fix memory leak in htrmAttrVal()