Adjust the library numbers for release.

autoconf seems to generate the contents in another order, and it
generates anoying changes to git.

ChangeLog

@@ -1,3 +1,805 @@
+*******************************************************************************
+Version 1.6.16
+*******************************************************************************
+
+2012-03-18 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Replace sprintf by snprintf in http_WriteHttpPost
+
+	Replace sprintf by snprintf in http_WriteHttpPost to avoid buffer
+	overflow.
+
+2012-03-18 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Add infoSize parameter to get_sdk_info
+
+	Add infoSize parameter to get_sdk_info function to replace sprintf call
+	by a snprintf call.
+
+2012-03-16 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Check return code in ixml
+
+	Check return code of ixmlDocument_CreateElementEx in
+	ixmlDocument_CreateElement.
+	Check return code of ixmlNode_setNodeName and ixmlNode_setNodeValue in
+	ixmlNode_cloneCDATASect and ixmlNode_cloneTextNode.
+
+2012-03-16 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Add more explicit casts and remove dead code
+
+	Comment unused SERVER from DeviceShutdown.
+	Comment unused max from parse_hostport.
+	Comment unused nodeptr from ixmlNode_cloneDoc.
+	Comment unused newNode from Parser_hasDefaultNamespace.
+	Comment unused Parser_parseReference function
+	Check return code of shutdown and display an error if needed.
+
+2012-03-15 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Fix previous commit
+
+	Replace HAVE_UPNP_OPTSSDP by UPNP_HAVE_OPTSSDP in upnpapi.c.
+
+2012-03-15 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Add --disable-optssdp option
+
+	Modify configure.ac to add --disable-optssdp option. This option will
+	remove OPT, 01-NLS and X_USER_AGENT headers from SSDP messages as those
+	headers are optional. If --disable-gena and disable-optssdp are both
+	used, uuid part will not be compiled anymore.
+
+2012-03-15 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Bug fix in ixmlNode_allowChildren
+
+	Commit d48d73720bd325062c4d3b9ce85f3944be4f562d added a bug in
+	ixmlNode_allowChildren, this function was returning FALSE instead of
+	TRUE when newChild->nodeName was eELEMENT_NODE.
+
+2012-03-15 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Improve upnp/genlib/net
+
+	Change ret_code from int to parse_status_t in match.
+	Set back return code of ReadResponseLineAndHeaders from parse_status_t
+	to int as this function can return UPNP_E_BAD_HTTPMSG. As a result, do
+	not cast the result of this function into parse_status_t in
+	http_OpenHttpGetProxy and http_OpenHttpGetEx.
+	Use switch with PARSE_OK in parsetools.c.
+	Add missing explicit casts of integer constants in uri.c and
+	httpreadwrite.c.
+	Use switch, int and sa_family_t with AF_INET in uri.c.
+	Print an error in http_Download if realloc failed.
+
+2012-03-14 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Use switch instead of if with enums in upnpapi.c
+
+	Replace if statements with switch when using HND_DEVICE and HND_CLIENT
+	enum constants.
+	Correct also UpnpUnRegisterRootDeviceLowPower and UpnpUnRegisterClient
+	as those functions were wrongly awaiting an UPNP_E_INVALID_HANDLE
+	instead of HND_INVALID from GetHandleInfo.
+
+2012-03-14 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Improve ssdp part
+
+	Do not compile CreateClientRequestPacketUlaGua if IPv6 is disable.
+	Cast DestAddr->sa_family from sa_family_t into int when calling
+	CreateServicePacket as this function has been set back to accept int in
+	a692e591defe6ed9a617b9b4a083964a01f7bbab.
+	Use switch instead of if with AF_INET and AF_INET6.
+	Add missing casts from AF_INET and AF_INET6 into sa_family_t when using
+	them to set sin_family and sin6_family.
+	Add missing explicit casts into size_t or lu when using	integer
+	constants with strlen or unsigned long indexes.
+	Set SSDP_PAUSE to be unsigned as it is used with usleep.
+
+2012-03-14 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Use switch insted of if with enums in ixml
+
+	Replace if statements with switch when using enums in ixml.
+	Remove uneeded initialization in ixmlAttr_init, Parser_init and
+	ixmlNode_init which was added by wrongly added in commit
+	06660b6383c438e4e2c9ca9854077cecc4da9e5d.
+
+2012-03-14 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Use switch insted of if with enums in threadutil
+
+	Replace if statements with switch when using enums in threadutil.
+
+2012-03-14 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Fix missing break in http_RecvMessage
+
+	There was a missing break in PARSE_INCOMPLETE_ENTITY due to commit
+	2eb3e069badd5c8676738c3ead37f9551fd8448e.
+
+2012-03-14 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Fix parse failure observed with tvdevice sample.
+
+	Commit c40d2bc0c9b60c43b641ac4669c7b8bbcd6134c5 has a problem
+	at removing the parentheses in parser_parse_responseline.
+	Difference of pointers was used with intention, don't cast
+	them separately.
+
+2012-03-14 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Fix compile error on Windows.
+
+	Include UpnpStdInt.h for ssize_t.
+	Define sa_family_t in UpnpInet.h.
+
+2012-03-14 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Avoid ambiguous change of SsdpEvent in unique_service_name.
+
+	Handle overflow before changing SsdpEvent.
+	Because the behavior of "snprintf" is platform dependent in such case.
+
+2012-03-14 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	SF Bug Tracker id 3502958 - The commit 5944960e prevents a pupnp client (amule) from receiving replies from an IGD device.
+
+	Previous change broke the feature. The error of unique_service_name
+	in ssdp_request_type should be ignored.
+	This reverts commit 5944960e172a797a9fcc196291f4046cafa7f6ec.
+
+2012-03-13 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	Address family is an int
+
+	Reference: "man 2 socket".
+
+2012-03-11 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Remove more implicit casts in upnp part
+
+	Remove more "implicit integer or enum conversions" errors as well as
+	dead code. 
+
+2012-03-11 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Remove more implicit casts in upnp part
+
+	Remove more "implicit integer or enum conversions" as well as memset
+	before snprintf.
+
+2012-03-11 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Avoid out of range access in CheckOtherHTTPHeaders.
+
+	There was a problem in HDR_ACCEPT_LANGUAGE case.
+	It may read from TmpBuf larger amount than allocated,
+	since condition was always true.
+	Terminate RespInstr->AcceptLanguageHeader correctly.
+	Skip allocation if there is already sufficient buffer.
+
+2012-03-10 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Remove some of the implicit cast in upnp part
+
+	Remove some of the "implicit integer or enum conversions" as well as
+	some access to NULL reference in upnp part.
+
+2012-03-10 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Remove lock in ThreadPoolInit
+
+	If ThreadPoolInit returned EAGAIN, tp->lock was not freed. 
+
+2012-03-10 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Improve ixml
+
+	Remove "implicit integer conversions" and
+	"dereference NULL return value" errors in ixml part.
+
+2012-03-10 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Exclude IPv6 stuff in SearchByTarget when UPNP_ENABLE_IPV6 is not defined.
+
+2012-03-10 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Further measures against buffer overflows.
+
+	* Pass output buffer size to CreateClientRequestPacket(UlaGua)
+	  from SearchByTarget and detect overflow.
+	* Handle SearchByTarget error in UpnpSearchAsync.
+	* Pass output buffer size to addrToString and detect overflow.
+	* Handle addrToString error in configure_urlbase. 
+	* Handle overflow in http_SendMessage.
+	* Respect unique_service_name error in ssdp_request_type
+	  so as not to touch non-terminated buffer under Evt.
+	* Treat large argument as error in UpnpAddVirtualDir.
+	* Use strncpy with the standard way in readFromSSDPSocket.
+	* Do not clear buffer before snprintf.
+	* Clarify the last argument of GetDescDocumentAndURL has size LINE_SIZE.
+	* For inet_ntop, use buffer with size INET6_ADDRSTRLEN or INET_ADDRSTRLEN.
+
+2012-03-10 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Handle allocation error in strndup to avoid access violation.
+
+	Return NULL before calling strncpy.
+	Platforms with HAVE_STRNDUP are not affected.
+
+2012-03-10 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Synchronize autoconfig.h with upnpconfig.h.
+
+	It fixes WIN32 build where configure is not invoked. 
+
+2012-03-09 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	More compilaton optimisation
+
+	Do not compile most of service_table.c and client_table.c if
+	--disable-gena is used.
+	Do not compile urlconfig.c if --disable-webserver is used.
+	Adding new UPNP_HAVE_xxx variables in upnpconfig.h and upnpconfig.h.in.
+
+2012-03-09 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Optimisation of --disable-webserver
+
+	Do not compile webserver.c if --disable-webserver is used.
+
+2012-03-09 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Improve threadutil
+
+	Remove "dereference NULL return" errors and implicit conversions to
+	double or enum types.
+
+2012-03-09 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Optimisation of --disable-webserver
+
+	Do not compile miniserver.c if --disable-webserver is used.
+
+2012-03-09 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Adding configure options
+
+	Adding --disable-ssdp, --disable-soap, --disable-gena options to
+	configure script.
+
+2012-03-09 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Bug fix of last commit
+
+	_snprintf was wrongly defined in ssdp_server.c
+
+2012-03-09 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3499781 - msvc doesn't have snprintf
+
+	Submitted: Yoichi NAKAYAMA ( yoichi ) - 2012-03-08 10:18:39 PST
+
+	97a17ff5add73c97844e2fa74456bab4df0800f1 commit breaks build on
+	windows/msvc since there is no snprintf.
+
+	Note:
+	* Some existing sources use _snprintf when WIN32 is defined, but its
+	behavior is a bit different from C99 snprintf.
+	* snprintf does terminate the buffer, so the commit (use buffer size
+	minus 1 as argument) changes the behavior at the boundary.
+	* Truncation might be better than crash in some cases. But it may
+	result in not good.
+
+2012-03-08 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker id 3499878 - UpnpUnSubscribeAsync(): ‘retVal’ may be used uninitialized
+
+	Submitted: Marcelo Roberto Jimenez ( mroberto ) - 2012-03-08 12:38:57 PST
+
+	src/api/upnpapi.c: In function ‘UpnpUnSubscribeAsync’:
+	src/api/upnpapi.c:2060:6: warning: ‘retVal’ may be used uninitialized in this function
+
+2012-03-08 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker id 3175217 - Crash bug in Parser_addNamespace()
+
+	Submitted: Terry Farnham ( tfarnham ) - 2011-02-07 09:25:25 PST
+
+	Details: The strcmp(pNode->prefix,pCur->prefix) crashes on pCur->prefix
+	being NULL. This occurs on invalidly formatted xml where a node uses an
+	undefined namespace. I would expect to receive IXML_FAILED in this
+	situation.
+
+2012-03-08 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Removing access to NULL pointers in node.c and element.c
+
+	Check that newNode is not NULL ixmlNode_cloneNodeTree and pass newAttr
+	as the return node in the ixmlElement_setAttributeNodeNS call of
+	ixmlElement_setAttributeNS.
+
+2012-03-08 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Memory leaks correction in upnpapi.c
+	
+	Fix memory leaks in UpnpUnSubscribe, SendActionExAsync and
+	RenewSubscription.
+
+2012-03-08 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3496993 - Write after free in ixmlNode_insertBefore
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 04:54:40 PST
+
+	If ixmlNode_isParent(nodeptr, newChild) returns TRUE,
+	ixmlNode_removeChild(nodeptr, newChild, NULL) will free newChild before
+	the modifications of newChild->nextSibling and newChild->prevSibling.
+
+2012-03-08 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Remove most of strcpy, sprintf and strcat
+
+	Replace strcpy, sprintf and strcat by strncpy, snprintf and strncat to
+	avoid buffer overflows.
+
+2012-03-07 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	SF Bug Tracker id 3497714 - Buffer overflows
+
+	Fix compile error on WIN32.
+
+	Local variables must be declared first.
+	Remove outdated comment.
+
+2012-03-07 Yoichi NAKAYAMA <yoichi.nakayama(at)gmail.com>
+
+	Avoid access violation in assertion.
+
+	xmlParser->pCurElement was dereferenced before null check.
+	Affects debug build only.
+
+2012-03-07 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Remove SIZEOF_MISTACH error in notify_send_and_recv
+
+	Replace sizeof(CRLF) by strlen(CRLF) as CRLF is a const char*.
+
+2012-03-07 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3498442 - Memory leak in get_file_info
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-07 02:44:30 PST
+
+	info->contentType is not freed before being set to NULL.
+
+2012-03-07 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3498439 - Memory leak in removeServiceTable
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-07 02:35:46 PST
+
+	UDN is not freed.
+
+2012-03-07 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3498436 - Memory leak in Parser_processAttributeName
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-07 02:30:57 PST
+
+	attr is not freed if ixmlNode_setNodeProperties or
+	ixmlNode_setAttributeNode return an error in
+	Parser_processAttributeName.
+
+2012-03-07 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Fixing an error in d6db7c555d0f11856ce5e3e479b16a4cf4689107 commit
+
+	Evt.Sid should not be cast into char* when calling sizeof otherwise
+	size will be 4.
+
+2012-03-06 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Removing two unused variables in ssdp_server.c
+
+	Removing first TempPtr allocation in unique_service_name as well as one
+	of the dbgStr allocation in AdvertizeAndReply as those values were not
+	used.
+
+2012-03-06 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3497714 - Buffer overflows
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-06 07:36:08 PST
+
+	Call to strcpy should be replaced by call to memset and strncpy to
+	avoid getting buffer overflows.
+
+2012-03-05 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker id 2989399 - UpnpSetVirtualDirCallbacks API removal in 1.6.x
+
+	Submitted: Nick Leverton ( leveret ) - 2010-04-19 07:44:10 PDT
+
+	Details: The recent codebase merge has removed a significant API call
+	which is used by several pupnp devices such as mediatomb and gmediaserver.
+	UpnpSetVirtualDirCallbacks() has been replaced by individual routines to
+	set each callback. Essentially this means that 1.6.7 will in fact be a majo
+	bump and 1.6.6 devices can no longer link against it. Could we have the call
+	reinstated please, perhaps as a wrapper around the individual calls ? As
+	it is, all distros will have to patch their 1.6.x apps, rebuild and re-link them.
+
+	The other removed API calls and external variables don't seem to be used
+	by any of the apps I have copies of, but UpnpSetVirtualDirCallbacks is
+	important for maintaining compatibility within 1.6.x.
+
+2012-03-05 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker id 3325246 - Memory Leak in XML Parser
+
+	Submitted: Terry Farnham ( tfarnham ) - 2011-06-23 09:45:54 PDT
+
+	Details: The following bit of xml results in a memory leak from the xml
+	parser:
+
+	const char *xmlbuffer="<?xml version=\"1.0\" encoding=\"utf-8\"?>
+	<root xmlns=\"urn:schemas-upnp-org:device-1-0\" xmlns:dlna=\"urn:schemas-dlna-org:device-1-0\">
+	<dlna:X_DLNADOC xmlns:dlna=\"urn:schemas-dlna-org:device-1-0\">DMS-1.50</dlna:X_DLNADOC></root>";
+
+	When I execute the following code:
+
+	IXML_Document *doc = ixmlParseBuffer(xmlbuffer);
+	ixmlDocument_free(doc);
+
+	It results in a memory leak in ixmlparser.c line 2107 where it calls
+	safe_strdup( newElement->namespaceURI ); It's difficult to figure out why.
+
+2012-03-05 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker id 3417134 - Crash seen in UpnpFinish
+
+	Submitted: Sunil ( sunilangadi ) - 2011-10-02 08:28:47 PDT
+
+	Details: I observed crash in the below mentioned log statement in
+	function upnpfinish(file: upnpapi.c).
+	UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__, "Exiting UpnpFinish:
+		UpnpSdkInit is :%d:\n", UpnpSdkInit);
+
+	In particular it was crashing in ithread_self in
+	UpnpDisplayFileAndLine(file upnpdebug.c) on WIN32.
+
+	Moving the call ithread_cleanup_library() below the upnp printf call
+	mentioned above in function upnpfinish fixed the crash but I couldn't get
+	to the root of the problem.
+
+	The problem was observed on WIN32.
+
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3497159 - Bug fix in Parser_readFileOrBuffer
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 14:20:58 PST
+
+	fileSize = ftell( xmlFilePtr ); can return a negative value, in this
+	 case the function should exit (at the moment, the function exits only
+	if ftell returns 0).
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3497140 - Bug fix in http_get_code_text
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 13:07:03 PST
+
+	Replace if( statusCode < 100 && statusCode >= 600 ) which can't be true
+	by if( statusCode < 100 || statusCode >= 600 ).
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3497126 - Resource leak in http_RecvPostMessage
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 12:33:59 PST
+
+	Fp is not closed when an error is raised on membuffer_append or
+	sock_read.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3497034 - Buffer not null terminated in UpnpGetIfInfo
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:43:52 PST
+
+	gIF_NAME might be not null terminated.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3497033 - Buffer not null terminated in UpnpInit
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:42:18 PST
+
+	gIF_IPV4, gIF_IPV6 and gIF_IPV6_ULA_GUA might be not null terminated.
+	Moreover, gIF_IPV4 should be 16 characters (INET_ADDRSTRLEN) and not 22
+	and gIF_IPV6 should be 46 characters (INET6_ADDRSTRLEN) and not 65.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Bug fix of lastest commit (parse_hostport)
+
+	Missing parenthesis in memset.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3497027 - Buffer not null terminated in parse_hostport
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 06:28:38 PST
+
+	workbuf might be not null terminated.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3497009 - Resource leak in http_SendMessage
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 05:51:44 PST
+
+	Fp is not closed if fseeko(Fp, Instr->RangeOffset, SEEK_CUR) does not return 0.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	HInfo->ServiceTable initialization in UpnpRegisterRootDevice2 and UpnpRegisterRootDevice4
+
+	Initialize also HInfo->ServiceTable in UpnpRegisterRootDevice2 and
+	UpnpRegisterRootDevice4 functions
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3496703 - Handle_Info::ServiceList may have undefined value
+
+	Submitted: Yoichi NAKAYAMA ( yoichi ) - 2012-03-03 20:49:25 PST
+
+	In UpnpRegisterRootDevice(), HInfo->ServiceTable is not initialized and
+	getServiceTable() may leave it intact. It will cause crash on
+	freeServiceTable() called from UpnpUnRegisterRootDevice().
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3496702 - TvDeviceStop is called even if Start failed
+
+	Submitted: Yoichi NAKAYAMA ( yoichi ) - 2012-03-03 20:35:08 PST
+
+	In sample tvdevice, error of device_main() is not handled, and
+	TvDeviceStop() cause crash.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3496942 - Memory leak in config_description_doc
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 01:55:54 PST
+
+	element was not freed if membuffer_append_str(&url_str, "http://") does
+	not return 0. Moreover addNew was not used.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3496938 - Missing structures initialisation in some functions
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 01:31:16 PST
+
+	Memsetting to 0 some of the structures: finfo in process_request,
+	job in readFromSSDPSocket, request in http_OpenHttpGetEx, job in
+	genaNotifyThread, job in genaNotifyAllExt, job in genaNotifyAll,
+	job in genaInitNotifyExt, job in genaInitNotify, LocalAddr in
+	getlocalhostname.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3496934 - Memory leaks in getlocalhostname and UpnpGetIfInfo
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 01:25:42 PST
+
+	LocalSock is not closed if ioctl(LocalSock, SIOCGIFCONF, &ifConf);
+	returns an error.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3496933 - Out-of-bounds access in CheckOtherHTTPHeaders
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-05 01:15:34 PST
+
+	An out-of-bands access is raised because size of
+	RespInst->AcceptLanguageHeader is 200 and TmpBuf size is 180.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Remove unused currentDevice variable in removeServiceTable
+
+	currentDevice is not used in this function.
+
+2012-03-05 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3496581 - Memory leak in getServiceList
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-03-03 08:43:23 PST
+
+	serviceNodeList is not freed if
+	current->next = malloc(sizeof(service_info)); returns NULL.
+
+2012-02-29 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3495616 - Memory leak in ixmlElement_setAttributeNS
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-29 02:09:43 PST
+
+	newAttrNode is not freed if newAttr->n.nodeValue = strdup(value); returns
+	NULL or if ixmlElement_setAttributeNodeNS(element, newAttr, NULL) does
+	not return IXML_SUCCESS.
+
+2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3495286 - Double free in get_action_node
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:27:54 PST
+
+	ixmlFreeDOMString(ActNodeName); is called twice if
+	ixmlParseBufferEx(ActNodeName, RespNode); does not return IXML_SUCCESS.
+
+2012-02-28 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3495280 - Memory leak in ixmlDocument_createElementEx
+
+	Submitted: Fabrice Fontaine ( ffontaine ) - 2012-02-28 04:01:02 PST
+
+	There is a memory leak in ixmlDocument_createElementEx:
+	newElement->tagName is not freed if
+	newElement->n.nodeName = strdup(tagName); returns NULL.
+
+2012-02-27 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	SF Bug Tracker id 3494865 - Use of non-initialized variable in parser_parse_requestline
+
+	Submitted: Marcelo Roberto Jimenez ( mroberto ) - 2012-02-26 16:50:23 PST
+
+	src/genlib/net/http/httpparser.c: In function ‘parser_parse_requestline’:
+	src/genlib/net/http/httpparser.c:1319:28: warning: ‘index’ may be used uninitialized in this function
+
+2012-02-24 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker id 3489999 - UpnpString leaks in genaSubscribe()
+
+	Submitted: Yoichi NAKAYAMA ( yoichi ) - 2012-02-21 07:06:35 PST
+
+	In genaSubscribe() (defined in upnp/src/gena/gena_ctrlpt.c),
+	ActualSID and EventURL will not be freed if ScheduleGenaAutoRenew
+	returns UPNP_E_SUCCESS.
+
+	This fixes the an issue introduced by the previous fix.
+
+2012-02-23 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker id 3489990 - some files are missing in tarball
+
+	Submitted: Yoichi NAKAYAMA ( yoichi ) - 2012-02-21 06:52:57 PST
+
+	Released tarball (e.g. libupnp-1.6.15.tar.bz2) does not contain
+	some files under upnp/{inc,src} used by the project files for
+	windows (build/vc8/libupnp. vcproj and build/vc9/libupnp.vcproj).
+
+	This breaks build on Windows from tarball released after following changes
+	http://pupnp.git.sourceforge.net/git/gitweb.cgi?p=pupnp/pupnp;a=commitdiff;h=0eba550da039be01211b56fea0d02d03f0a12343
+	http://pupnp.git.sourceforge.net/git/gitweb.cgi?p=pupnp/pupnp;a=commitdiff;h=7a796b264ec7d5de5876fd6a2001c2d329709e02
+
+2012-02-23 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker id 3489999 - UpnpString leaks in genaSubscribe()
+
+	Submitted: Yoichi NAKAYAMA ( yoichi ) - 2012-02-21 07:06:35 PST
+
+	In genaSubscribe() (defined in upnp/src/gena/gena_ctrlpt.c),
+	ActualSID and EventURL will not be freed if ScheduleGenaAutoRenew
+	returns UPNP_E_SUCCESS.
+
+	This fixes the original issue.
+
+2012-02-23 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug Tracker: UpnpString leaks in genaSubscribe()
+
+	In genaSubscribe() (defined in upnp/src/gena/gena_ctrlpt.c),
+	ActualSID and EventURL will not be freed if ScheduleGenaAutoRenew
+	returns UPNP_E_SUCCESS.
+
+2012-02-23 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	Revert cb89781a55466703763c1b0ee67094eb401ddfe9 as suggested by
+	Fabrice Fontaine.
+
+2012-02-07 Edwin Stearns <edwin(at)vtilt.com>
+
+	Attached is a patch that resolved an issue I found with a server that
+	gave its device description URI without a trailing slash (e.g.
+	`http://127.0.0.1:5555`).
+
+2012-01-04 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Bug fix for IPv4-mapped IPv6 addresses.
+
+	Setting IPv6 sockets with IPV6_V6ONLY flag to avoid getting IP packets
+	with IPv4-mapped IPv6 addresses on IPv6 sockets.
+
+
+*******************************************************************************
+Version 1.6.15
+*******************************************************************************
+
+2012-01-11 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Bug fix on M-SEARCH for IPv6 CPs.
+
+	Small bug fix on IPv6 Control Point: now CP will also send M-SEARCH on
+	site-scope address (FF05::C) instead of only sending M-SEARCH on
+	link-scope (FF02::C).
+
+2012-01-11 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Retrieve IPv6 addresses in Upnp_Discovery.
+
+	Changing sockaddr_in into sockaddr_storage in Upnp_Discovery to be able
+	to retrieve IPv6 addresses of devices in Control Points using pupnp.
+
+2012-01-09 Marcelo Roberto Jimenez <mroberto(at)users.sourceforge.net>
+
+	SF Bug tracker, ID: 3469344
+	Submitted: dimmman ( dimmman ) - 2012-01-04 01:44:29 PST
+	Details: Looking at the code (v1.6.14, upnptools.c) for UpnpResolveURL
+	and UpnpResolveURL2 it shows that the ExitFunction: always returns
+	UPNP_E_SUCCESS.
+
+	I'm farily sure it's a simple mistake that should have been "return ret;"
+	in both cases.
+
+	Br,
+	Jonny
+
+*******************************************************************************
+Version 1.6.14
+*******************************************************************************
+
+2011-10-31 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	UPnP Low Power Support.
+
+	Adding two new functions (UpnpSendAdvertisementLowPower and
+	UpnpUnRegisterRootDeviceLowPower) which can be used to specify values
+	for the three SSDP headers defined by UPnP Low Power. Those headers are
+	Powerstate, SleepPeriod and RegistrationState.
+
+2011-10-24 Fabrice Fontaine <fabrice.fontaine(at)orange.com>
+
+	Bug fix in IN6_IS_ADDR_GLOBAL.
+
+	Changing IN6_IS_ADDR_GLOBAL to accept all IPv6 addresses which have a
+	2000::/3 prefix.
+
+2011-07-20 Marc Essayan <marc.essayan(at)orange-ftgroup.com>
+
+	Bug Fix on M-SEARCH.
+
+	Do not answer to M-SEARCH using HTTP version 1.0 as specified by the
+	UPnP Device Architecture.
+
+2011-03-18 Iain Denniston <iain.denniston(at)gmail.com>
+
+	Fixes for compilation under Windows (specifically MSVC). Also added
+	MSVC supported "_inline", and fixed some WIN32 specific warnings.
+
+2011-03-08 Iain Denniston <iain.denniston(at)gmail.com>
+
+	Several fixes to correctly use SOCKET (and related) types instead of
+	non-portable variations.
+
 *******************************************************************************
 Version 1.6.13
 *******************************************************************************

