Enabled std=c23/stc=c99 for all builds; fixed Valgrind suppressions; updated release notes

configure.ac

@@ -42,6 +42,10 @@ AC_CONFIG_HEADERS([config.h])
 # to make
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
+dnl save the user-provided CFLAGS so we can detect an explicit -std= later
+dnl and not override it with our own choice of the C standard
+XMLSEC_CFLAGS_USER="$CFLAGS"
+
 dnl
 dnl Check the environment
 dnl
@@ -2711,13 +2715,6 @@ elif test "z$build_with_gcc" = "zyes" ; then
         CFLAGS="$CFLAGS -Wformat-overflow=2"
     fi
 
-    dnl GCC >= 14: --std=c23 (added in GCC 14)
-    if test "$gcc_major_ver" -ge 14 ; then
-        CFLAGS="$CFLAGS -std=c23"
-    else
-        CFLAGS="$CFLAGS -std=c99"
-    fi
-
     AC_MSG_RESULT([yes])
 elif test "z$build_with_clang" = "zyes" ; then
     dnl Flags supported since Clang 3.x (always available in any modern Clang)
@@ -2735,18 +2732,44 @@ elif test "z$build_with_clang" = "zyes" ; then
         CFLAGS="$CFLAGS -Wdouble-promotion -Wnull-dereference"
     fi
 
-    dnl Clang >= 18: --std=c23 (added in Clang 18)
-    if test "$clang_major_ver" -ge 18 ; then
-        CFLAGS="$CFLAGS -std=c23"
-    else
-        CFLAGS="$CFLAGS -std=c99"
-    fi
-
     AC_MSG_RESULT([yes])
 else
     AC_MSG_RESULT([disabled (unsupported compiler)])
 fi
 
+dnl ==========================================================================
+dnl C standard: use C23 if the compiler (recent GCC or Clang) supports it.
+dnl C23 provides memset_explicit() which xmlSecMemCleanse() prefers for
+dnl secure zeroing of sensitive data.
+dnl ==========================================================================
+AC_MSG_CHECKING([for C23 support])
+case " $XMLSEC_CFLAGS_USER " in
+    *" -std="*)
+        AC_MSG_RESULT([no (custom -std= in CFLAGS)])
+        ;;
+    *)
+        XMLSEC_CFLAGS_SAVE="$CFLAGS"
+        CFLAGS="$CFLAGS -std=c23"
+        AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
+            #if !defined(__STDC_VERSION__) || __STDC_VERSION__ < 202311L
+            #error "the compiler does not support C23"
+            #endif
+        ]],[[
+            /* compiled as C23 */
+        ]])],
+            [XMLSEC_USE_C23="yes"],
+            [XMLSEC_USE_C23="no"])
+        CFLAGS="$XMLSEC_CFLAGS_SAVE"
+        if test "z$XMLSEC_USE_C23" = "zyes" ; then
+            CFLAGS="$CFLAGS -std=c23"
+            AC_MSG_RESULT([yes])
+        else
+            CFLAGS="$CFLAGS -std=c99"
+            AC_MSG_RESULT([no (use -std=c99)])
+        fi
+        ;;
+esac
+
 dnl ==========================================================================
 dnl Security hardening flags (GCC/Clang only, enabled by default)
 dnl
@@ -2844,7 +2867,7 @@ else
 fi
 
 dnl ==========================================================================
-dnl Secure memset (DEPREACTED in favor or true secure wipe -- see xmlSecMemCleanse)
+dnl Secure memset (DEPRECATED in favor of true secure wipe -- see xmlSecMemCleanse)
 dnl ==========================================================================
 AC_MSG_CHECKING(for secure memset)
 AC_ARG_ENABLE([secure-memset], [AS_HELP_STRING([--enable-secure-memset],[enable secure memset compilation flags (DEPRECATED, yes)])])

docs/md/index.md

@@ -15,28 +15,39 @@ see the Copyright file in the distribution for details.
 
