Code execution via stale raw tag-name pointers

Use-after-free in libexpat before 2.4.9 allows remote attackers to crash XML-parsing applications or execute arbitrary code via crafted XML. When parsing resumes inside an internal entity with unclosed tags, doContent returns without storeRawNames copying raw tag names out of the parse buffer, leaving pointers stale after that buffer is changed or reallocated. Exploitation requires an application to suspend and resume parsing during internal-entity substitution and then process attacker-controlled XML; the bounded outcomes are a crash or arbitrary code execution in that application's context.