Security fixes for opensaml2 and xmltooling

[Scott Cantor]

Florian Weimer wrote on 2009-09-23:
> This touches a function implicitly declared inline.  We have to rebuild
> all reverse build dependencies (direct and indirect) which instantiate
> MetadataCredentialCriteria objects because each such compilation unit
> has received a local copy of the function.  (There isn't any out-of-line
> method in the class, so there is no compilation unit which contains the
> class vtable and a master copy of that method.)

AFAIK, virtual functions aren't inlined, period. If every object file had
its own copy, the language would break.

> You really should move all definitions of virtual methods (in
> particular, virtual destructors) to .cpp files.  With the exception of
> destructors, they can't be inlined without whole-program analysis
> anyway.  Of course, this is not suitable for a security update because
> it breaks the ABI.

I agree that it's a bad thing, and I'm doing it as I find them and make
changes allowing it, but my understanding is different from yours, not that
I've deeply checked.

-- Scott