xmllint: Make --push report parse errors

The push parser leaves documents in ctxt->myDoc even if they're invalid.

Also fix documentation.

Regressed with f8ff4d86.

parser.c

@@ -11615,9 +11615,14 @@ done:
  * The last chunk, which will often be empty, must be marked with
  * the @terminate flag. With the default SAX callbacks, the resulting
  * document will be available in ctxt->myDoc. This pointer will not
- * be freed by the library.
+ * be freed when calling xmlFreeParserCtxt and must be freed by the
+ * caller. If the document isn't well-formed, it will still be returned
+ * in ctxt->myDoc.
+ *
+ * As an exception, xmlCtxtResetPush will free the document in
+ * ctxt->myDoc. So ctxt->myDoc should be set to NULL after extracting
+ * the document.
  *
- * If the document isn't well-formed, ctxt->myDoc is set to NULL.
  * The push parser doesn't support recovery mode.
  *
  * Returns an xmlParserErrors code (0 on success).

xmllint.c

@@ -355,6 +355,16 @@ parseXml(xmllintState *lint, const char *filename) {
         ctxt->myDoc = NULL;
         if (f != stdin)
             fclose(f);
+
+        /*
+         * The push parser leaves non-wellformed documents
+         * in ctxt->myDoc.
+         */
+        if (!ctxt->wellFormed) {
+            xmlFreeDoc(doc);
+            doc = NULL;
+        }
+
         return(doc);
     }
 #endif /* LIBXML_PUSH_ENABLED */