 ## News
 
-- **TBD**
+- **October 27, 2026**
   The [XML Security Library 1.3.13](download.md) release includes the following changes:
   - (xmlsec-core, **not backward compatible**) Fixed several issues with Relationship transform handling.
-    To restore the old (broken) behaviour, use `--relationship-legacy` flag (or set corresponding flag in
-    the `xmlSecDSigCtx` structs in your application code).
+    To restore the old (broken) behaviour, use `--relationship-legacy` flag (or set the
+    `XMLSEC_DSIG_FLAGS_RELATIONSHIP_LEGACY` flag in the `xmlSecDSigCtx` struct in your application code).
   - (xmlsec-core, **not backward compatible**) Restricted the default enabled reference and transform URIs
     to empty and same document URIs only. Use  `--enabled-reference-uris`, `--enabled-retrieval-method-uris`,
   `--enabled-key-info-reference-uris`, etc. parameters for XMLSec command line tool if local or remote URIs
     usage is required (or set corresponding flag in the `xmlSecDSigCtx` and `xmlSecEncCtx` structs in your
-    application code).
+    application code). The `any` value is now accepted by these options to enable all URI types.
   - (xmlsec-core, **not backward compatible**) Enforced restrictions on max depth when processing encrypted keys,
     key agreements, etc. Use the new `--max-encrypted-key-level` option to control the maximum depth level for
     these use cases. (default is 1).
   - (xmlsec-core, **not backward compatible**) Include files have been cleaned up to remove unnecessary includes,
     fix circular dependencies, etc.
+  - (xmlsec-core, **not backward compatible**) Removed support for negative values in BN string conversion/parsing helpers;
+    values are now treated as unsigned magnitudes.
+  - (xmlsec-build, **not backward compatible**) Added '-std=c23' compiler flag for building the library
+    on compilers that support it or '-std=c99' otherwise (this flag was only enabled with --enable-pedantic builds
+    in the past).
+  - (xmlsec-openssl, xmlsec-nss, xmlsec-gnutls, xmlsec-mscng, xmlsec-mscrypto, xmlsec-gcrypt,
+    **not backward compatible**) Reject zero-length CBC padding blocks in all CBC finalization paths.
+  - (xmlsec-mscng) Added support for using both current user and local machine certificates store for verifying
+    the certificates (new `xmlSecMSCngAppGetCurrentUserCertStoreName()` / `xmlSecMSCngAppGetLocalMachineCertStoreName()`
+    APIs; `xmlSecMSCngAppGetCertStoreName` is now a deprecated alias).
+  - (xmlsec-nss) Hardened CRL verification: CRLs without `thisUpdate` / `nextUpdate` are rejected, and the CRL
+    issuer certificate is chain-verified with CA usage.
   - (xmlsec-build, **not backward compatible**) Added `--enable-hardening` option to `configure` script and
     `hardening` option to `configure.ps1` script to enable security hardening flags on GCC, Clang, and MSVC
     when the compiler version and the target architecture support it (default: `yes`).
-  - (xmlsec-openssl) Added checks to enforce full consumption of parsed DER objects.
-  - (xmlsec-mscng) Added support for using both current user and local machine certificates store for verifying
-    the certificates.
-  - (xmlsec-mscng) Enforced HMAC length checks similar to other crypto backends.
+  - (xmlsec-build) Deprecated the `--enable-secure-memset` option (memory cleansing is now always built in with
+    the new `xmlSecMemCleanse()` function) and removed the test-only `--enable-skm` option; the fuzz targets in
+    `apps/oss-fuzz/` are now built and run by `make check` / `nmake check` by default.
   - (xmlsec-windows) Added `apps` option to `configure.ps1` to control whether the command-line binaries in
     the `apps/` folder are built (default: `yes`).
   - Many other small fixes (see [commit log](https://github.com/lsh123/xmlsec/commits/xmlsec_1_3_13) for more details).

