Bug: Access violation in ParseList()

The latest version of tidy causes access violation when parsing the
example I have reported previously
(though it's not an infinite loop).

Here's the excerpt from release notes(September 1999).
(http://www.w3.org/People/Raggett/tidy/release-notes.html)

"Kenichi Numata discovered that Tidy looped indefinitely for examples
similar to the following:

<font size=+2>Title
<ol>
</font>Text
</ol>

I have now cured this problem which used to occur when a </font> tag was
placed at the beginning of a list element. ..."

Access violation occurred at line 1422 in parser.c
----
if ((node->tag->model & CM_BLOCK) && lexer->excludeBlocks)
----
in which "node->tag" is null.

Regards.
-- 
Kenichi Numata
Fuji Xerox Co., Ltd.
E-Mail: Kenichi.Numata@fujixerox.co.jp