expat parsing destructively?

I want to do something with expat which seems elegant to me but I need 
to find out if it makes sense, if there's a way to do it, and if anyone 
has prior experience or example code.

Imagine I have a complete XML document in a memory buffer and pass the 
starting address of the buffer to expat for parsing. Some of the 
attributes will need to be added into a hash table or similar in-memory 
data structure. In the way I've seen expat used that would mean calling 
malloc/strdup on the values passed into the callback, putting them in 
the table, then arranging to free them later. But, given that the entire 
document is already stored in a malloc-ed buffer for which I have no 
further use once parsed, I've been thinking how great it would be if 
expat would work "destructively", which in this case means writing a 
null byte at the back of each attribute value. This would be safe as it 
would always replace the trailing quote.

If it would do that I could just put the data in the table as is and 
cleanup would be as simple as freeing the buffer. No debugging of memory 
leaks or bad frees, no heap fragmentation, simpler and faster code. For 
all I know expat already works like this but I can't find any 
documentation which discusses it. Does anyone know or have a pointer to 
related documentation?

Thanks,
MB