docs/md/news.md

@@ -1,8 +1,41 @@
 # XML Security Library: News
 
-- **TBD**
+- **October 27, 2026**
   The [XML Security Library 1.3.13](download.md) release includes the following changes:
-  - Several other small fixes (see [more details](https://github.com/lsh123/xmlsec/commits/xmlsec_1_3_13)).
+  - (xmlsec-core, **not backward compatible**) Fixed several issues with Relationship transform handling.
+    To restore the old (broken) behaviour, use `--relationship-legacy` flag (or set the
+    `XMLSEC_DSIG_FLAGS_RELATIONSHIP_LEGACY` flag in the `xmlSecDSigCtx` struct in your application code).
+  - (xmlsec-core, **not backward compatible**) Restricted the default enabled reference and transform URIs
+    to empty and same document URIs only. Use  `--enabled-reference-uris`, `--enabled-retrieval-method-uris`,
+  `--enabled-key-info-reference-uris`, etc. parameters for XMLSec command line tool if local or remote URIs
+    usage is required (or set corresponding flag in the `xmlSecDSigCtx` and `xmlSecEncCtx` structs in your
+    application code). The `any` value is now accepted by these options to enable all URI types.
+  - (xmlsec-core, **not backward compatible**) Enforced restrictions on max depth when processing encrypted keys,
+    key agreements, etc. Use the new `--max-encrypted-key-level` option to control the maximum depth level for
+    these use cases. (default is 1).
+  - (xmlsec-core, **not backward compatible**) Include files have been cleaned up to remove unnecessary includes,
+    fix circular dependencies, etc.
+  - (xmlsec-core, **not backward compatible**) Removed support for negative values in BN string conversion/parsing helpers;
+    values are now treated as unsigned magnitudes.
+  - (xmlsec-build, **not backward compatible**) Added '-std=c23' compiler flag for building the library
+    on compilers that support it or '-std=c99' otherwise (this flag was only enabled with --enable-pedantic builds
+    in the past).
+  - (xmlsec-openssl, xmlsec-nss, xmlsec-gnutls, xmlsec-mscng, xmlsec-mscrypto, xmlsec-gcrypt,
+    **not backward compatible**) Reject zero-length CBC padding blocks in all CBC finalization paths.
+  - (xmlsec-mscng) Added support for using both current user and local machine certificates store for verifying
+    the certificates (new `xmlSecMSCngAppGetCurrentUserCertStoreName()` / `xmlSecMSCngAppGetLocalMachineCertStoreName()`
+    APIs; `xmlSecMSCngAppGetCertStoreName` is now a deprecated alias).
+  - (xmlsec-nss) Hardened CRL verification: CRLs without `thisUpdate` / `nextUpdate` are rejected, and the CRL
+    issuer certificate is chain-verified with CA usage.
+  - (xmlsec-build, **not backward compatible**) Added `--enable-hardening` option to `configure` script and
+    `hardening` option to `configure.ps1` script to enable security hardening flags on GCC, Clang, and MSVC
+    when the compiler version and the target architecture support it (default: `yes`).
+  - (xmlsec-build) Deprecated the `--enable-secure-memset` option (memory cleansing is now always built in with
+    the new `xmlSecMemCleanse()` function) and removed the test-only `--enable-skm` option; the fuzz targets in
+    `apps/oss-fuzz/` are now built and run by `make check` / `nmake check` by default.
+  - (xmlsec-windows) Added `apps` option to `configure.ps1` to control whether the command-line binaries in
+    the `apps/` folder are built (default: `yes`).
+  - Many other small fixes (see [commit log](https://github.com/lsh123/xmlsec/commits/xmlsec_1_3_13) for more details).
 
 - **June 23, 2026**
   The [XML Security Library 1.3.12](download.md) release includes the following changes:

src/buffer.c

@@ -10,10 +10,10 @@
  * @brief Binary memory buffer functions.
  */
 
-/* Required for xmlSecMemCleanse when compiled with --enable-pedantic (i.e. with -std=c99 or -std=c23) (also see configure.ac) */
+/* Required for xmlSecMemCleanse when compiled with -std=c99 or -std=c23 (also see configure.ac) */
 #if defined(__GNUC__) && !defined(_GNU_SOURCE)
 #define _GNU_SOURCE
-#endif
+#endif /* defined(__GNUC__) && !defined(_GNU_SOURCE) */
 