Doxyfile

@@ -31,7 +31,7 @@ PROJECT_NAME           = libUPnP
 # This could be handy for archiving the generated documentation or 
 # if some version control system is used.
 
-PROJECT_NUMBER         = 1.6.13
+PROJECT_NUMBER         = 1.6.16
 
 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) 
 # base path where the generated documentation will be put. 

THANKS

@@ -14,7 +14,7 @@ exempt of errors.
 - Bob Ciora
 - Carlo Parata
 - Carl Benson
-- Chandra (inactiveneurons)
+- Chandra Penke (inactiveneurons)
 - Chaos
 - Charles Nepveu (cnepveu)
 - Chris Pickel
@@ -27,7 +27,7 @@ exempt of errors.
 - Eric Tanguy
 - Erwan Velu
 - Eugene Christensen
-- Fabrice Fontaine
+- Fabrice Fontaine (ffontaine)
 - Fredrik Svensson
 - Glen Masgai
 - Hartmut Holzgraefe (hholzgra)
@@ -63,4 +63,6 @@ exempt of errors.
 - Timothy Redaelli
 - Titus Winters
 - Tom (tomdev2)
+- Yoichi Nakayama (yoichi)
+- zephyrus (zephyrus00jp)
 

build/inc/autoconfig.h

@@ -105,13 +105,16 @@
 #define PACKAGE_NAME "libupnp"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "libupnp 1.6.13"
+#define PACKAGE_STRING "libupnp 1.6.16"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "libupnp"
 
+/* Define to the home page for this package. */
+#define PACKAGE_URL ""
+
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.6.13"
+#define PACKAGE_VERSION "1.6.16"
 
 /* Define to necessary symbol if this constant uses a non-standard name on
    your system. */
@@ -138,6 +141,18 @@
 /* see upnpconfig.h */
 #define UPNP_HAVE_DEVICE 1
 
+/* see upnpconfig.h */
+#define UPNP_HAVE_GENA 1
+
+/* see upnpconfig.h */
+#define UPNP_HAVE_OPTSSDP 1
+
+/* see upnpconfig.h */
+#define UPNP_HAVE_SOAP 1
+
+/* see upnpconfig.h */
+#define UPNP_HAVE_SSDP 1
+
 /* see upnpconfig.h */
 #define UPNP_HAVE_TOOLS 1
 
@@ -154,13 +169,13 @@
 #define UPNP_VERSION_MINOR 6
 
 /* see upnpconfig.h */
-#define UPNP_VERSION_PATCH 13
+#define UPNP_VERSION_PATCH 16
 
 /* see upnpconfig.h */
-#define UPNP_VERSION_STRING "1.6.13"
+#define UPNP_VERSION_STRING "1.6.16"
 
 /* Version number of package */
-#define VERSION "1.6.13"
+#define VERSION "1.6.16"
 
 /* File Offset size */
 #define _FILE_OFFSET_BITS 64

build/inc/upnpconfig.h

@@ -40,7 +40,7 @@
  ***************************************************************************/ 
 
 /** The library version (string) e.g. "1.3.0" */
-#define UPNP_VERSION_STRING "1.6.13"
+#define UPNP_VERSION_STRING "1.6.16"
 
 /** Major version of the library */
 #define UPNP_VERSION_MAJOR 1
@@ -49,7 +49,7 @@
 #define UPNP_VERSION_MINOR 6
 
 /** Patch version of the library */
-#define UPNP_VERSION_PATCH 13
+#define UPNP_VERSION_PATCH 16
 
 /** The library version (numeric) e.g. 10300 means version 1.3.0 */
 #define UPNP_VERSION	\
@@ -100,6 +100,26 @@
 #define UPNP_HAVE_WEBSERVER 1
 
 
+/** Defined to 1 if the library has been compiled with the SSDP part enabled
+ *  (i.e. configure --enable-ssdp) */
+#define UPNP_HAVE_SSDP 1
+
+
+/** Defined to 1 if the library has been compiled with optional SSDP headers
+ *  support (i.e. configure --enable-optssdp) */
+#define UPNP_HAVE_OPTSSDP 1
+
+
+/** Defined to 1 if the library has been compiled with the SOAP part enabled
+ *  (i.e. configure --enable-soap) */
+#define UPNP_HAVE_SOAP 1
+
+
+/** Defined to 1 if the library has been compiled with the GENA part enabled
+ *  (i.e. configure --enable-gena) */
+#define UPNP_HAVE_GENA 1
+
+
 /** Defined to 1 if the library has been compiled with helper API
  *  (i.e. configure --enable-tools) : <upnp/upnptools.h> file is available */
 #define UPNP_HAVE_TOOLS 1

build/vc8/ixml.vcproj

@@ -103,8 +103,8 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="..\..\ixml\inc;..\..\ixml\src\inc;..\inc"
+				AdditionalIncludeDirectories="..\..\ixml\inc;..\..\ixml\src\inc;..\inc;..\..\upnp\inc"
-				PreprocessorDefinitions="WIN32;IXML_INLINE="
+				PreprocessorDefinitions="WIN32;DEBUG;IXML_INLINE="
 				RuntimeLibrary="0"
 				WarningLevel="3"
 				Detect64BitPortabilityProblems="true"

build/vc8/libupnp.vcproj

@@ -50,7 +50,7 @@
 				Optimization="2"
 				InlineFunctionExpansion="1"
 				AdditionalIncludeDirectories="..\..\pthreads\include;..\..\ixml\src\inc;..\..\ixml\inc;..\..\threadutil\inc;..\..\upnp\inc;..\..\upnp\src\inc;..\inc;..\msvc"
-				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;LIBUPNP_EXPORTS;PTW32_STATIC_LIB;UPNP_STATIC_LIB;UPNP_USE_MSVCPP;_CRT_SECURE_NO_WARNINGS"
+				PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;LIBUPNP_EXPORTS;PTW32_STATIC_LIB;UPNP_USE_MSVCPP;_CRT_SECURE_NO_WARNINGS"
 				StringPooling="true"
 				RuntimeLibrary="0"
 				EnableFunctionLevelLinking="true"
@@ -80,8 +80,8 @@
 				OutputFile="$(OutDir)\libupnp.dll"
 				LinkIncremental="1"
 				SuppressStartupBanner="true"
-				ProgramDatabaseFile=".\Release/libupnp.pdb"
+				ProgramDatabaseFile="$(OutDir)\libupnp.pdb"
-				ImportLibrary=".\Release/libupnp.lib"
+				ImportLibrary="$(OutDir)\libupnp.lib"
 				TargetMachine="1"
 			/>
 			<Tool
@@ -96,7 +96,7 @@
 			<Tool
 				Name="VCBscMakeTool"
 				SuppressStartupBanner="true"
-				OutputFile=".\Release/libupnp.bsc"
+				OutputFile="$(OutDir)\libupnp.bsc"
 			/>
 			<Tool
 				Name="VCFxCopTool"
@@ -218,14 +218,6 @@
 			Name="sources"
 			Filter="cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 			>
-			<File
-				RelativePath="..\..\upnp\src\api\ActionComplete.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\ActionRequest.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\ixml\src\attr.c"
 				>
@@ -234,10 +226,6 @@
 				RelativePath="..\..\upnp\src\genlib\client_table\client_table.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\Discovery.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\ixml\src\document.c"
 				>
@@ -246,18 +234,6 @@
 				RelativePath="..\..\ixml\src\element.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\Event.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\EventSubscribe.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\FileInfo.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\threadutil\src\FreeList.c"
 				>
@@ -358,10 +334,6 @@
 				RelativePath="..\..\upnp\src\ssdp\ssdp_device.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\ssdp\ssdp_ResultData.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\ssdp\ssdp_server.c"
 				>
@@ -370,22 +342,10 @@
 				RelativePath="..\..\upnp\src\genlib\net\http\statcodes.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\StateVarComplete.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\StateVarRequest.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\genlib\util\strintmap.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\SubscriptionRequest.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\uuid\sysdep.c"
 				>
@@ -447,14 +407,6 @@
 			Name="headers"
 			Filter="h;hpp;hxx;hm;inl"
 			>
-			<File
-				RelativePath="..\..\upnp\inc\ActionComplete.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\actionrequest.h"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\inc\client_table.h"
 				>
@@ -463,22 +415,6 @@
 				RelativePath="..\..\upnp\src\inc\config.h"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\inc\discovery.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\Event.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\EventSubscribe.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\FileInfo.h"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\inc\gena.h"
 				>
@@ -563,14 +499,6 @@
 				RelativePath="..\..\upnp\src\inc\statcodes.h"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\inc\StateVarComplete.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\statevarrequest.h"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\inc\statuscodes.h"
 				>
@@ -579,10 +507,6 @@
 				RelativePath="..\..\upnp\src\inc\strintmap.h"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\inc\SubscriptionRequest.h"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\inc\sysdep.h"
 				>

