[Botan-announce] Botan 1.2.5

[Jack L. <ll...@ac...>]

Botan 1.2.5 was released this afternoon, fixing many bugs. In particular,
compilation problems affecting Visual Studio .NET and CodeWarrior 8 were
fixed, several memory leaks were plugged, two major errors in SSL3-MAC were
fixed, a potential denial of service vulnerability in X509_Store was
removed, and various minor bugs in the MPI code were also fixed. Three
poorly designed functions in X509:: and PKCS8:: have been deprecated (check
doc/deprecated.txt for details). The x509opt.h, primes.h, and desx.h
headers have been removed, and their contents moved into other headers
(desx.h was already empty in 1.2.[0-4]).

In VS .NET, two warnings are disabled via #pragma in config.h (both
warnings are, as far as I can determine, useless). In any case, with those
two warnings blocked and a bunch of minor source changes, Botan compiles
cleanly with the /W3 flag (unless, of course, I messed up). I haven't tried
using CodeWarrior 8, but the three problems that were reported in 1.2.4
have been fixed, so it seems likely it will build there as well.

This release also has a major revamping of the memory allocation system,
which is now simpler, faster (the validation suite, as a whole, runs about
15% faster thanks to this change), and has less overhead. In addition, it's
much easier to write a custom allocation system, because all of the
housekeeping that each allocator had been forced to do is collected in the
SecureAllocator base class (both the malloc and mmap based allocators are
less than half the size they were in 1.2.4). The alloc_mlock module has
been completely removed, replaced by the ml_unix module. This moves the
memory locking allocator into the library itself, which simply calls the
locking functions (which are, right now, either stubs or implemented in the
ml_unix module). This will make it very easy to support other locking
functions in the future.

All the bugs I know of are fixed in this release, so please let me know if
you run into any problems.

-Jack