 #include "globals.h"
 

src/mscng/x509vfy.c

@@ -1437,7 +1437,6 @@ xmlSecMSCngX509GetCertName(const xmlChar* name) {
 static BYTE*
 xmlSecMSCngCertStrToName(DWORD dwCertEncodingType, LPTSTR pszX500, DWORD dwStrType, DWORD* len) {
     BYTE* str = NULL;
-    LPCTSTR ppszError = NULL;
 
     xmlSecAssert2(pszX500 != NULL, NULL);
     xmlSecAssert2(len != NULL, NULL);
@@ -1448,7 +1447,7 @@ xmlSecMSCngCertStrToName(DWORD dwCertEncodingType, LPTSTR pszX500, DWORD dwStrTy
      * (both byte counts), even in a Unicode build where sizeof(TCHAR) == 2; the buffer
      * below is sized as sizeof(TCHAR) * (*len + 1), which is always >= *len + 1 bytes.
      * See https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-certstrtoname */
-    if (!CertStrToName(dwCertEncodingType, pszX500, dwStrType, NULL, NULL, len, &ppszError)) {
+    if (!CertStrToName(dwCertEncodingType, pszX500, dwStrType, NULL, NULL, len, NULL)) {
         /* this might not be an error, string might just not exist */
         return(NULL);
     }
@@ -1460,8 +1459,7 @@ xmlSecMSCngCertStrToName(DWORD dwCertEncodingType, LPTSTR pszX500, DWORD dwStrTy
     }
     memset(str, 0, sizeof(TCHAR) * ((*len) + 1));
 
-    if (!CertStrToName(dwCertEncodingType, pszX500, dwStrType,
-                        NULL, str, len, NULL)) {
+    if (!CertStrToName(dwCertEncodingType, pszX500, dwStrType, NULL, str, len, NULL)) {
         xmlSecMSCngLastError("CertStrToName", NULL);
         xmlFree(str);
         return(NULL);

src/mscrypto/x509vfy.c

@@ -1041,13 +1041,11 @@ xmlSecMSCryptoX509StoreFinalize(xmlSecKeyDataStorePtr store) {
 static BYTE*
 xmlSecMSCryptoCertStrToName(DWORD dwCertEncodingType, LPCTSTR pszX500, DWORD dwStrType, DWORD* len) {
     BYTE* str = NULL;
-    LPCTSTR ppszError = NULL;
 
     xmlSecAssert2(pszX500 != NULL, NULL);
     xmlSecAssert2(len != NULL, NULL);
 
-    if (!CertStrToName(dwCertEncodingType, pszX500, dwStrType,
-                        NULL, NULL, len, &ppszError)) {
+    if (!CertStrToName(dwCertEncodingType, pszX500, dwStrType, NULL, NULL, len, NULL)) {
         /* this might not be an error, string might just not exist */
         return(NULL);
     }
@@ -1059,8 +1057,7 @@ xmlSecMSCryptoCertStrToName(DWORD dwCertEncodingType, LPCTSTR pszX500, DWORD dwS
     }
     memset(str, 0, sizeof(TCHAR) * ((*len) + 1));
 
-    if (!CertStrToName(dwCertEncodingType, pszX500, dwStrType,
-                        NULL, str, len, NULL)) {
+    if (!CertStrToName(dwCertEncodingType, pszX500, dwStrType, NULL, str, len, NULL)) {
         xmlSecMSCryptoError("CertStrToName", NULL);
         xmlFree(str);
         return(NULL);

tests/testrun.sh

@@ -51,16 +51,15 @@ fi
 #
 # Valgrind
 #
+valgrind_suppression="--suppressions=$topfolder/valgrind.supp"
 if [ "z$crypto" = "zopenssl" ] ; then
-    valgrind_suppression="--suppressions=$topfolder/valgrind-openssl.supp"
+    valgrind_suppression="$valgrind_suppression --suppressions=$topfolder/valgrind-openssl.supp"
 elif [ "z$crypto" = "znss" ] ; then
-    valgrind_suppression="--suppressions=$topfolder/valgrind-nss.supp"
+    valgrind_suppression="$valgrind_suppression --suppressions=$topfolder/valgrind-nss.supp"
 elif [ "z$crypto" = "zgcrypt" ] ; then
-    valgrind_suppression="--suppressions=$topfolder/valgrind-gcrypt.supp"
+    valgrind_suppression="$valgrind_suppression --suppressions=$topfolder/valgrind-gcrypt.supp"
 elif [ "z$crypto" = "zgnutls" ] ; then
-    valgrind_suppression="--suppressions=$topfolder/valgrind-gnutls.supp"
-else
-    valgrind_suppression=""
+    valgrind_suppression="$valgrind_suppression --suppressions=$topfolder/valgrind-gnutls.supp"
 fi
 
 valgrind_options="--leak-check=full --show-reachable=yes --num-callers=32 --track-origins=yes -s"