build/vc8/threadutil.vcproj

@@ -40,7 +40,7 @@
 				Name="VCCLCompilerTool"
 				Optimization="0"
 				AdditionalIncludeDirectories="..\..\threadutil\inc;..\..\upnp\inc;..\..\ixml\inc;..\..\pthreads\include"
-				PreprocessorDefinitions="WIN32;DEBUG"
+				PreprocessorDefinitions="WIN32;DEBUG;UPNP_USE_MSVCPP"
 				MinimalRebuild="true"
 				BasicRuntimeChecks="3"
 				RuntimeLibrary="3"
@@ -80,9 +80,9 @@
 		</Configuration>
 		<Configuration
 			Name="Release|Win32"
-			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			OutputDirectory=".\out.vc8.$(ConfigurationName)\$(ProjectName)"
-			IntermediateDirectory="$(ConfigurationName)"
+			IntermediateDirectory=".\out.vc8.$(ConfigurationName)\$(ProjectName)"
-			ConfigurationType="1"
+			ConfigurationType="4"
 			CharacterSet="2"
 			WholeProgramOptimization="1"
 			>
@@ -103,6 +103,8 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
+				AdditionalIncludeDirectories="..\..\threadutil\inc;..\..\upnp\inc;..\..\ixml\inc;..\..\pthreads\include"
+				PreprocessorDefinitions="WIN32;UPNP_USE_MSVCPP"
 				RuntimeLibrary="2"
 				WarningLevel="3"
 				Detect64BitPortabilityProblems="true"
@@ -118,18 +120,11 @@
 				Name="VCPreLinkEventTool"
 			/>
 			<Tool
-				Name="VCLinkerTool"
+				Name="VCLibrarianTool"
-				GenerateDebugInformation="true"
-				OptimizeReferences="2"
-				EnableCOMDATFolding="2"
-				TargetMachine="1"
 			/>
 			<Tool
 				Name="VCALinkTool"
 			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
 			<Tool
 				Name="VCXDCMakeTool"
 			/>
@@ -139,12 +134,6 @@
 			<Tool
 				Name="VCFxCopTool"
 			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
 			<Tool
 				Name="VCPostBuildEventTool"
 			/>

build/vc8/tvcombo.vcproj

@@ -40,7 +40,7 @@
 				Name="VCCLCompilerTool"
 				Optimization="0"
 				AdditionalIncludeDirectories="..\..\upnp\inc;..\..\ixml\inc;..\..\upnp\sample\common;..\inc;..\..\threadutil\inc;..\..\pthreads\include;..\..\upnp\sample\tvcombo;..\..\upnp\sample\tvcombo\linux"
-				PreprocessorDefinitions="WIN32;DEBUG"
+				PreprocessorDefinitions="WIN32;DEBUG;UPNP_USE_MSVCPP"
 				MinimalRebuild="true"
 				BasicRuntimeChecks="3"
 				RuntimeLibrary="3"
@@ -91,8 +91,8 @@
 		</Configuration>
 		<Configuration
 			Name="Release|Win32"
-			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			OutputDirectory=".\out.vc8.$(ConfigurationName)\$(ProjectName)"
-			IntermediateDirectory="$(ConfigurationName)"
+			IntermediateDirectory=".\out.vc8.$(ConfigurationName)\$(ProjectName)"
 			ConfigurationType="1"
 			CharacterSet="2"
 			WholeProgramOptimization="1"
@@ -114,6 +114,8 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
+				AdditionalIncludeDirectories="..\..\upnp\inc;..\..\ixml\inc;..\..\upnp\sample\common;..\inc;..\..\threadutil\inc;..\..\pthreads\include;..\..\upnp\sample\tvcombo;..\..\upnp\sample\tvcombo\linux"
+				PreprocessorDefinitions="WIN32;UPNP_USE_MSVCPP"
 				RuntimeLibrary="2"
 				WarningLevel="3"
 				Detect64BitPortabilityProblems="true"
@@ -130,6 +132,8 @@
 			/>
 			<Tool
 				Name="VCLinkerTool"
+				AdditionalDependencies="..\..\pthreads\lib\pthreadVC2.lib ixml.lib threadutil.lib libupnp.lib"
+				AdditionalLibraryDirectories="&quot;$(OutDir)&quot;;&quot;out.vc8.$(ConfigurationName)\ixml&quot;;&quot;out.vc8.$(ConfigurationName)\threadutil&quot;;&quot;out.vc8.$(ConfigurationName)\libupnp&quot;"
 				GenerateDebugInformation="true"
 				OptimizeReferences="2"
 				EnableCOMDATFolding="2"
@@ -174,15 +178,15 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\upnp\sample\tvcombo\linux\upnp_tv_combo_main.c"
+				RelativePath="..\..\upnp\sample\linux\tv_combo_main.c"
 				>
 			</File>
 			<File
-				RelativePath="..\..\upnp\sample\tvcombo\upnp_tv_ctrlpt.c"
+				RelativePath="..\..\upnp\sample\common\tv_ctrlpt.c"
 				>
 			</File>
 			<File
-				RelativePath="..\..\upnp\sample\tvcombo\upnp_tv_device.c"
+				RelativePath="..\..\upnp\sample\common\tv_device.c"
 				>
 			</File>
 		</Filter>

build/vc8/tvctrlpt.vcproj

@@ -40,7 +40,7 @@
 				Name="VCCLCompilerTool"
 				Optimization="0"
 				AdditionalIncludeDirectories="..\..\upnp\inc;..\..\ixml\inc;..\..\upnp\sample\common;..\inc;..\..\threadutil\inc;..\..\pthreads\include;..\..\upnp\sample\tvctrlpt;..\..\upnp\sample\tvctrlpt\linux"
-				PreprocessorDefinitions="WIN32;DEBUG"
+				PreprocessorDefinitions="WIN32;DEBUG;UPNP_USE_MSVCPP"
 				MinimalRebuild="true"
 				BasicRuntimeChecks="3"
 				RuntimeLibrary="3"
@@ -91,8 +91,8 @@
 		</Configuration>
 		<Configuration
 			Name="Release|Win32"
-			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			OutputDirectory=".\out.vc8.$(ConfigurationName)\$(ProjectName)"
-			IntermediateDirectory="$(ConfigurationName)"
+			IntermediateDirectory=".\out.vc8.$(ConfigurationName)\$(ProjectName)"
 			ConfigurationType="1"
 			CharacterSet="2"
 			WholeProgramOptimization="1"
@@ -114,6 +114,8 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
+				AdditionalIncludeDirectories="..\..\upnp\inc;..\..\ixml\inc;..\..\upnp\sample\common;..\inc;..\..\threadutil\inc;..\..\pthreads\include;..\..\upnp\sample\tvctrlpt;..\..\upnp\sample\tvctrlpt\linux"
+				PreprocessorDefinitions="WIN32;UPNP_USE_MSVCPP"
 				RuntimeLibrary="2"
 				WarningLevel="3"
 				Detect64BitPortabilityProblems="true"
@@ -130,6 +132,8 @@
 			/>
 			<Tool
 				Name="VCLinkerTool"
+				AdditionalDependencies="..\..\pthreads\lib\pthreadVC2.lib ixml.lib threadutil.lib  libupnp.lib"
+				AdditionalLibraryDirectories="&quot;$(OutDir)&quot;;&quot;out.vc8.$(ConfigurationName)\ixml&quot;;&quot;out.vc8.$(ConfigurationName)\threadutil&quot;;&quot;out.vc8.$(ConfigurationName)\libupnp&quot;"
 				GenerateDebugInformation="true"
 				OptimizeReferences="2"
 				EnableCOMDATFolding="2"
@@ -174,11 +178,11 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\upnp\sample\tvctrlpt\upnp_tv_ctrlpt.c"
+				RelativePath="..\..\upnp\sample\common\tv_ctrlpt.c"
 				>
 			</File>
 			<File
-				RelativePath="..\..\upnp\sample\tvctrlpt\linux\upnp_tv_ctrlpt_main.c"
+				RelativePath="..\..\upnp\sample\linux\tv_ctrlpt_main.c"
 				>
 			</File>
 		</Filter>

build/vc8/tvdevice.vcproj

@@ -40,7 +40,7 @@
 				Name="VCCLCompilerTool"
 				Optimization="0"
 				AdditionalIncludeDirectories="..\..\upnp\inc;..\..\ixml\inc;..\..\upnp\sample\common;..\inc;..\..\threadutil\inc;..\..\pthreads\include;..\..\upnp\sample\tvdevice;..\..\upnp\sample\tvdevice\linux"
-				PreprocessorDefinitions="WIN32;DEBUG"
+				PreprocessorDefinitions="WIN32;DEBUG;UPNP_USE_MSVCPP"
 				MinimalRebuild="true"
 				BasicRuntimeChecks="3"
 				RuntimeLibrary="3"
@@ -91,8 +91,8 @@
 		</Configuration>
 		<Configuration
 			Name="Release|Win32"
-			OutputDirectory="$(SolutionDir)$(ConfigurationName)"
+			OutputDirectory=".\out.vc8.$(ConfigurationName)\$(ProjectName)"
-			IntermediateDirectory="$(ConfigurationName)"
+			IntermediateDirectory=".\out.vc8.$(ConfigurationName)\$(ProjectName)"
 			ConfigurationType="1"
 			CharacterSet="2"
 			WholeProgramOptimization="1"
@@ -114,6 +114,8 @@
 			/>
 			<Tool
 				Name="VCCLCompilerTool"
+				AdditionalIncludeDirectories="..\..\upnp\inc;..\..\ixml\inc;..\..\upnp\sample\common;..\inc;..\..\threadutil\inc;..\..\pthreads\include;..\..\upnp\sample\tvdevice;..\..\upnp\sample\tvdevice\linux"
+				PreprocessorDefinitions="WIN32;UPNP_USE_MSVCPP"
 				RuntimeLibrary="2"
 				WarningLevel="3"
 				Detect64BitPortabilityProblems="true"
@@ -130,6 +132,8 @@
 			/>
 			<Tool
 				Name="VCLinkerTool"
+				AdditionalDependencies="..\..\pthreads\lib\pthreadVC2.lib ixml.lib threadutil.lib libupnp.lib"
+				AdditionalLibraryDirectories="&quot;$(OutDir)&quot;;&quot;out.vc8.$(ConfigurationName)\ixml&quot;;&quot;out.vc8.$(ConfigurationName)\threadutil&quot;;&quot;out.vc8.$(ConfigurationName)\libupnp&quot;"
 				GenerateDebugInformation="true"
 				OptimizeReferences="2"
 				EnableCOMDATFolding="2"
@@ -174,11 +178,11 @@
 				>
 			</File>
 			<File
-				RelativePath="..\..\upnp\sample\tvdevice\upnp_tv_device.c"
+				RelativePath="..\..\upnp\sample\common\tv_device.c"
 				>
 			</File>
 			<File
-				RelativePath="..\..\upnp\sample\tvdevice\linux\upnp_tv_device_main.c"
+				RelativePath="..\..\upnp\sample\linux\tv_device_main.c"
 				>
 			</File>
 		</Filter>

build/vc9/libupnp.vcproj

@@ -764,14 +764,6 @@
 			Name="sources"
 			Filter="cpp;c;cxx;rc;def;r;odl;idl;hpj;bat"
 			>
-			<File
-				RelativePath="..\..\upnp\src\api\ActionComplete.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\ActionRequest.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\ixml\src\attr.c"
 				>
@@ -780,14 +772,6 @@
 				RelativePath="..\..\upnp\src\genlib\client_table\client_table.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\genlib\client_table\ClientSubscription.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\Discovery.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\ixml\src\document.c"
 				>
@@ -796,18 +780,6 @@
 				RelativePath="..\..\ixml\src\element.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\Event.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\EventSubscribe.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\FileInfo.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\threadutil\src\FreeList.c"
 				>
@@ -904,10 +876,6 @@
 				RelativePath="..\..\upnp\src\ssdp\ssdp_device.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\ssdp\ssdp_ResultData.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\ssdp\ssdp_server.c"
 				>
@@ -916,22 +884,10 @@
 				RelativePath="..\..\upnp\src\genlib\net\http\statcodes.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\StateVarComplete.c"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\StateVarRequest.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\genlib\util\strintmap.c"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\src\api\SubscriptionRequest.c"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\uuid\sysdep.c"
 				>
@@ -993,14 +949,6 @@
 			Name="headers"
 			Filter="h;hpp;hxx;hm;inl"
 			>
-			<File
-				RelativePath="..\..\upnp\inc\ActionComplete.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\ActionRequest.h"
-				>
-			</File>
 			<File
 				RelativePath="..\inc\autoconfig.h"
 				>
@@ -1017,22 +965,6 @@
 				RelativePath="..\..\upnp\src\inc\config.h"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\inc\Discovery.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\Event.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\EventSubscribe.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\FileInfo.h"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\inc\gena.h"
 				>
@@ -1113,14 +1045,6 @@
 				RelativePath="..\..\upnp\src\inc\statcodes.h"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\inc\StateVarComplete.h"
-				>
-			</File>
-			<File
-				RelativePath="..\..\upnp\inc\StateVarRequest.h"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\inc\statuscodes.h"
 				>
@@ -1133,10 +1057,6 @@
 				RelativePath="..\..\upnp\src\inc\strintmap.h"
 				>
 			</File>
-			<File
-				RelativePath="..\..\upnp\inc\SubscriptionRequest.h"
-				>
-			</File>
 			<File
 				RelativePath="..\..\upnp\src\inc\sysdep.h"
 				>

configure.ac

@@ -9,7 +9,7 @@
 
 AC_PREREQ(2.60)
 
-AC_INIT([libupnp], [1.6.13], [mroberto@users.sourceforge.net])
+AC_INIT([libupnp], [1.6.16], [mroberto@users.sourceforge.net])
 dnl ############################################################################
 dnl # *Independently* of the above libupnp package version, the libtool version
 dnl # of the 3 libraries need to be updated whenever there is a change released:
@@ -255,9 +255,54 @@ dnl #AC_SUBST([LT_VERSION_THREADUTIL], [6:0:0])
 dnl #AC_SUBST([LT_VERSION_UPNP],       [7:0:1])
 dnl #
 dnl ############################################################################
-AC_SUBST([LT_VERSION_IXML],       [2:6:0])
+dnl # Release 1.6.14:
-AC_SUBST([LT_VERSION_THREADUTIL], [6:0:0])
+dnl # "current:revision:age"
-AC_SUBST([LT_VERSION_UPNP],       [7:0:1])
+dnl #
+dnl # - Code has changed in upnp
+dnl #	revision: 0 -> 1
+dnl # - interface added in upnp
+dnl #   current: 7 -> 8
+dnl #   revision: 1 - > 0
+dnl #   age: 1 -> 2
+dnl #
+dnl #AC_SUBST([LT_VERSION_IXML],       [2:6:0])
+dnl #AC_SUBST([LT_VERSION_THREADUTIL], [6:0:0])
+dnl #AC_SUBST([LT_VERSION_UPNP],       [8:0:2])
+dnl #
+dnl ############################################################################
+dnl # Release 1.6.15:
+dnl # "current:revision:age"
+dnl #
+dnl # - Code has changed in upnp
+dnl #	revision: 0 -> 1
+dnl #
+dnl #AC_SUBST([LT_VERSION_IXML],       [2:6:0])
+dnl #AC_SUBST([LT_VERSION_THREADUTIL], [6:0:0])
+dnl #AC_SUBST([LT_VERSION_UPNP],       [8:1:2])
+dnl #
+dnl ############################################################################
+dnl # Release 1.6.16:
+dnl # "current:revision:age"
+dnl #
+dnl # - Code has changed in ixml
+dnl #	revision: 6 -> 7
+dnl # - Code has changed in threadutil
+dnl #   revision: 0 -> 1
+dnl # - Code has changed in upnp
+dnl #	revision: 1 -> 2
+dnl # - interface changed/added/removed in upnp
+dnl #   current++(9); revision = 0
+dnl # - interface added in upnp
+dnl #   age++(3)
+dnl #
+dnl #AC_SUBST([LT_VERSION_IXML],       [2:7:0])
+dnl #AC_SUBST([LT_VERSION_THREADUTIL], [6:1:0])
+dnl #AC_SUBST([LT_VERSION_UPNP],       [9:0:3])
+dnl #
+dnl ############################################################################
+AC_SUBST([LT_VERSION_IXML],       [2:7:0])
+AC_SUBST([LT_VERSION_THREADUTIL], [6:1:0])
+AC_SUBST([LT_VERSION_UPNP],       [9:0:3])
 dnl ############################################################################
 dnl # Repeating the algorithm to place it closer to the modificatin place:
 dnl # 	- library code modified:		revision++
@@ -345,6 +390,29 @@ if test "x$enable_webserver" = xyes ; then
 	AC_DEFINE(UPNP_HAVE_WEBSERVER, 1, [see upnpconfig.h])
 fi
 
+RT_BOOL_ARG_ENABLE([ssdp], [yes], [SSDP part])
+if test "x$enable_ssdp" = xyes ; then
+        AC_DEFINE(UPNP_HAVE_SSDP, 1, [see upnpconfig.h])
+fi
+
+RT_BOOL_ARG_ENABLE([optssdp], [yes], [optionnal SSDP headers support)])
+if test "x$enable_optssdp" = xyes ; then
+        AC_DEFINE(UPNP_HAVE_OPTSSDP, 1, [see upnpconfig.h])
+	enable_uuid=yes
+fi
+
+RT_BOOL_ARG_ENABLE([soap], [yes], [SOAP part])
+if test "x$enable_soap" = xyes ; then
+        AC_DEFINE(UPNP_HAVE_SOAP, 1, [see upnpconfig.h])
+fi
+
+RT_BOOL_ARG_ENABLE([gena], [yes], [GENA part])
+if test "x$enable_gena" = xyes ; then
+        AC_DEFINE(UPNP_HAVE_GENA, 1, [see upnpconfig.h])
+	enable_uuid=yes
+fi
+
+AM_CONDITIONAL(ENABLE_UUID, test x"$enable_uuid" = xyes)
 
