Security fixes for opensaml2 and xmltooling

[Florian Weimer]

* Scott Cantor:

> My point was that it's never inlined in the sense of true inlining in C++.
> If it's virtual, the language rules ensure that it's only called through the
> vtable, never generated inline in the caller.

This is not true, GCC has supported devirtualization for some time.
For instance, in this example, demo() is optimized into a direct call
to bar().

struct Parent {
  virtual ~Parent() { }
  virtual void foo();
};

extern void bar();

struct Child : Parent {
  virtual void foo() {
    bar();
  }
};

void
demo()
{
  Child c;
  c.foo();
}

(Please keep Cc: me, I'm not subscribed to the mailing list.  We've
losted security@ somewhere along the way, but I don't think that it
matters now. 8-)