GeezerVison

A character data callback can disable buffering or remove the next event handler during a flush. Interning an attribute name can also change ordered_attributes while pyexpat is filling the attribute container. Using the freed buffer, cleared handler, or wrong container type can crash the interpreter. Clear the buffered length before dispatch, keep the active handler alive, recheck the buffer and handlers after callbacks, and use one attribute mode for the whole start event.
(cherry picked from commit 0ba58e7)

Co-authored-by: Jelle Zijlstra [email protected]

• Issue: Fix minor safety issues #159739