 RT_BOOL_ARG_ENABLE([tools], [yes], [helper APIs in upnptools.h])
 if test "x$enable_tools" = xyes ; then

ixml/inc/ixml.h

@@ -738,7 +738,7 @@ EXPORT_SPEC int ixmlDocument_createDocumentEx(
  * \return A pointer to the new \b Document object with the nodeName set to
  *  	"#document" or \c NULL on failure.
  */
-EXPORT_SPEC IXML_Document *ixmlDocument_createDocument();
+EXPORT_SPEC IXML_Document *ixmlDocument_createDocument(void);
 
 
 /*!

ixml/src/attr.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 

ixml/src/document.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -143,6 +144,7 @@ int ixmlDocument_createElementEx(
 	newElement->n.nodeType = eELEMENT_NODE;
 	newElement->n.nodeName = strdup(tagName);
 	if (newElement->n.nodeName == NULL) {
+		free(newElement->tagName);
 		ixmlElement_free(newElement);
 		newElement = NULL;
 		errCode = IXML_INSUFFICIENT_MEMORY;
@@ -163,8 +165,14 @@ IXML_Element *ixmlDocument_createElement(
 	const DOMString tagName)
 {
 	IXML_Element *newElement = NULL;
+	int ret = IXML_SUCCESS;
 
-	ixmlDocument_createElementEx(doc, tagName, &newElement);
+	ret = ixmlDocument_createElementEx(doc, tagName, &newElement);
+	if (ret != IXML_SUCCESS) {
+                IxmlPrintf(__FILE__, __LINE__, "ixmlDocument_createElement",
+			"Error %d\n", ret);
+		return NULL;
+        }
 	return newElement;
 }
 
@@ -183,7 +191,7 @@ int ixmlDocument_createDocumentEx(IXML_Document **rtDoc)
 
 	ixmlDocument_init(doc);
 
-	doc->n.nodeName = strdup(DOCUMENTNODENAME);
+	doc->n.nodeName = strdup((const char*)DOCUMENTNODENAME);
 	if (doc->n.nodeName == NULL) {
 		ixmlDocument_free(doc);
 		doc = NULL;
@@ -232,7 +240,7 @@ int ixmlDocument_createTextNodeEx(
 	/* initialize the node */
 	ixmlNode_init(returnNode);
 
-	returnNode->nodeName = strdup(TEXTNODENAME);
+	returnNode->nodeName = strdup((const char*)TEXTNODENAME);
 	if (returnNode->nodeName == NULL) {
 		ixmlNode_free(returnNode);
 		returnNode = NULL;
@@ -318,7 +326,8 @@ IXML_Attr *ixmlDocument_createAttribute(
 {
 	IXML_Attr *attrNode = NULL;
 
-	ixmlDocument_createAttributeEx(doc, name, &attrNode);
+	if(ixmlDocument_createAttributeEx(doc, name, &attrNode) != IXML_SUCCESS)
+		return NULL;
 
 	return attrNode;
 }
@@ -401,7 +410,7 @@ int ixmlDocument_createCDATASectionEx(
 
 	ixmlCDATASection_init(cDSectionNode);
 	cDSectionNode->n.nodeType = eCDATA_SECTION_NODE;
-	cDSectionNode->n.nodeName = strdup(CDATANODENAME);
+	cDSectionNode->n.nodeName = strdup((const char*)CDATANODENAME);
 	if (cDSectionNode->n.nodeName == NULL) {
 		ixmlCDATASection_free(cDSectionNode);
 		cDSectionNode = NULL;

ixml/src/element.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -232,55 +233,42 @@ int ixmlElement_setAttributeNode(
 	IXML_Node *preSib = NULL;
 	IXML_Node *nextSib = NULL;
 
-	if (element == NULL || newAttr == NULL) {
+	if (!element || !newAttr)
 		return IXML_INVALID_PARAMETER;
-	}
+	if (newAttr->n.ownerDocument != element->n.ownerDocument)
-
-	if (newAttr->n.ownerDocument != element->n.ownerDocument) {
 		return IXML_WRONG_DOCUMENT_ERR;
-	}
+	if (newAttr->ownerElement)
-
-	if (newAttr->ownerElement != NULL) {
 		return IXML_INUSE_ATTRIBUTE_ERR;
-	}
-
 	newAttr->ownerElement = element;
 	node = (IXML_Node *)newAttr;
-
 	attrNode = element->n.firstAttr;
-	while (attrNode != NULL) {
+	while (attrNode) {
-		if (strcmp(attrNode->nodeName, node->nodeName) == 0) {
+		if (!strcmp(attrNode->nodeName, node->nodeName))
 			/* Found it */
 			break;
-		} else {
+		else
 			attrNode = attrNode->nextSibling;
-		}
 	}
-
+	if (attrNode) {
-	if (attrNode != NULL) {
 		/* Already present, will replace by newAttr */
 		preSib = attrNode->prevSibling;
 		nextSib = attrNode->nextSibling;
-		if (preSib != NULL) {
+		if (preSib)
 			preSib->nextSibling = node;
-		}
+		if (nextSib)
-		if (nextSib != NULL) {
 			nextSib->prevSibling = node;
-		}
+		if (element->n.firstAttr == attrNode)
-		if (element->n.firstAttr == attrNode) {
 			element->n.firstAttr = node;
-		}
+		if (rtAttr)
-		if (rtAttr != NULL) {
 			*rtAttr = (IXML_Attr *)attrNode;
-		} else {
+		else
 			ixmlAttr_free((IXML_Attr *)attrNode);
-		}
 	} else {
 		/* Add this attribute */
-		if (element->n.firstAttr != NULL) {
+		if (element->n.firstAttr) {
 			prevAttr = element->n.firstAttr;
 			nextAttr = prevAttr->nextSibling;
-			while (nextAttr != NULL) {
+			while (nextAttr) {
 				prevAttr = nextAttr;
 				nextAttr = prevAttr->nextSibling;
 			}
@@ -292,10 +280,8 @@ int ixmlElement_setAttributeNode(
 			node->prevSibling = NULL;
 			node->nextSibling = NULL;
 		}
-
+		if (rtAttr)
-		if (rtAttr != NULL) {
 			*rtAttr = NULL;
-		}
 	}
 
 	return IXML_SUCCESS;
@@ -445,7 +431,7 @@ int ixmlElement_setAttributeNS(
 
 	/* see DOM 2 spec page 59 */
 	if ((newAttrNode.prefix != NULL && namespaceURI == NULL) ||
-	    (strcmp(newAttrNode.prefix, "xml") == 0 &&
+	    (newAttrNode.prefix != NULL && strcmp(newAttrNode.prefix, "xml") == 0 &&
 	     strcmp(namespaceURI, "http://www.w3.org/XML/1998/namespace") != 0) ||
 	    (strcmp(qualifiedName, "xmlns") == 0 &&
 	     strcmp(namespaceURI, "http://www.w3.org/2000/xmlns/") != 0)) {
@@ -492,15 +478,18 @@ int ixmlElement_setAttributeNS(
 			qualifiedName,
 			&newAttr);
 		if (rc != IXML_SUCCESS) {
+			Parser_freeNodeContent(&newAttrNode);
 			return rc;
 		}
 		newAttr->n.nodeValue = strdup(value);
 		if (newAttr->n.nodeValue == NULL) {
 			ixmlAttr_free(newAttr);
+			Parser_freeNodeContent(&newAttrNode);
 			return IXML_INSUFFICIENT_MEMORY;
 		}
-		if (ixmlElement_setAttributeNodeNS(element, newAttr, NULL) != IXML_SUCCESS) {
+		if (ixmlElement_setAttributeNodeNS(element, newAttr, &newAttr) != IXML_SUCCESS) {
 			ixmlAttr_free(newAttr);
+			Parser_freeNodeContent(&newAttrNode);
 			return IXML_FAILED;
 		}
 	}

ixml/src/inc/ixmlmembuf.h

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -49,7 +50,7 @@
 #define MAXVAL(a, b) ( (a) > (b) ? (a) : (b) )
 
 
-#define MEMBUF_DEF_SIZE_INC 20
+#define MEMBUF_DEF_SIZE_INC 20u
 
 
 /*!

ixml/src/ixml.c

@@ -60,7 +60,7 @@ static void copy_with_escape(
 	if (p == NULL)
 		return;
 	plen = strlen(p);
-	for (i = 0; i < plen; ++i) {
+	for (i = (size_t)0; i < plen; ++i) {
 		switch (p[i]) {
 		case '<':
 			ixml_membuf_append_str(buf, "&lt;");
@@ -175,7 +175,7 @@ static void ixmlPrintDomTreeRecursive(
 		default:
 			IxmlPrintf(__FILE__, __LINE__, "ixmlPrintDomTreeRecursive",
 				"Warning, unknown node type %d\n",
-				ixmlNode_getNodeType(nodeptr));
+				(int)ixmlNode_getNodeType(nodeptr));
 			break;
 		}
 	}
@@ -247,7 +247,7 @@ static void ixmlPrintDomTree(
 	default:
 		IxmlPrintf(__FILE__, __LINE__, "ixmlPrintDomTree",
 			"Warning, unknown node type %d\n",
-			ixmlNode_getNodeType(nodeptr));
+			(int)ixmlNode_getNodeType(nodeptr));
 		break;
 	}
 }
@@ -318,7 +318,7 @@ static void ixmlDomTreetoString(
 	default:
 		IxmlPrintf(__FILE__, __LINE__, "ixmlPrintDomTreeRecursive",
 			"Warning, unknown node type %d\n",
-			ixmlNode_getNodeType(nodeptr));
+			(int)ixmlNode_getNodeType(nodeptr));
 		break;
 	}
 }

ixml/src/ixmlmembuf.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -87,11 +88,11 @@ static int ixml_membuf_set_size(
 
 	assert(alloc_len >= new_length);
 
-	temp_buf = realloc(m->buf, alloc_len + 1);
+	temp_buf = realloc(m->buf, alloc_len + (size_t)1);
 	if (temp_buf == NULL) {
 		/* try smaller size */
 		alloc_len = new_length;
-		temp_buf = realloc(m->buf, alloc_len + 1);
+		temp_buf = realloc(m->buf, alloc_len + (size_t)1);
 		if (temp_buf == NULL) {
 			return IXML_INSUFFICIENT_MEMORY;
 		}
@@ -110,8 +111,8 @@ void ixml_membuf_init(ixml_membuf *m)
 
 	m->size_inc = MEMBUF_DEF_SIZE_INC;
 	m->buf = NULL;
-	m->length = 0;
+	m->length = (size_t)0;
-	m->capacity = 0;
+	m->capacity = (size_t)0;
 }
 
 
@@ -171,7 +172,7 @@ int ixml_membuf_append(
 {
 	assert(m != NULL);
 
-	return ixml_membuf_insert(m, buf, 1, m->length);
+	return ixml_membuf_insert(m, buf, (size_t)1, m->length);
 }
 
 
@@ -197,7 +198,7 @@ int ixml_membuf_insert(
 		return IXML_INDEX_SIZE_ERR;
 	}
 
-	if (buf == NULL || buf_len == 0) {
+	if (buf == NULL || buf_len == (size_t)0) {
 		return 0;
 	}
 	/* alloc mem */

ixml/src/ixmlparser.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -409,7 +410,7 @@ static void Parser_skipWhiteSpaces(
 	Parser *xmlParser)
 {
     while( ( *( xmlParser->curPtr ) != 0 ) &&
-           ( strchr( WHITESPACE, *( xmlParser->curPtr ) ) != NULL ) ) {
+           ( strchr( WHITESPACE, ( int ) *( xmlParser->curPtr ) ) != NULL ) ) {
         xmlParser->curPtr++;
     }
 }
@@ -693,12 +694,12 @@ static BOOL Parser_isNameChar(
 	/*! [in] TRUE if you also want to check in the NameChar table. */
 	BOOL bNameChar)
 {
-	if (Parser_isCharInTable(c, Letter, LETTERTABLESIZE)) {
+	if (Parser_isCharInTable(c, Letter, (int)LETTERTABLESIZE)) {
 		return TRUE;
 	}
 
 	if (bNameChar &&
-	    Parser_isCharInTable(c, NameChar, NAMECHARTABLESIZE)) {
+	    Parser_isCharInTable(c, NameChar, (int)NAMECHARTABLESIZE)) {
 		return TRUE;
 	}
 
@@ -745,7 +746,7 @@ static int Parser_getChar(
 
 	*cLen = 0;
 	if (*src != '&') {
-		if (*src > 0 && Parser_isXmlChar(*src)) {
+		if (*src > 0 && Parser_isXmlChar((int)*src)) {
 			*cLen = 1;
 			ret = *src;
 			goto ExitFunction;
@@ -762,30 +763,30 @@ static int Parser_getChar(
 		ret = i;
 		goto ExitFunction;
 	} else if (strncasecmp(src, QUOT, strlen(QUOT)) == 0) {
-		*cLen = strlen(QUOT);
+		*cLen = (int)strlen(QUOT);
 		ret = '"';
 		goto ExitFunction;
 	} else if (strncasecmp(src, LT, strlen(LT)) == 0) {
-		*cLen = strlen(LT);
+		*cLen = (int)strlen(LT);
 		ret = '<';
 		goto ExitFunction;
 	} else if (strncasecmp(src, GT, strlen(GT)) == 0) {
-		*cLen = strlen(GT);
+		*cLen = (int)strlen(GT);
 		ret = '>';
 		goto ExitFunction;
 	} else if (strncasecmp(src, APOS, strlen(APOS)) == 0) {
-		*cLen = strlen(APOS);
+		*cLen = (int)strlen(APOS);
 		ret = '\'';
 		goto ExitFunction;
 	} else if (strncasecmp(src, AMP, strlen(AMP)) == 0) {
-		*cLen = strlen(AMP);
+		*cLen = (int)strlen(AMP);
 		ret = '&';
 		goto ExitFunction;
 	} else if (strncasecmp(src, ESC_HEX, strlen(ESC_HEX)) == 0) {
 		/* Read in escape characters of type &#xnn where nn is a hexadecimal value */
 		pnum = src + strlen( ESC_HEX );
 		sum = 0;
-		while (strchr(HEX_NUMBERS, *pnum) != 0) {
+		while (strchr(HEX_NUMBERS, (int)*pnum) != 0) {
 			c = *pnum;
 			if (c <= '9') {
 				sum = sum * 16 + ( c - '0' );
@@ -807,7 +808,7 @@ static int Parser_getChar(
 		/* Read in escape characters of type &#nn where nn is a decimal value */
 		pnum = src + strlen(ESC_DEC);
 		sum = 0;
-		while (strchr(DEC_NUMBERS, *pnum) != 0) {
+		while (strchr(DEC_NUMBERS, (int)*pnum) != 0) {
 			sum = sum * 10 + ( *pnum - '0' );
 			pnum++;
 		}
@@ -1095,7 +1096,7 @@ static char *safe_strdup(
 	assert(s != NULL);
 
 	if (s == NULL) {
-		return strdup("");
+		return strdup((const char*)"");
 	}
 	return strdup(s);
 }
@@ -1214,7 +1215,7 @@ static int Parser_processCDSect(
 	IXML_Node *node)
 {
     char *pEnd;
-    size_t tokenLength = 0;
+    size_t tokenLength = (size_t)0;
     char *pCDataStart;
 
     if( *pSrc == NULL ) {
@@ -1223,7 +1224,7 @@ static int Parser_processCDSect(
 
     pCDataStart = *pSrc + strlen( CDSTART );
     pEnd = pCDataStart;
-    while( ( Parser_isXmlChar( *pEnd ) == TRUE ) && ( *pEnd != '\0' ) ) {
+    while( ( Parser_isXmlChar( (int)*pEnd ) == TRUE ) && ( *pEnd != '\0' ) ) {
         if( strncmp( pEnd, CDEND, strlen( CDEND ) ) == 0 ) {
             break;
         } else {
@@ -1232,8 +1233,8 @@ static int Parser_processCDSect(
     }
 
     if( ( pEnd - pCDataStart > 0 ) && ( *pEnd != '\0' ) ) {
-        tokenLength = (size_t)(pEnd - pCDataStart);
+        tokenLength = (size_t)pEnd - (size_t)pCDataStart;
-        node->nodeValue = (char *)malloc(tokenLength + 1);
+        node->nodeValue = (char *)malloc(tokenLength + (size_t)1);
         if( node->nodeValue == NULL ) {
             return IXML_INSUFFICIENT_MEMORY;
         }
@@ -1268,7 +1269,6 @@ static int Parser_processContent(
 	int ret = IXML_SUCCESS;
 	int line = 0;
 	char *pEndContent;
-	BOOL bReadContent;
 	ptrdiff_t tokenLength;
 	const char *notAllowed = "]]>";
 	char *pCurToken = NULL;
@@ -1324,10 +1324,6 @@ static int Parser_processContent(
 			pEndContent++;
 		}
 
-		if (*pEndContent == '\0') {
-			bReadContent = FALSE;
-		}
-
 		if (strncmp(pEndContent, (const char *)notAllowed, strlen(notAllowed)) == 0) {
 			line = __LINE__;
 			ret = IXML_SYNTAX_ERR;
@@ -1455,6 +1451,7 @@ ExitFunction:
  *
  * \return IXML_SUCCESS.
  */
+#if 0
 static int Parser_parseReference(
 	/*! [in] Currently unused. */
 	char *pStr)
@@ -1463,6 +1460,7 @@ static int Parser_parseReference(
 	return IXML_SUCCESS;
 	pStr = pStr;
 }
+#endif
 
