confuse tokenizer. Obtained from: expat CVS Security: CVE-2009-3720
UTF-8 sequences. Obtained from: expat CVS (revisions 1.14 and 1.15) Security: CVE-2009-3560