_vstrdupf(const char *format,	/* I
   */
 
   if ((buffer = calloc(1, bytes + 1)) != NULL)
-    vsnprintf(buffer, bytes + 1, format, ap);
+    vsnprintf(buffer, bytes + 1, format, ap2);
+  va_end(ap2);
 
  /*
   * Return the new string...