 
 /*!
@@ -1502,47 +1500,39 @@ static int Parser_addNamespace(
 	/*! [in] The XML parser. */
 	Parser *xmlParser)
 {
-    IXML_Node *pNode;
+	IXML_Node *pNode;
-    IXML_ElementStack *pCur;
+	IXML_ElementStack *pCur;
-    const char *namespaceUri;
+	const char *namespaceUri;
 
-    pNode = xmlParser->pNeedPrefixNode;
+	pNode = xmlParser->pNeedPrefixNode;
-    pCur = xmlParser->pCurElement;
+	pCur = xmlParser->pCurElement;
+	if (!pNode->prefix) {
+		/* element does not have prefix */
+		if (strcmp(pNode->nodeName, pCur->element) != 0)
+			return IXML_FAILED;
+		if (pCur->namespaceUri) {
+			/* it would be wrong that pNode->namespace != NULL. */
+			assert(pNode->namespaceURI == NULL);
+			pNode->namespaceURI = safe_strdup(pCur->namespaceUri);
+			if (!pNode->namespaceURI)
+				return IXML_INSUFFICIENT_MEMORY;
+		}
+		xmlParser->pNeedPrefixNode = NULL;
+	} else {
+		if (!pCur->prefix ||
+		    ((strcmp(pNode->nodeName, pCur->element) != 0) &&
+		     (strcmp(pNode->prefix, pCur->prefix) != 0)))
+			return IXML_FAILED;
+		namespaceUri = Parser_getNameSpace(xmlParser, pCur->prefix);
+		if (namespaceUri) {
+			pNode->namespaceURI = safe_strdup(namespaceUri);
+			if (!pNode->namespaceURI)
+				return IXML_INSUFFICIENT_MEMORY;
+			xmlParser->pNeedPrefixNode = NULL;
+		}
+	}
 
-    if( pNode->prefix == NULL ) {
+	return IXML_SUCCESS;
-	/* element does not have prefix */
-        if( strcmp( pNode->nodeName, pCur->element ) != 0 ) {
-            return IXML_FAILED;
-        }
-        if( pCur->namespaceUri != NULL ) {
-            /* it would be wrong that pNode->namespace != NULL. */
-            assert( pNode->namespaceURI == NULL );
-
-            pNode->namespaceURI = safe_strdup( pCur->namespaceUri );
-            if( pNode->namespaceURI == NULL ) {
-                return IXML_INSUFFICIENT_MEMORY;
-            }
-        }
-
-        xmlParser->pNeedPrefixNode = NULL;
-
-    } else {
-        if( ( strcmp( pNode->nodeName, pCur->element ) != 0 ) &&
-            ( strcmp( pNode->prefix, pCur->prefix ) != 0 ) ) {
-            return IXML_FAILED;
-        }
-
-        namespaceUri = Parser_getNameSpace( xmlParser, pCur->prefix );
-        if( namespaceUri != NULL ) {
-            pNode->namespaceURI = safe_strdup( namespaceUri );
-            if( pNode->namespaceURI == NULL ) {
-                return IXML_INSUFFICIENT_MEMORY;
-            }
-
-            xmlParser->pNeedPrefixNode = NULL;
-        }
-    }
-    return IXML_SUCCESS;
 }
 
 
@@ -1593,6 +1583,9 @@ static int Parser_xmlNamespace(
 		}
 		if (pCur->prefix != NULL &&
 		    strcmp(pCur->prefix, newNode->localName) == 0) {
+			if (pCur->namespaceUri != NULL) {
+				free(pCur->namespaceUri);
+			}
 			pCur->namespaceUri = safe_strdup(newNode->nodeValue);
 			if (pCur->namespaceUri == NULL) {
 				ret = IXML_INSUFFICIENT_MEMORY;
@@ -1755,9 +1748,9 @@ static int Parser_processAttribute(
 			line = __LINE__;
 			goto ExitFunction;
 		}
-		if (*pCur == '&') {
+		/*if (*pCur == '&') {
 			Parser_parseReference(++pCur);
-		}
+		}*/
 		pCur++;
 	}
 	/* clear token buffer */
@@ -1843,7 +1836,7 @@ static int Parser_getNextNode(
 {
 	char *pCurToken = NULL;
 	char *lastElement = NULL;
-	IXML_ERRORCODE ret = IXML_SUCCESS;
+	int ret = IXML_SUCCESS;
 	int line = 0;
 	ptrdiff_t tokenLen = 0;
 
@@ -1855,11 +1848,12 @@ static int Parser_getNextNode(
 		goto ExitFunction;
 	}
 
-	if (xmlParser->state == eCONTENT) {
+	switch (xmlParser->state) {
+	case eCONTENT:
 		line = __LINE__;
 		ret = Parser_processContent(xmlParser, node);
 		goto ExitFunction;
-	} else {
+	default:
 		Parser_skipWhiteSpaces(xmlParser);
 		tokenLen = Parser_getNextToken(xmlParser);
 		if (tokenLen == 0 &&
@@ -1869,7 +1863,7 @@ static int Parser_getNextNode(
 			line = __LINE__;
 			ret = IXML_SUCCESS;
 			goto ExitFunction;
-		} else if ((xmlParser->tokenBuf).length == 0) {
+		} else if ((xmlParser->tokenBuf).length == (size_t)0) {
 			line = __LINE__;
 			ret = IXML_SYNTAX_ERR;
 			goto ExitFunction;
@@ -1909,8 +1903,16 @@ static int Parser_getNextNode(
 			line = __LINE__;
 			ret = IXML_SUCCESS;
 			goto ExitFunction;
-		} else if (xmlParser->state == eATTRIBUTE && xmlParser->pCurElement != NULL) {
+		} else if (xmlParser->pCurElement != NULL) {
-			if (Parser_processAttribute(xmlParser, node) != IXML_SUCCESS) {
+			switch (xmlParser->state) {
+			case eATTRIBUTE:
+				if (Parser_processAttribute(xmlParser, node) != IXML_SUCCESS) {
+					line = __LINE__;
+					ret = IXML_SYNTAX_ERR;
+					goto ExitFunction;
+				}
+				break;
+			default:
 				line = __LINE__;
 				ret = IXML_SYNTAX_ERR;
 				goto ExitFunction;
@@ -2050,11 +2052,15 @@ static int Parser_processAttributeName(
 
     rc = ixmlNode_setNodeProperties( ( IXML_Node * ) attr, newNode );
     if( rc != IXML_SUCCESS ) {
+        ixmlAttr_free( attr );
         return rc;
     }
 
     rc = ixmlElement_setAttributeNode(
 	(IXML_Element *)xmlParser->currentNodePtr, attr, NULL );
+    if( rc != IXML_SUCCESS ) {
+        ixmlAttr_free( attr );
+    }
     return rc;
 }
 
@@ -2142,8 +2148,6 @@ static int isTopLevelElement(
 static BOOL Parser_hasDefaultNamespace(
 	/*! [in] The XML parser. */
 	Parser *xmlParser,
-	/*! [in] The Node to process. */
-	IXML_Node *newNode,
 	/*! [in,out] The name space URI. */
 	char **nsURI )
 {
@@ -2159,7 +2163,6 @@ static BOOL Parser_hasDefaultNamespace(
     }
 
     return FALSE;
-    newNode = newNode;
 }
 
 
@@ -2212,11 +2215,17 @@ static int Parser_processElementName(
     } else {
 	/* does element has default namespace */
         /* the node may have default namespace definition */
-        if (Parser_hasDefaultNamespace(xmlParser, newNode, &nsURI)) {
+        if (Parser_hasDefaultNamespace(xmlParser, &nsURI)) {
             Parser_setElementNamespace(newElement, nsURI);
-        } else if (xmlParser->state == eATTRIBUTE) {
+        } else {
-            /* the default namespace maybe defined later */
+            switch (xmlParser->state) {
-            xmlParser->pNeedPrefixNode = (IXML_Node *)newElement;
+            case eATTRIBUTE:
+                /* the default namespace maybe defined later */
+                xmlParser->pNeedPrefixNode = (IXML_Node *)newElement;
+                break;
+            default:
+                break;
+            }
         }
     }
 
@@ -2246,14 +2255,14 @@ static int Parser_isValidEndElement(
 	IXML_Node *newNode)
 {
 	assert(xmlParser);
-	assert(xmlParser->pCurElement->element);
-	assert(newNode);
-	assert(newNode->nodeName);
 
 	if (xmlParser->pCurElement == NULL) {
 		return 0;
 	}
 
+	assert(xmlParser->pCurElement->element);
+	assert(newNode);
+	assert(newNode->nodeName);
 	return strcmp(xmlParser->pCurElement->element, newNode->nodeName) == 0;
 }
 
@@ -2297,13 +2306,17 @@ static int Parser_eTagVerification(
     assert( newNode->nodeName );
     assert( xmlParser->currentNodePtr );
 
-    if( newNode->nodeType == eELEMENT_NODE ) {
+    switch( newNode->nodeType ) {
+    case eELEMENT_NODE:
         if( Parser_isValidEndElement( xmlParser, newNode ) == TRUE ) {
             Parser_popElement( xmlParser );
         } else {
 	    /* syntax error */
             return IXML_SYNTAX_ERR;
         }
+        break;
+    default:
+       break;
     }
 
     if( strcmp( newNode->nodeName, xmlParser->currentNodePtr->nodeName ) ==
@@ -2460,16 +2473,16 @@ ErrorHandler:
 BOOL Parser_isValidXmlName(const DOMString name)
 {
 	const char *pstr = NULL;
-	size_t i = 0;
+	size_t i = (size_t)0;
-	size_t nameLen = 0;
+	size_t nameLen = (size_t)0;
 
 	assert(name != NULL);
 
 	nameLen = strlen(name);
 	pstr = name;
-	if (Parser_isNameChar(*pstr, FALSE) == TRUE) {
+	if (Parser_isNameChar((int)*pstr, FALSE) == TRUE) {
-		for (i = 1; i < nameLen; ++i) {
+		for (i = (size_t)1; i < nameLen; ++i) {
-			if (Parser_isNameChar(*(pstr + i), TRUE) == FALSE) {
+			if (Parser_isNameChar((int)*(pstr + i), TRUE) == FALSE) {
 				/* illegal char */
 				return FALSE;
 			}
@@ -2522,7 +2535,7 @@ static int Parser_readFileOrBuffer(
 	BOOL file)
 {
     long fileSize = 0;
-    size_t bytesRead = 0;
+    size_t bytesRead = (size_t)0;
     FILE *xmlFilePtr = NULL;
 
     if( file ) {
@@ -2532,12 +2545,12 @@ static int Parser_readFileOrBuffer(
         } else {
             fseek( xmlFilePtr, 0, SEEK_END );
             fileSize = ftell( xmlFilePtr );
-            if( fileSize == 0 ) {
+            if( fileSize <= 0 ) {
                 fclose( xmlFilePtr );
                 return IXML_SYNTAX_ERR;
             }
 
-            xmlParser->dataBuffer = (char *)malloc((size_t)fileSize + 1);
+            xmlParser->dataBuffer = (char *)malloc((size_t)fileSize + (size_t)1);
             if( xmlParser->dataBuffer == NULL ) {
                 fclose( xmlFilePtr );
                 return IXML_INSUFFICIENT_MEMORY;
@@ -2545,7 +2558,7 @@ static int Parser_readFileOrBuffer(
 
             fseek( xmlFilePtr, 0, SEEK_SET );
             bytesRead =
-                fread(xmlParser->dataBuffer, 1, (size_t)fileSize, xmlFilePtr);
+                fread(xmlParser->dataBuffer, (size_t)1, (size_t)fileSize, xmlFilePtr);
 	    /* append null */
             xmlParser->dataBuffer[bytesRead] = '\0';
             fclose( xmlFilePtr );
@@ -2652,12 +2665,12 @@ int Parser_setNodePrefixAndLocalName(
         /* fill in the local name and prefix */
         pLocalName = ( char * )pStrPrefix + 1;
         nPrefix = pStrPrefix - node->nodeName;
-        node->prefix = malloc((size_t)nPrefix + 1);
+        node->prefix = malloc((size_t)nPrefix + (size_t)1);
         if (!node->prefix) {
             return IXML_INSUFFICIENT_MEMORY;
         }
 
-        memset(node->prefix, 0, (size_t)nPrefix + 1);
+        memset(node->prefix, 0, (size_t)nPrefix + (size_t)1);
         strncpy(node->prefix, node->nodeName, (size_t)nPrefix);
 
         node->localName = safe_strdup( pLocalName );

ixml/src/namedNodeMap.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -53,11 +54,11 @@ static unsigned long ixmlNamedNodeMap_getItemNumber(
 	IN const char *name)
 {
 	IXML_Node *tempNode;
-	unsigned long returnItemNo = 0;
+	unsigned long returnItemNo = 0lu;
 
 	assert(nnMap != NULL && name != NULL);
 	if (nnMap == NULL || name == NULL) {
-		return IXML_INVALID_ITEM_NUMBER;
+		return (unsigned long)IXML_INVALID_ITEM_NUMBER;
 	}
 
 	tempNode = nnMap->nodeItem;
@@ -69,7 +70,7 @@ static unsigned long ixmlNamedNodeMap_getItemNumber(
 		returnItemNo++;
 	}
 
-	return IXML_INVALID_ITEM_NUMBER;
+	return (unsigned long)IXML_INVALID_ITEM_NUMBER;
 }
 
 
@@ -92,7 +93,7 @@ IXML_Node *ixmlNamedNodeMap_getNamedItem(
 	}
 
 	index = ixmlNamedNodeMap_getItemNumber(nnMap, name);
-	if (index == IXML_INVALID_ITEM_NUMBER) {
+	if (index == (unsigned long)IXML_INVALID_ITEM_NUMBER) {
 		return NULL;
 	} else {
 		return ixmlNamedNodeMap_item(nnMap, index);
@@ -111,12 +112,12 @@ IXML_Node *ixmlNamedNodeMap_item(
 		return NULL;
 	}
 
-	if (index > ixmlNamedNodeMap_getLength(nnMap) - 1) {
+	if (index > ixmlNamedNodeMap_getLength(nnMap) - 1lu) {
 		return NULL;
 	}
 
 	tempNode = nnMap->nodeItem;
-	for (i = 0; i < index && tempNode != NULL; ++i) {
+	for (i = 0u; i < index && tempNode != NULL; ++i) {
 		tempNode = tempNode->nextSibling;
 	}
 
@@ -127,11 +128,11 @@ IXML_Node *ixmlNamedNodeMap_item(
 unsigned long ixmlNamedNodeMap_getLength(IXML_NamedNodeMap *nnMap)
 {
 	IXML_Node *tempNode;
-	unsigned long length = 0;
+	unsigned long length = 0lu;
 
 	if (nnMap != NULL) {
 		tempNode = nnMap->nodeItem;
-		for (length = 0; tempNode != NULL; ++length) {
+		for (length = 0lu; tempNode != NULL; ++length) {
 			tempNode = tempNode->nextSibling;
 		}
 	}

ixml/src/node.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -90,9 +91,13 @@ static void ixmlNode_freeSingleNode(
 		if (nodeptr->localName != NULL) {
 			free(nodeptr->localName);
 		}
-		if (nodeptr->nodeType == eELEMENT_NODE) {
+		switch (nodeptr->nodeType ) {
+		case eELEMENT_NODE:
 			element = (IXML_Element *)nodeptr;
 			free(element->tagName);
+			break;
+		default:
+			break;
 		}
 		free(nodeptr);
 	}
@@ -280,7 +285,7 @@ unsigned short ixmlNode_getNodeType(IXML_Node *nodeptr)
 	if (nodeptr != NULL) {
 		return nodeptr->nodeType;
 	} else {
-		return eINVALID_NODE;
+		return (unsigned short)eINVALID_NODE;
 	}
 }
 
@@ -397,7 +402,8 @@ static BOOL ixmlNode_isParent(
 
 	assert(nodeptr != NULL && toFind != NULL);
 
-	found = toFind->parentNode == nodeptr;
+	if (nodeptr != NULL && toFind != NULL)
+		found = toFind->parentNode == nodeptr;
 
 	return found;
 }
@@ -422,17 +428,22 @@ static BOOL ixmlNode_allowChildren(
 	case eTEXT_NODE:
 	case eCDATA_SECTION_NODE:
 		return FALSE;
-		break;
 
 	case eELEMENT_NODE:
-		if (newChild->nodeType == eATTRIBUTE_NODE ||
+		switch (newChild->nodeType) {
-		    newChild->nodeType == eDOCUMENT_NODE) {
+		case eATTRIBUTE_NODE:
+		case eDOCUMENT_NODE:
 			return FALSE;
+		default:
+			break;
 		}
 	break;
 
 	case eDOCUMENT_NODE:
-		if (newChild->nodeType != eELEMENT_NODE) {
+		switch (newChild->nodeType) {
+		case eELEMENT_NODE:
+			break;
+		default:
 			return FALSE;
 		}
 
