Index: /trunk/include/iprt/cpp/xml.h
===================================================================
--- /trunk/include/iprt/cpp/xml.h	(revision 33834)
+++ /trunk/include/iprt/cpp/xml.h	(revision 33835)
@@ -673,4 +673,7 @@
 
     void write(const Document &doc, void** ppvBuf, size_t *pcbSize);
+
+private:
+    void* m_pBuf;
 };
 
Index: /trunk/src/VBox/Main/ApplianceImplExport.cpp
===================================================================
--- /trunk/src/VBox/Main/ApplianceImplExport.cpp	(revision 33834)
+++ /trunk/src/VBox/Main/ApplianceImplExport.cpp	(revision 33835)
@@ -1725,5 +1725,4 @@
             /* Write the ovf file to disk. */
             vrc = RTSha1WriteBuf(strOvfFile.c_str(), pvBuf, cbSize, pCallbacks, pStorage);
-            RTMemFree(pvBuf);
             if (RT_FAILURE(vrc))
                 throw setError(VBOX_E_FILE_ERROR,
Index: /trunk/src/VBox/Runtime/r3/xml.cpp
===================================================================
--- /trunk/src/VBox/Runtime/r3/xml.cpp	(revision 33834)
+++ /trunk/src/VBox/Runtime/r3/xml.cpp	(revision 33835)
@@ -1463,4 +1463,5 @@
 
 XmlMemWriter::XmlMemWriter()
+  : m_pBuf(0)
 {
 }
@@ -1468,12 +1469,18 @@
 XmlMemWriter::~XmlMemWriter()
 {
+    if (m_pBuf)
+        xmlFree(m_pBuf);
 }
 
 void XmlMemWriter::write(const Document &doc, void **ppvBuf, size_t *pcbSize)
 {
-    xmlChar* pBuf;
+    if (m_pBuf)
+    {
+        xmlFree(m_pBuf);
+        m_pBuf = 0;
+    }
     int size;
-    xmlDocDumpFormatMemory(doc.m->plibDocument, &pBuf, &size, 1);
-    *ppvBuf = pBuf;
+    xmlDocDumpFormatMemory(doc.m->plibDocument, (xmlChar**)&m_pBuf, &size, 1);
+    *ppvBuf = m_pBuf;
     *pcbSize = size;
 }