diff --git a/ChangeLog b/ChangeLog
index 77ac6455..8f51f5d2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Mon Aug 25 12:37:05 CEST 2003 Daniel Veillard <daniel@veillard.com>
+
+	* relaxng.c: fixed a couple of stupid bugs in the state allocation
+	  routines which led to bug #120040 and the ones reported by
+	  Martijn Faassen
+
 Mon Aug 25 12:37:23 CEST 2003 Igor Zlatkovic <igor@zlatkovic.com>
 
 	* include/libxml/parserInternals.h include/libxml/relaxng.h
diff --git a/relaxng.c b/relaxng.c
index c498c0b9..cdcc0798 100644
--- a/relaxng.c
+++ b/relaxng.c
@@ -1076,6 +1076,7 @@ xmlRelaxNGNewValidState(xmlRelaxNGValidCtxtPtr ctxt, xmlNodePtr node)
 		return (ret);
 	    }
 	    ret->attrs = tmp;
+	    ret->maxAttrs = nbAttrs;
 	}
 	ret->nbAttrs = nbAttrs;
 	if (nbAttrs < MAX_ATTR) {
@@ -1153,6 +1154,7 @@ xmlRelaxNGCopyValidState(xmlRelaxNGValidCtxtPtr ctxt,
 		return (ret);
 	    }
 	    ret->maxAttrs = state->maxAttrs;
+	    ret->attrs = tmp;
 	}
 	memcpy(ret->attrs, state->attrs, state->nbAttrs * sizeof(xmlAttrPtr));
     }