@@ -500,7 +511,7 @@ int ixmlNode_insertBefore(
 
 	if (refChild != NULL) {
 		if (ixmlNode_isParent(nodeptr, newChild) == TRUE) {
-			ixmlNode_removeChild(nodeptr, newChild, NULL);
+			ixmlNode_removeChild(nodeptr, newChild, &newChild);
 			newChild->nextSibling = NULL;
 			newChild->prevSibling = NULL;
 		}
@@ -566,31 +577,23 @@ int ixmlNode_removeChild(
 	IXML_Node *oldChild,
 	IXML_Node **returnNode)
 {
-	if (nodeptr == NULL || oldChild == NULL) {
+	if (!nodeptr || !oldChild)
 		return IXML_INVALID_PARAMETER;
-	}
+	if (!ixmlNode_isParent(nodeptr, oldChild))
-
-	if (ixmlNode_isParent(nodeptr, oldChild) == FALSE ) {
 		return IXML_NOT_FOUND_ERR;
-	}
+	if (oldChild->prevSibling)
-
-	if (oldChild->prevSibling != NULL) {
 		oldChild->prevSibling->nextSibling = oldChild->nextSibling;
-	}
+	if (nodeptr->firstChild == oldChild)
-	if (nodeptr->firstChild == oldChild) {
 		nodeptr->firstChild = oldChild->nextSibling;
-	}
+	if (oldChild->nextSibling)
-	if (oldChild->nextSibling != NULL) {
 		oldChild->nextSibling->prevSibling = oldChild->prevSibling;
-	}
 	oldChild->nextSibling = NULL;
 	oldChild->prevSibling = NULL;
 	oldChild->parentNode = NULL;
-	if (returnNode != NULL) {
+	if (returnNode)
 		*returnNode = oldChild;
-	} else {
+	else
 		ixmlNode_free(oldChild);
-	}
 
 	return IXML_SUCCESS;
 }
@@ -619,7 +622,7 @@ int ixmlNode_appendChild(IXML_Node *nodeptr, IXML_Node *newChild)
 	}
 
 	if (ixmlNode_isParent(nodeptr, newChild) == TRUE ) {
-		ixmlNode_removeChild(nodeptr, newChild, NULL);
+		ixmlNode_removeChild(nodeptr, newChild, &newChild);
 	}
 	/* set the parent node pointer */
 	newChild->parentNode = nodeptr;
@@ -652,6 +655,7 @@ static IXML_Node *ixmlNode_cloneTextNode(
 	IXML_Node *nodeptr)
 {
 	IXML_Node *newNode = NULL;
+	int rc;
 
 	assert(nodeptr != NULL);
 
@@ -660,8 +664,16 @@ static IXML_Node *ixmlNode_cloneTextNode(
 		return NULL;
 	} else {
 		ixmlNode_init(newNode);
-		ixmlNode_setNodeName(newNode, nodeptr->nodeName);
+		rc = ixmlNode_setNodeName(newNode, nodeptr->nodeName);
-		ixmlNode_setNodeValue(newNode, nodeptr->nodeValue);
+		if (rc != IXML_SUCCESS) {
+			ixmlNode_free(newNode);
+			return NULL;
+		}
+		rc = ixmlNode_setNodeValue(newNode, nodeptr->nodeValue);
+		if (rc != IXML_SUCCESS) {
+			ixmlNode_free(newNode);
+			return NULL;
+		}
 		newNode->nodeType = eTEXT_NODE;
 	}
 
@@ -680,15 +692,24 @@ static IXML_CDATASection *ixmlNode_cloneCDATASect(
 	IXML_CDATASection *newCDATA = NULL;
 	IXML_Node *newNode;
 	IXML_Node *srcNode;
+	int rc;
 
 	assert(nodeptr != NULL);
 	newCDATA = (IXML_CDATASection *)malloc(sizeof (IXML_CDATASection));
 	if (newCDATA != NULL) {
 		newNode = (IXML_Node *)newCDATA;
-		ixmlNode_init(newNode);
+		ixmlCDATASection_init(newCDATA);
 		srcNode = (IXML_Node *)nodeptr;
-		ixmlNode_setNodeName(newNode, srcNode->nodeName);
+		rc = ixmlNode_setNodeName(newNode, srcNode->nodeName);
-		ixmlNode_setNodeValue(newNode, srcNode->nodeValue);
+		if (rc != IXML_SUCCESS) {
+			ixmlCDATASection_free(newCDATA);
+			return NULL;
+		}
+		rc = ixmlNode_setNodeValue(newNode, srcNode->nodeValue);
+		if (rc != IXML_SUCCESS) {
+			ixmlCDATASection_free(newCDATA);
+			return NULL;
+		}
 		newNode->nodeType = eCDATA_SECTION_NODE;
 	}
 
@@ -763,42 +784,32 @@ static IXML_Element *ixmlNode_cloneElement(
 
 
 /*!
- * \brief Returns a clone of a document node.
+ * \brief Returns a new document node.
  *
  * Currently, the IXML_Document struct is just a node, so this function
- * just mallocs the IXML_Document, sets the node type and name. Curiously,
+ * just mallocs the IXML_Document, sets the node type and name.
- * the parameter nodeptr is not actually used.
  *
- * \return A clone of a document node.
+ * \return A new document node.
  */
-static IXML_Document *ixmlNode_cloneDoc(
+static IXML_Document *ixmlNode_newDoc(void)
-	/*! [in] The \b Node to clone. */
-	IXML_Document *nodeptr)
 {
 	IXML_Document *newDoc;
 	IXML_Node *docNode;
 	int rc;
 
-	assert(nodeptr != NULL);
-
 	newDoc = (IXML_Document *)malloc(sizeof (IXML_Document));
-	if (newDoc == NULL) {
+	if (!newDoc)
 		return NULL;
-	}
-
 	ixmlDocument_init(newDoc);
 	docNode = (IXML_Node *)newDoc;
-
 	rc = ixmlNode_setNodeName(docNode, DOCUMENTNODENAME);
 	if (rc != IXML_SUCCESS) {
 		ixmlDocument_free(newDoc);
 		return NULL;
 	}
-
 	newDoc->n.nodeType = eDOCUMENT_NODE;
 
 	return newDoc;
-	nodeptr = nodeptr;
 }
 
 /*!
@@ -923,6 +934,8 @@ static IXML_Node *ixmlNode_cloneNodeTreeRecursive(
 		switch (nodeptr->nodeType) {
 		case eELEMENT_NODE:
 			newElement = ixmlNode_cloneElement((IXML_Element *)nodeptr);
+			if (newElement == NULL)
+				return NULL;
 			newElement->n.firstAttr = ixmlNode_cloneNodeTreeRecursive(
 				nodeptr->firstAttr, deep);
 			if (deep) {
@@ -943,6 +956,8 @@ static IXML_Node *ixmlNode_cloneNodeTreeRecursive(
 
 		case eATTRIBUTE_NODE:
 			newAttr = ixmlNode_cloneAttr((IXML_Attr *)nodeptr);
+			if (newAttr == NULL)
+				return NULL;
 			nextSib = ixmlNode_cloneNodeTreeRecursive(nodeptr->nextSibling, deep);
 			newAttr->n.nextSibling = nextSib;
 			if (nextSib != NULL) {
@@ -961,7 +976,9 @@ static IXML_Node *ixmlNode_cloneNodeTreeRecursive(
 			break;
 
 		case eDOCUMENT_NODE:
-			newDoc = ixmlNode_cloneDoc((IXML_Document *)nodeptr);
+			newDoc = ixmlNode_newDoc();
+			if (newDoc == NULL)
+				return NULL;
 			newNode = (IXML_Node *)newDoc;
 			if (deep) {
 				newNode->firstChild = ixmlNode_cloneNodeTreeRecursive(
@@ -1008,6 +1025,8 @@ static IXML_Node *ixmlNode_cloneNodeTree(
 	switch (nodeptr->nodeType) {
 	case eELEMENT_NODE:
 		newElement = ixmlNode_cloneElement((IXML_Element *)nodeptr);
+		if (newElement == NULL)
+			return NULL;
 		newElement->n.firstAttr = ixmlNode_cloneNodeTreeRecursive(nodeptr->firstAttr, deep);
 		if (deep) {
 			newElement->n.firstChild = ixmlNode_cloneNodeTreeRecursive(
@@ -1048,7 +1067,8 @@ static IXML_Node *ixmlNode_cloneNodeTree(
 	}
 
 	/* by spec, the duplicate node has no parent */
-	newNode->parentNode = NULL;
+	if (newNode != NULL)
+		newNode->parentNode = NULL;
 
 	return newNode;
 }
@@ -1119,7 +1139,8 @@ IXML_NamedNodeMap *ixmlNode_getAttributes(IXML_Node *nodeptr)
 		return NULL;
 	}
 
-	if(nodeptr->nodeType == eELEMENT_NODE) {
+	switch(nodeptr->nodeType) {
+	case eELEMENT_NODE:
 		returnNamedNodeMap = (IXML_NamedNodeMap *)malloc(sizeof(IXML_NamedNodeMap));
 		if(returnNamedNodeMap == NULL) {
 			return NULL;
@@ -1137,7 +1158,7 @@ IXML_NamedNodeMap *ixmlNode_getAttributes(IXML_Node *nodeptr)
 			tempNode = tempNode->nextSibling;
 		}
 		return returnNamedNodeMap;
-	} else {
+	default:
 		/* if not an ELEMENT_NODE */
 		return NULL;
 	}
@@ -1157,8 +1178,13 @@ BOOL ixmlNode_hasChildNodes(IXML_Node *nodeptr)
 BOOL ixmlNode_hasAttributes(IXML_Node *nodeptr)
 {
 	if (nodeptr != NULL) {
-		if (nodeptr->nodeType == eELEMENT_NODE && nodeptr->firstAttr != NULL) {
+		switch (nodeptr->nodeType) {
-			return TRUE;
+		case eELEMENT_NODE:
+			if (nodeptr->firstAttr != NULL)
+				return TRUE;
+			break;
+		default:
+			break;
 		}
 	}
 

ixml/src/nodeList.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -62,12 +63,12 @@ IXML_Node *ixmlNodeList_item(
 		return NULL;
 	}
 	/* if index is more than list length */
-	if (index > ixmlNodeList_length(nList) - 1) {
+	if (index > ixmlNodeList_length(nList) - 1lu) {
 		return NULL;
 	}
 
 	next = nList;
-	for (i = 0; i < index && next != NULL; ++i) {
+	for (i = 0u; i < index && next != NULL; ++i) {
 		next = next->next;
 	}
 
@@ -127,7 +128,7 @@ int ixmlNodeList_addToNodeList(
 unsigned long ixmlNodeList_length(IXML_NodeList *nList)
 {
 	IXML_NodeList *list;
-	unsigned long length = 0;
+	unsigned long length = 0lu;
 
 	list = nList;
 	while (list != NULL) {

libupnp.spec

@@ -1,4 +1,4 @@
-Version: 1.6.13
+Version: 1.6.16
 Summary: Universal Plug and Play (UPnP) SDK
 Name: libupnp
 Release: 1%{?dist}

threadutil/inc/ThreadPool.h

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -98,7 +99,7 @@ typedef enum priority {
 #define DEFAULT_MAX_THREADS 10
 
 /*! default stack size used by TPAttrInit */
-#define DEFAULT_STACK_SIZE 0
+#define DEFAULT_STACK_SIZE 0u
 
 /*! default jobs per thread used by TPAttrInit */
 #define DEFAULT_JOBS_PER_THREAD 10
@@ -165,7 +166,7 @@ typedef struct THREADPOOLJOB
 	void *arg;
 	free_routine free_func;
 	struct timeval requestTime;
-	int priority;
+	ThreadPriority priority;
 	int jobId;
 } ThreadPoolJob;
 

threadutil/inc/ithread.h

@@ -922,7 +922,8 @@ static UPNP_INLINE int ithread_cleanup_thread(void) {
 #endif
 
 
-#if !defined(PTHREAD_MUTEX_RECURSIVE) && !defined(__DragonFly__)
+#if !defined(PTHREAD_MUTEX_RECURSIVE) && !defined(__DragonFly__) && !defined(UPNP_USE_MSVCPP)
+/* !defined(UPNP_USE_MSVCPP) should probably also have pthreads version check - but it's not clear if that is possible */
 /* NK: Added for satisfying the gcc compiler */
 EXPORT_SPEC int pthread_mutexattr_setkind_np(pthread_mutexattr_t *attr, int kind);
 #endif

threadutil/src/LinkedList.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -102,7 +103,7 @@ int ListInit(LinkedList *list, cmp_routine cmp_func, free_function free_func)
 	list->tail.prev = &list->head;
 	list->tail.next = NULL;
 
-	return 0;
+	return retCode;
 }
 
 ListNode *ListAddHead(LinkedList *list, void *item)

threadutil/src/ThreadPool.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -59,15 +60,15 @@ static long DiffMillis(
 	/*! . */
 	struct timeval *time2)
 {
-	double temp = 0;
+	double temp = 0.0;
 
-	temp = (double)(time1->tv_sec - time2->tv_sec);
+	temp = (double)time1->tv_sec - (double)time2->tv_sec;
 	/* convert to milliseconds */
-	temp *= 1000;
+	temp *= 1000.0;
 
 	/* convert microseconds to milliseconds and add to temp */
 	/* implicit flooring of unsigned long data type */
-	temp += (double)((time1->tv_usec - time2->tv_usec) / 1000);
+	temp += ((double)time1->tv_usec - (double)time2->tv_usec) / 1000.0;
 
 	return (long)temp;
 }
@@ -82,18 +83,18 @@ static void StatsInit(
 	/*! Must be valid non null stats structure. */
 	ThreadPoolStats *stats)
 {
-	stats->totalIdleTime = 0;
+	stats->totalIdleTime = 0.0;
 	stats->totalJobsHQ = 0;
 	stats->totalJobsLQ = 0;
 	stats->totalJobsMQ = 0;
-	stats->totalTimeHQ = 0;
+	stats->totalTimeHQ = 0.0;
-	stats->totalTimeMQ = 0;
+	stats->totalTimeMQ = 0.0;
-	stats->totalTimeLQ = 0;
+	stats->totalTimeLQ = 0.0;
-	stats->totalWorkTime = 0;
+	stats->totalWorkTime = 0.0;
-	stats->totalIdleTime = 0;
+	stats->totalIdleTime = 0.0;
-	stats->avgWaitHQ = 0;
+	stats->avgWaitHQ = 0.0;
-	stats->avgWaitMQ = 0;
+	stats->avgWaitMQ = 0.0;
-	stats->avgWaitLQ = 0;
+	stats->avgWaitLQ = 0.0;
 	stats->workerThreads = 0;
 	stats->idleThreads = 0;
 	stats->persistentThreads = 0;
@@ -292,8 +293,8 @@ static int SetPriority(
 	/*! . */
 	ThreadPriority priority)
 {
-	int retVal = 0;
 #if defined(_POSIX_PRIORITY_SCHEDULING) && _POSIX_PRIORITY_SCHEDULING > 0
+	int retVal = 0;
 	int currentPolicy;
 	int minPriority = 0;
 	int maxPriority = 0;
@@ -325,11 +326,12 @@ static int SetPriority(
 
 	sched_result = pthread_setschedparam(ithread_self(), currentPolicy, &newPriority);
 	retVal = (sched_result == 0 || errno == EPERM) ? 0 : sched_result;
-#else
-	retVal = 0;
-#endif
 exit_function:
 	return retVal;
+#else
+	return 0;
+	priority = priority;
+#endif
 }
 
 /*!
@@ -475,7 +477,7 @@ static void *WorkerThread(
 		}
 		retCode = 0;
 		tp->stats.idleThreads++;
-		tp->stats.totalWorkTime += (double)(StatsTime(NULL) - start);
+		tp->stats.totalWorkTime += (double)StatsTime(NULL) - (double)start;
 		StatsTime(&start);
 		if (persistent == 0) {
 			tp->stats.workerThreads--;
@@ -508,7 +510,7 @@ static void *WorkerThread(
 		}
 		tp->stats.idleThreads--;
 		/* idle time */
-		tp->stats.totalIdleTime += (double)(StatsTime(NULL) - start);
+		tp->stats.totalIdleTime += (double)StatsTime(NULL) - (double)start;
 		/* work time */
 		StatsTime(&start);
 		/* bump priority of starved jobs */
@@ -530,16 +532,28 @@ static void *WorkerThread(
 				/* Pick the highest priority job */
 				if (tp->highJobQ.size > 0) {
 					head = ListHead(&tp->highJobQ);
+					if (head == NULL) {
+						tp->stats.workerThreads--;
+						goto exit_function;
+					}
 					job = (ThreadPoolJob *) head->item;
 					CalcWaitTime(tp, HIGH_PRIORITY, job);
 					ListDelNode(&tp->highJobQ, head, 0);
 				} else if (tp->medJobQ.size > 0) {
 					head = ListHead(&tp->medJobQ);
+					if (head == NULL) {
+						tp->stats.workerThreads--;
+						goto exit_function;
+					}
 					job = (ThreadPoolJob *) head->item;
 					CalcWaitTime(tp, MED_PRIORITY, job);
 					ListDelNode(&tp->medJobQ, head, 0);
 				} else if (tp->lowJobQ.size > 0) {
 					head = ListHead(&tp->lowJobQ);
+					if (head == NULL) {
+						tp->stats.workerThreads--;
+						goto exit_function;
+					}
 					job = (ThreadPoolJob *) head->item;
 					CalcWaitTime(tp, LOW_PRIORITY, job);
 					ListDelNode(&tp->lowJobQ, head, 0);
@@ -693,6 +707,10 @@ int ThreadPoolInit(ThreadPool *tp, ThreadPoolAttr *attr)
 	retCode += ithread_cond_init(&tp->condition, NULL);
 	retCode += ithread_cond_init(&tp->start_and_shutdown, NULL);
 	if (retCode) {
+		ithread_mutex_unlock(&tp->mutex);
+		ithread_mutex_destroy(&tp->mutex);
+		ithread_cond_destroy(&tp->condition);
+		ithread_cond_destroy(&tp->start_and_shutdown);
 		return EAGAIN;
 	}
 	if (attr) {
@@ -813,13 +831,16 @@ int ThreadPoolAdd(ThreadPool *tp, ThreadPoolJob *job, int *jobId)
 	temp = CreateThreadPoolJob(job, tp->lastJobId, tp);
 	if (!temp)
 		goto exit_function;
-	if (job->priority == HIGH_PRIORITY) {
+	switch (job->priority) {
+	case HIGH_PRIORITY:
 		if (ListAddTail(&tp->highJobQ, temp))
 			rc = 0;
-	} else if (job->priority == MED_PRIORITY) {
+		break;
+	case MED_PRIORITY:
 		if (ListAddTail(&tp->medJobQ, temp))
 			rc = 0;
-	} else {
+		break;
+	default:
 		if (ListAddTail(&tp->lowJobQ, temp))
 			rc = 0;
 	}
@@ -960,6 +981,10 @@ int ThreadPoolShutdown(ThreadPool *tp)
 	/* clean up high priority jobs */
 	while (tp->highJobQ.size) {
 		head = ListHead(&tp->highJobQ);
+		if (head == NULL) {
+			ithread_mutex_unlock(&tp->mutex);
+			return EINVAL;
+		}
 		temp = (ThreadPoolJob *)head->item;
 		if (temp->free_func)
 			temp->free_func(temp->arg);
@@ -970,6 +995,10 @@ int ThreadPoolShutdown(ThreadPool *tp)
 	/* clean up med priority jobs */
 	while (tp->medJobQ.size) {
 		head = ListHead(&tp->medJobQ);
+		if (head == NULL) {
+			ithread_mutex_unlock(&tp->mutex);
+			return EINVAL;
+		}
 		temp = (ThreadPoolJob *)head->item;
 		if (temp->free_func)
 			temp->free_func(temp->arg);
@@ -980,6 +1009,10 @@ int ThreadPoolShutdown(ThreadPool *tp)
 	/* clean up low priority jobs */
 	while (tp->lowJobQ.size) {
 		head = ListHead(&tp->lowJobQ);
+		if (head == NULL) {
+			ithread_mutex_unlock(&tp->mutex);
+			return EINVAL;
+		}
 		temp = (ThreadPoolJob *)head->item;
 		if (temp->free_func)
 			temp->free_func(temp->arg);
@@ -1046,12 +1079,13 @@ int TPJobSetPriority(ThreadPoolJob *job, ThreadPriority priority)
 {
 	if (!job)
 		return EINVAL;
-	if (priority == LOW_PRIORITY ||
+	switch (priority) {
-	    priority == MED_PRIORITY ||
+	case LOW_PRIORITY:
-	    priority == HIGH_PRIORITY) {
+	case MED_PRIORITY:
+	case HIGH_PRIORITY:
 		job->priority = priority;
 		return 0;
-	} else {
+	default:
 		return EINVAL;
 	}
 }
@@ -1169,17 +1203,17 @@ int ThreadPoolGetStats(ThreadPool *tp, ThreadPoolStats *stats)
 
 	*stats = tp->stats;
 	if (stats->totalJobsHQ > 0)
-		stats->avgWaitHQ = stats->totalTimeHQ / stats->totalJobsHQ;
+		stats->avgWaitHQ = stats->totalTimeHQ / (double)stats->totalJobsHQ;
 	else
-		stats->avgWaitHQ = 0;
+		stats->avgWaitHQ = 0.0;
 	if (stats->totalJobsMQ > 0)
-		stats->avgWaitMQ = stats->totalTimeMQ / stats->totalJobsMQ;
+		stats->avgWaitMQ = stats->totalTimeMQ / (double)stats->totalJobsMQ;
 	else
-		stats->avgWaitMQ = 0;
+		stats->avgWaitMQ = 0.0;
 	if (stats->totalJobsLQ > 0)
-		stats->avgWaitLQ = stats->totalTimeLQ / stats->totalJobsLQ;
+		stats->avgWaitLQ = stats->totalTimeLQ / (double)stats->totalJobsLQ;
 	else
-		stats->avgWaitLQ = 0;
+		stats->avgWaitLQ = 0.0;
 	stats->totalThreads = tp->totalThreads;
 	stats->persistentThreads = tp->persistentThreads;
 	stats->currentJobsHQ = (int)ListSize(&tp->highJobQ);

threadutil/src/TimerThread.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -84,6 +85,10 @@ static void *TimerThreadWorker(
         /* Get the next event if possible. */
         if (timer->eventQ.size > 0) {
             head = ListHead( &timer->eventQ );
+            if (head == NULL) {
+                ithread_mutex_unlock( &timer->mutex );
+                return NULL;
+            }
             nextEvent = ( TimerEvent * ) head->item;
             nextEventTime = nextEvent->eventTime;
         }
@@ -128,9 +133,10 @@ static int CalculateEventTime(
 
     assert( timeout != NULL );
 
-    if (type == ABS_SEC)
+    switch (type) {
+    case ABS_SEC:
         return 0;
-    else /*if (type == REL_SEC) */{
+    default: /* REL_SEC) */
         time(&now);
         ( *timeout ) += now;
         return 0;

upnp/Makefile.am

@@ -79,17 +79,21 @@ libupnp_la_SOURCES = \
 	src/inc/webserver.h
 
 # ssdp
+if ENABLE_SSDP
 libupnp_la_SOURCES += \
         src/ssdp/ssdp_ResultData.h \
 	src/ssdp/ssdp_device.c \
 	src/ssdp/ssdp_ctrlpt.c \
 	src/ssdp/ssdp_server.c
+endif
 
 # soap
+if ENABLE_SOAP
 libupnp_la_SOURCES += \
 	src/soap/soap_device.c \
 	src/soap/soap_ctrlpt.c \
 	src/soap/soap_common.c
+endif
 
 # genlib
 libupnp_la_SOURCES += \
@@ -109,10 +113,12 @@ libupnp_la_SOURCES += \
 	src/genlib/net/uri/uri.c
 
 # gena
+if ENABLE_GENA
 libupnp_la_SOURCES += \
 	src/gena/gena_device.c \
 	src/gena/gena_ctrlpt.c \
 	src/gena/gena_callback2.c
+endif
 
 # api
 libupnp_la_SOURCES += \
@@ -129,10 +135,12 @@ endif
 
 
 # uuid
+if ENABLE_UUID
 libupnp_la_SOURCES += \
 	src/uuid/md5.c \
 	src/uuid/sysdep.c \
 	src/uuid/uuid.c
+endif
 
 
 # urlconfig

upnp/inc/UpnpGlobal.h

@@ -40,7 +40,7 @@
 	 */
 	#ifdef UPNP_USE_MSVCPP
 		/* define some things the M$ VC++ doesn't know */
-		#define UPNP_INLINE
+		#define UPNP_INLINE _inline
 		typedef __int64 int64_t;
 		#define PRId64 "I64d"
 		#define PRIzd "ld"

upnp/inc/UpnpInet.h

@@ -15,13 +15,23 @@
 
 #ifdef WIN32
 	#include <stdarg.h>
-	#include <windef.h>
+	#ifndef UPNP_USE_MSVCPP
-	#include <winbase.h>
+		/* Removed: not required (and cause compilation issues) */
+		#include <winbase.h>
+		#include <windef.h>
+	#endif
 	#include <winsock2.h>
 	#include <iphlpapi.h>
 	#include <ws2tcpip.h>
 
 	#define UpnpCloseSocket closesocket
+
+	#if(_WIN32_WINNT < 0x0600)
+		typedef short sa_family_t;
+	#else
+		typedef ADDRESS_FAMILY sa_family_t;
+	#endif
+
 #else /* WIN32 */
 	#include <sys/param.h>
 	#if defined(__sun)

upnp/inc/UpnpIntTypes.h

@@ -1,11 +1,11 @@
 #ifndef UPNPINTTYPES_H
 #define UPNPINTTYPES_H
 
-#if !defined(UPNP_USE_BCBPP) && !defined(UPNP_USE_MSVCPP)
+#if !defined(UPNP_USE_BCBPP)
 
 /* Printf format for integers. */
 #include <inttypes.h>
 
-#endif /* !defined(UPNP_USE_BCBPP) && !defined(UPNP_USE_MSVCPP) */
+#endif /* !defined(UPNP_USE_BCBPP) */
 
 #endif /* UPNPINTTYPES_H */

upnp/inc/UpnpStdInt.h

@@ -1,11 +1,20 @@
 #ifndef UPNPSTDINT_H
 #define UPNPSTDINT_H
 
-#if !defined(UPNP_USE_BCBPP) && !defined(UPNP_USE_MSVCPP)
+#if !defined(UPNP_USE_BCBPP)
 
 /* Sized integer types. */
 #include <stdint.h>
 
-#endif /* !defined(UPNP_USE_BCBPP) && !defined(UPNP_USE_MSVCPP) */
+#ifdef UPNP_USE_MSVCPP
+	/* no ssize_t defined for VC */
+	#ifdef  _WIN64
+		typedef int64_t ssize_t;
+	#else
+		typedef int32_t ssize_t;
+	#endif
+#endif
+
+#endif /* !defined(UPNP_USE_BCBPP) */
 
 #endif /* UPNPSTDINT_H */

upnp/inc/upnp.h

@@ -5,6 +5,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (C) 2011-2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -51,14 +52,17 @@
  */
 #ifdef WIN32
 	#include <time.h>
+	#ifdef UPNP_USE_MSVCPP
+		#include <sys/types.h>	/* needed for off_t */
+	#endif
 #elif (defined(BSD) && BSD >= 199306)
 	#include <time.h>
 #else
 	/* Other systems ??? */
 #endif
 
-#define LINE_SIZE  180
+#define LINE_SIZE  (size_t)180
-#define NAME_SIZE  256
+#define NAME_SIZE  (size_t)256
 #define MNFT_NAME_SIZE  64
 #define MODL_NAME_SIZE  32
 #define SERL_NUMR_SIZE  64
@@ -752,7 +756,7 @@ struct Upnp_Discovery
 	char Ext[LINE_SIZE];           
 				     
 	/** The host address of the device responding to the search. */
-	struct sockaddr_in DestAddr; 
+	struct sockaddr_storage DestAddr;
 };
 
 /** Returned along with a {\bf UPNP_EVENT_SUBSCRIBE_COMPLETE} or {\bf
@@ -1209,7 +1213,7 @@ EXPORT_SPEC int UpnpRegisterRootDevice3(
 	UpnpDevice_Handle *Hnd,
 	/*! [in] Address family of this device. Can be AF_INET for an IPv4 device, or
 	 * AF_INET6 for an IPv6 device. Defaults to AF_INET. */
-	const int  AddressFamily);
+	int  AddressFamily);
 
 /*!
  * \brief Registers a device application for a specific address family with
@@ -1259,7 +1263,7 @@ EXPORT_SPEC int UpnpRegisterRootDevice4(
 	UpnpDevice_Handle *Hnd,
 	/*! [in] Address family of this device. Can be AF_INET for an IPv4 device, or
 	 * AF_INET6 for an IPv6 device. Defaults to AF_INET. */
-	const int  AddressFamily,
+	int  AddressFamily,
 	/*! [in] Pointer to a string containing the description URL to be returned for
 	 * legacy CPs for this root device instance. */
 	const char *LowerDescUrl);
@@ -1284,6 +1288,35 @@ EXPORT_SPEC int UpnpUnRegisterRootDevice(
 	/*! [in] The handle of the root device instance to unregister. */
 	UpnpDevice_Handle Hnd);
 
+/*!
+ * \brief Unregisters a root device registered with \b UpnpRegisterRootDevice,
+ * \b UpnpRegisterRootDevice2, \b UpnpRegisterRootDevice3 or
+ * \b UpnpRegisterRootDevice4.
+ *
+ * After this call, the \b UpnpDevice_Handle is no longer valid. For all
+ * advertisements that have not yet expired, the SDK sends a device unavailable
+ * message automatically.
+ *
+ * This is a synchronous call and generates no callbacks. Once this call
+ * returns, the SDK will no longer generate callbacks to the application.
+ *
+ * This function allow a device to specify the SSDP extensions defined by UPnP
+ * Low Power.
+ *
+ * \return An integer representing one of the following:
+ *     \li \c UPNP_E_SUCCESS: The operation completed successfully.
+ *     \li \c UPNP_E_INVALID_HANDLE: The handle is not a valid device handle.
+ */
+EXPORT_SPEC int UpnpUnRegisterRootDeviceLowPower(
+        /*! [in] The handle of the root device instance to unregister. */
+        UpnpDevice_Handle Hnd,
+        /*! PowerState as defined by UPnP Low Power. */
+        int PowerState,
+        /*! SleepPeriod as defined by UPnP Low Power. */
+        int SleepPeriod,
+        /*! RegistrationState as defined by UPnP Low Power. */
+        int RegistrationState);
+
 /*!
  * \brief Registers a control point application with the UPnP Library.
  *
@@ -1438,6 +1471,36 @@ EXPORT_SPEC int UpnpSendAdvertisement(
 	/*! The expiration age, in seconds, of the announcements. */
 	int Exp);
 
+/*!
+ * \brief Sends out the discovery announcements for all devices and services
+ * for a device.
+ *
+ * Each announcement is made with the same expiration time.
+ *
+ * This is a synchronous call.
+ *
+ * This function allow a device to specify the SSDP extensions defined by UPnP
+ * Low Power.
+ *
+ * \return An integer representing one of the following:
+ *     \li \c UPNP_E_SUCCESS: The operation completed successfully.
+ *     \li \c UPNP_E_INVALID_HANDLE: The handle is not a valid
+ *             device handle.
+ *     \li \c UPNP_E_OUTOF_MEMORY: There are insufficient resources to
+ *             send future advertisements.
+ */
+EXPORT_SPEC int UpnpSendAdvertisementLowPower(
+        /*! The device handle for which to send out the announcements. */
+        UpnpDevice_Handle Hnd,
+        /*! The expiration age, in seconds, of the announcements. */
+        int Exp,
+        /*! PowerState as defined by UPnP Low Power. */
+        int PowerState,
+        /*! SleepPeriod as defined by UPnP Low Power. */
+        int SleepPeriod,
+        /*! RegistrationState as defined by UPnP Low Power. */
+        int RegistrationState);
+
 /* @} Discovery */
 
 /******************************************************************************
@@ -2727,6 +2790,21 @@ typedef int (*VDCallback_Close)(
  */
 EXPORT_SPEC int UpnpVirtualDir_set_CloseCallback(VDCallback_Close callback);
 
+/*!
+ * \brief The {\bf UpnpVirtualDirCallbacks} structure contains the pointers to
+ *  file-related callback functions a device application can register to
+ *  virtualize URLs.
+ */
+struct UpnpVirtualDirCallbacks
+{
+	VDCallback_GetInfo get_info;
+	VDCallback_Open open;
+	VDCallback_Read read;
+	VDCallback_Write write;
+	VDCallback_Seek seek;
+	VDCallback_Close close;
+};
+
 /*!
  * \brief Enables or disables the webserver.
  *
@@ -2747,6 +2825,17 @@ EXPORT_SPEC int UpnpEnableWebserver(
  */
 EXPORT_SPEC int UpnpIsWebserverEnabled(void);
 
+/*!
+ *  \brief Sets the callback functions to be used to access a virtual directory.
+ *
+ *  \return An integer representing one of the following:
+ *       \li \c UPNP_E_SUCCESS: The operation completed successfully.
+ *       \li \c UPNP_E_INVALID_PARAM: one of the callbacks is not valid.
+ */
+EXPORT_SPEC int UpnpSetVirtualDirCallbacks(
+	/*! [in] A structure that contains the callback functions. */
+	struct UpnpVirtualDirCallbacks *callbacks );
+
 /*!
  * \brief Adds a virtual directory mapping.
  *

upnp/inc/upnpconfig.h.in

@@ -99,6 +99,26 @@
 #undef UPNP_HAVE_WEBSERVER
 
 
+/** Defined to 1 if the library has been compiled with the SSDP part enabled
+ *  (i.e. configure --enable-ssdp) */
+#undef UPNP_HAVE_SSDP
+
+
+/** Defined to 1 if the library has been compiled with optional SSDP headers
+ *  support (i.e. configure --enable-optssdp) */
+#undef UPNP_HAVE_OPTSSDP
+
+
+/** Defined to 1 if the library has been compiled with the SOAP part enabled
+ *  (i.e. configure --enable-soap) */
+#undef UPNP_HAVE_SOAP
+
+
+/** Defined to 1 if the library has been compiled with the GENA part enabled
+ *  (i.e. configure --enable-gena) */
+#undef UPNP_HAVE_GENA
+
+
 /** Defined to 1 if the library has been compiled with helper API
  *  (i.e. configure --enable-tools) : <upnp/upnptools.h> file is available */
 #undef UPNP_HAVE_TOOLS

upnp/inc/upnptools.h

@@ -50,6 +50,7 @@
 
 
 #include "ixml.h" /* for IXML_Document */
+#include "upnpconfig.h"	/* for UPNP_HAVE_TOOLS */
 
 
 /* Function declarations only if tools compiled into the library */

upnp/sample/linux/tv_device_main.c

@@ -46,7 +46,11 @@ int main(int argc, char *argv[])
 #endif
 	int code;
 
-	device_main(argc, argv);
+	rc = device_main(argc, argv);
+	if (rc != UPNP_E_SUCCESS) {
+		return rc;
+	}
+
 	/* start a command loop thread */
 	code = ithread_create(&cmdloop_thread, NULL, TvDeviceCommandLoop, NULL);
 #ifdef WIN32

upnp/src/api/UpnpString.c

@@ -28,16 +28,19 @@
 	/* Other systems have strncasecmp */
 #endif
 
-/* strnlen() is a GNU extension. */
+#ifndef UPNP_USE_MSVCPP
-#if HAVE_STRNLEN
+	/* VC has strnlen which is already included but with (potentially) different linkage */
-	extern size_t strnlen(const char *s, size_t maxlen);
+	/* strnlen() is a GNU extension. */
-#else /* HAVE_STRNLEN */
+	#if HAVE_STRNLEN
-	static size_t strnlen(const char *s, size_t n)
+		extern size_t strnlen(const char *s, size_t maxlen);
-	{
+	#else /* HAVE_STRNLEN */
-		const char *p = (const char *)memchr(s, 0, n);
+		static size_t strnlen(const char *s, size_t n)
-		return p ? p - s : n;
+		{
-	}
+			const char *p = (const char *)memchr(s, 0, n);
-#endif /* HAVE_STRNLEN */
+			return p ? p - s : n;
+		}
+	#endif /* HAVE_STRNLEN */
+#endif /* WIN32 */
 
 /* strndup() is a GNU extension. */
 #if HAVE_STRNDUP && !defined(WIN32)
@@ -47,6 +50,8 @@
 	{
 		size_t strsize = strnlen(__string, __n);
 		char *newstr = (char *)malloc(strsize + 1);
+		if (newstr == NULL)
+			return NULL;
 
 		strncpy(newstr, __string, strsize);
 		newstr[strsize] = 0;
@@ -72,7 +77,7 @@ struct SUpnpString
 UpnpString *UpnpString_new()
 {
 	/* All bytes are zero, and so is the length of the string. */
-	struct SUpnpString *p = calloc(1, sizeof (struct SUpnpString));
+	struct SUpnpString *p = calloc((size_t)1, sizeof (struct SUpnpString));
 	if (p == NULL) {
 		goto error_handler1;
 	}
@@ -81,7 +86,7 @@ UpnpString *UpnpString_new()
 #endif
 
 	/* This byte is zero, calloc does initialize it. */
-	p->m_string = calloc(1, 1);
+	p->m_string = calloc((size_t)1, (size_t)1);
 	if (p->m_string == NULL) {
 		goto error_handler2;
 	}
@@ -101,7 +106,7 @@ void UpnpString_delete(UpnpString *p)
 		
 	if (!q) return;
 
-	q->m_length = 0;
+	q->m_length = (size_t)0;
 
 	free(q->m_string);
 	q->m_string = NULL;
@@ -111,7 +116,7 @@ void UpnpString_delete(UpnpString *p)
 
 UpnpString *UpnpString_dup(const UpnpString *p)
 {
-	struct SUpnpString *q = calloc(1, sizeof (struct SUpnpString));
+	struct SUpnpString *q = calloc((size_t)1, sizeof (struct SUpnpString));
 	if (q == NULL) {
 		goto error_handler1;
 	}
@@ -182,7 +187,7 @@ error_handler1:
 
 void UpnpString_clear(UpnpString *p)
 {
-	((struct SUpnpString *)p)->m_length = 0;
+	((struct SUpnpString *)p)->m_length = (size_t)0;
 	/* No need to realloc now, will do later when needed. */
 	((struct SUpnpString *)p)->m_string[0] = 0;
 }

upnp/src/api/upnpdebug.c

@@ -118,6 +118,7 @@ int DebugAtThisLevel(Upnp_LogLevel DLevel, Dbg_Module Module)
 	    (Module == DOM && DEBUG_DOM) || (Module == HTTP && DEBUG_HTTP);
 
 	return ret;
+	Module = Module; /* VC complains about this being unreferenced */
 }
 
 void UpnpPrintf(Upnp_LogLevel DLevel,

upnp/src/api/upnptools.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved.  
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -55,6 +56,9 @@
 /*! Maximum action header buffer length. */
 #define HEADER_LENGTH 2000
 
+#ifdef WIN32
+	#define snprintf _snprintf
+#endif
 
 /*!
  * \brief Structure to maintain a error code and string associated with the
@@ -157,7 +161,7 @@ int UpnpResolveURL(
 		ret = UPNP_E_INVALID_URL;
 
 ExitFunction:
-	return UPNP_E_SUCCESS;
+	return ret;
 }
 
 
@@ -177,7 +181,7 @@ int UpnpResolveURL2(
 		ret = UPNP_E_INVALID_URL;
 
 ExitFunction:
-	return UPNP_E_SUCCESS;
+	return ret;
 }
 
 
@@ -220,14 +224,18 @@ static int addToAction(
 		}
 
 		if (response) {
-			sprintf(ActBuff,
+			rc = snprintf(ActBuff, HEADER_LENGTH,
 				"<u:%sResponse xmlns:u=\"%s\">\r\n</u:%sResponse>",
 				ActionName, ServType, ActionName);
 		} else {
-			sprintf(ActBuff,
+			rc = snprintf(ActBuff, HEADER_LENGTH,
 				"<u:%s xmlns:u=\"%s\">\r\n</u:%s>",
 				ActionName, ServType, ActionName);
 		}
+		if (rc < 0 || (unsigned int) rc >= HEADER_LENGTH) {
+			free(ActBuff);
+			return UPNP_E_OUTOF_MEMORY;
+		}
 
 		rc = ixmlParseBufferEx(ActBuff, ActionDoc);
 		free(ActBuff);
@@ -282,6 +290,7 @@ static IXML_Document *makeAction(
 	IXML_Node *node;
 	IXML_Element *Ele;
 	IXML_Node *Txt = NULL;
+	int rc = 0;
 
 	if (ActionName == NULL || ServType == NULL) {
 		return NULL;
@@ -293,15 +302,16 @@ static IXML_Document *makeAction(
 	}
 
 	if (response) {
-		sprintf(ActBuff,
+		rc = snprintf(ActBuff, HEADER_LENGTH,
 			"<u:%sResponse xmlns:u=\"%s\">\r\n</u:%sResponse>",
 			ActionName, ServType, ActionName);
 	} else {
-		sprintf(ActBuff,
+		rc = snprintf(ActBuff, HEADER_LENGTH,
 			"<u:%s xmlns:u=\"%s\">\r\n</u:%s>",
 			ActionName, ServType, ActionName);
 	}
-	if (ixmlParseBufferEx(ActBuff, &ActionDoc) != IXML_SUCCESS) {
+	if (rc < 0 || (unsigned int) rc >= HEADER_LENGTH ||
+		ixmlParseBufferEx(ActBuff, &ActionDoc) != IXML_SUCCESS) {
 		free(ActBuff);
 		return NULL;
 	}

upnp/src/gena/gena_ctrlpt.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -51,6 +52,9 @@
 #include "uuid.h"
 #include "upnpapi.h"
 
+#ifdef WIN32
+	#define snprintf _snprintf
+#endif
 
 extern ithread_mutex_t GlobalClientSubscribeMutex;
 
@@ -142,6 +146,8 @@ static int ScheduleGenaAutoRenew(
 	const UpnpString *tmpSID = UpnpClientSubscription_get_SID(sub);
 	const UpnpString *tmpEventURL = UpnpClientSubscription_get_EventURL(sub);
 
+	memset(&job, 0, sizeof(job));
+
 	if (TimeOut == UPNP_INFINITE) {
 		return_code = GENA_SUCCESS;
 		goto end_function;
@@ -152,6 +158,7 @@ static int ScheduleGenaAutoRenew(
 		return_code = UPNP_E_OUTOF_MEMORY;
 		goto end_function;
 	}
+	memset(RenewEventStruct, 0, sizeof(struct Upnp_Event_Subscribe));
 
 	RenewEvent = (upnp_timeout *) malloc(sizeof(upnp_timeout));
 	if (RenewEvent == NULL) {
@@ -159,11 +166,13 @@ static int ScheduleGenaAutoRenew(
 		return_code = UPNP_E_OUTOF_MEMORY;
 		goto end_function;
 	}
+	memset(RenewEvent, 0, sizeof(upnp_timeout));
 
 	/* schedule expire event */
 	RenewEventStruct->ErrCode = UPNP_E_SUCCESS;
 	RenewEventStruct->TimeOut = TimeOut;
-	strcpy(RenewEventStruct->Sid, UpnpString_get_String(tmpSID));
+	strncpy(RenewEventStruct->Sid, UpnpString_get_String(tmpSID),
+		sizeof(RenewEventStruct->Sid) - 1);
 	strncpy(RenewEventStruct->PublisherUrl,
 		UpnpString_get_String(tmpEventURL), NAME_SIZE - 1);
 
@@ -283,6 +292,7 @@ static int gena_subscribe(
 	membuffer request;
 	uri_type dest_url;
 	http_parser_t response;
+	int rc = 0;
 
 	UpnpString_clear(sid);
 
@@ -291,12 +301,16 @@ static int gena_subscribe(
 		timeout = &local_timeout;
 	}
 	if (*timeout < 0) {
-		strcpy(timeout_str, "infinite");
+		memset(timeout_str, 0, sizeof(timeout_str));
+		strncpy(timeout_str, "infinite", sizeof(timeout_str) - 1);
 	} else if(*timeout < CP_MINIMUM_SUBSCRIPTION_TIME) {
-		sprintf(timeout_str, "%d", CP_MINIMUM_SUBSCRIPTION_TIME);
+		rc = snprintf(timeout_str, sizeof(timeout_str),
+			"%d", CP_MINIMUM_SUBSCRIPTION_TIME);
 	} else {
-		sprintf(timeout_str, "%d", *timeout);
+		rc = snprintf(timeout_str, sizeof(timeout_str), "%d", *timeout);
 	}
+	if (rc < 0 || (unsigned int) rc >= sizeof(timeout_str))
+		return UPNP_E_OUTOF_MEMORY;
 
 	/* parse url */
 	return_code = http_FixStrUrl(
@@ -512,6 +526,10 @@ int genaSubscribe(
 	UpnpString *ActualSID = UpnpString_new();
 	UpnpString *EventURL = UpnpString_new();
 	struct Handle_Info *handle_info;
+	int rc = 0;
+
+	memset(temp_sid, 0, sizeof(temp_sid));
+	memset(temp_sid2, 0, sizeof(temp_sid2));
 
 	UpnpPrintf(UPNP_INFO, GENA, __FILE__, __LINE__, "GENA SUBSCRIBE BEGIN");
 
@@ -520,9 +538,9 @@ int genaSubscribe(
 	HandleReadLock();
 	/* validate handle */
 	if (GetHandleInfo(client_handle, &handle_info) != HND_CLIENT) {
-		HandleUnlock();
+		return_code = GENA_E_BAD_HANDLE;
-
+		SubscribeLock();
-		return GENA_E_BAD_HANDLE;
+		goto error_handler;
 	}
 	HandleUnlock();
 
@@ -545,7 +563,11 @@ int genaSubscribe(
 	/* generate client SID */
 	uuid_create(&uid );
 	uuid_unpack(&uid, temp_sid);
-	sprintf(temp_sid2, "uuid:%s", temp_sid);
+	rc = snprintf(temp_sid2, sizeof(temp_sid2), "uuid:%s", temp_sid);
+	if (rc < 0 || (unsigned int) rc >= sizeof(temp_sid2)) {
+		return_code = UPNP_E_OUTOF_MEMORY;
+		goto error_handler;
+	}
 	UpnpString_set_String(out_sid, temp_sid2);
 
 	/* create event url */
@@ -567,11 +589,10 @@ int genaSubscribe(
 	return_code = ScheduleGenaAutoRenew(client_handle, *TimeOut, newSubscription);
 
 error_handler:
-	if (return_code != UPNP_E_SUCCESS) {
+	UpnpString_delete(ActualSID);
-		UpnpString_delete(ActualSID);
+	UpnpString_delete(EventURL);
-		UpnpString_delete(EventURL);
+	if (return_code != UPNP_E_SUCCESS)
 		UpnpClientSubscription_delete(newSubscription);
-	}
 	HandleUnlock();
 	SubscribeUnlock();
 
@@ -789,7 +810,9 @@ void gena_process_notification_event(
 
 	/* fill event struct */
 	tmpSID = UpnpClientSubscription_get_SID(subscription);
-	strcpy(event_struct.Sid, UpnpString_get_String(tmpSID));
+	memset(event_struct.Sid, 0, sizeof(event_struct.Sid));
+	strncpy(event_struct.Sid, UpnpString_get_String(tmpSID),
+		sizeof(event_struct.Sid) - 1);
 	event_struct.EventKey = eventKey;
 	event_struct.ChangedVariables = ChangedVars;
 

upnp/src/gena/gena_device.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -49,6 +50,10 @@
 #include "upnpapi.h"
 #include "uuid.h"
 
+#ifdef WIN32
+	#define snprintf _snprintf
+#endif
+
 /*!
  * \brief Unregisters a device.
  *
@@ -210,7 +215,7 @@ static UPNP_INLINE int notify_send_and_recv(
 		"bbb",
 		start_msg.buf, start_msg.length,
 		propertySet, strlen(propertySet),
-		CRLF, sizeof CRLF);
+		CRLF, strlen(CRLF));
 	if (ret_code) {
 		membuffer_destroy(&start_msg);
 		sock_destroy(&info, SD_BOTH);
@@ -315,6 +320,8 @@ static void genaNotifyThread(
 	struct Handle_Info *handle_info;
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	/* This should be a HandleLock and not a HandleReadLock otherwise if there
 	 * is a lot of notifications, then multiple threads will acquire a read
 	 * lock and the thread which sends the notification will be blocked forever
@@ -410,6 +417,7 @@ static char *AllocGenaHeaders(
 	char *headers = NULL;
 	size_t headers_size = 0;
 	int line = 0;
+	int rc = 0;
 
 	headers_size =
 		strlen(HEADER_LINE_1 ) +
@@ -422,7 +430,7 @@ static char *AllocGenaHeaders(
 		line = __LINE__;
 		goto ExitFunction;
 	}
-	sprintf(headers, "%s%s%"PRIzu"%s%s%s",
+	rc = snprintf(headers, headers_size, "%s%s%"PRIzu"%s%s%s",
 		HEADER_LINE_1,
 		HEADER_LINE_2A,
 		strlen(propertySet) + 1,
@@ -431,7 +439,7 @@ static char *AllocGenaHeaders(
 		HEADER_LINE_4);
 
 ExitFunction:
-	if (headers == NULL) {
+	if (headers == NULL || rc < 0 || (unsigned int) rc >= headers_size) {
 		UpnpPrintf(UPNP_ALL, GENA, __FILE__, line,
 			"AllocGenaHeaders(): Error UPNP_E_OUTOF_MEMORY\n");
 	}
@@ -463,6 +471,8 @@ int genaInitNotify(
 	struct Handle_Info *handle_info;
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	UpnpPrintf(UPNP_INFO, GENA, __FILE__, __LINE__,
 		"GENA BEGIN INITIAL NOTIFY");
 
@@ -488,8 +498,10 @@ int genaInitNotify(
 		goto ExitFunction;
 	}
 
-	strcpy(UDN_copy, UDN);
+	memset(UDN_copy, 0, strlen(UDN) + 1);
-	strcpy(servId_copy, servId);
+	strncpy(UDN_copy, UDN, strlen(UDN));
+	memset(servId_copy, 0, strlen(servId) + 1);
+	strncpy(servId_copy, servId, strlen(servId));
 
 	HandleLock();
 
@@ -553,7 +565,9 @@ int genaInitNotify(
 		thread_struct->UDN = UDN_copy;
 		thread_struct->headers = headers;
 		thread_struct->propertySet = propertySet;
-		strcpy(thread_struct->sid, sid);
+		memset(thread_struct->sid, 0, sizeof(thread_struct->sid));
+		strncpy(thread_struct->sid, sid,
+			sizeof(thread_struct->sid) - 1);
 		thread_struct->eventKey = sub->eventKey++;
 		thread_struct->reference_count = reference_count;
 		thread_struct->device_handle = device_handle;
@@ -616,6 +630,8 @@ int genaInitNotifyExt(
 	struct Handle_Info *handle_info;
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	UpnpPrintf(UPNP_INFO, GENA, __FILE__, __LINE__,
 		"GENA BEGIN INITIAL NOTIFY EXT");
 	
@@ -641,8 +657,10 @@ int genaInitNotifyExt(
 		goto ExitFunction;
 	}
 
-	strcpy(UDN_copy, UDN);
+	memset(UDN_copy, 0, strlen(UDN) + 1);
-	strcpy(servId_copy, servId);
+	strncpy(UDN_copy, UDN, strlen(UDN));
+	memset(servId_copy, 0, strlen(servId) + 1);
+	strncpy(servId_copy, servId, strlen(servId));
 
 	HandleLock();
 
@@ -707,7 +725,9 @@ int genaInitNotifyExt(
 		thread_struct->UDN = UDN_copy;
 		thread_struct->headers = headers;
 		thread_struct->propertySet = propertySet;
-		strcpy(thread_struct->sid, sid);
+		memset(thread_struct->sid, 0, sizeof(thread_struct->sid));
+		strncpy(thread_struct->sid, sid,
+			sizeof(thread_struct->sid) - 1);
 		thread_struct->eventKey = sub->eventKey++;
 		thread_struct->reference_count = reference_count;
 		thread_struct->device_handle = device_handle;
@@ -769,6 +789,8 @@ int genaNotifyAllExt(
 	struct Handle_Info *handle_info;
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	UpnpPrintf(UPNP_INFO, GENA, __FILE__, __LINE__,
 		"GENA BEGIN NOTIFY ALL EXT");
 
@@ -794,8 +816,10 @@ int genaNotifyAllExt(
 		goto ExitFunction;
 	}
 
-	strcpy(UDN_copy, UDN);
+	memset(UDN_copy, 0, strlen(UDN) + 1);
-	strcpy(servId_copy, servId);
+	strncpy(UDN_copy, UDN, strlen(UDN));
+	memset(servId_copy, 0, strlen(servId) + 1);
+	strncpy(servId_copy, servId, strlen(servId));
 
 	propertySet = ixmlPrintNode((IXML_Node *)PropSet);
 	if (propertySet == NULL) {
@@ -837,7 +861,10 @@ int genaNotifyAllExt(
 				thread_struct->servId = servId_copy;
 				thread_struct->headers = headers;
 				thread_struct->propertySet = propertySet;
-				strcpy(thread_struct->sid, finger->sid);
+				memset(thread_struct->sid, 0,
+					sizeof(thread_struct->sid));
+				strncpy(thread_struct->sid, finger->sid,
+					sizeof(thread_struct->sid) - 1);
 				thread_struct->eventKey = finger->eventKey++;
 				thread_struct->device_handle = device_handle;
 				/* if overflow, wrap to 1 */
@@ -908,6 +935,8 @@ int genaNotifyAll(
 	struct Handle_Info *handle_info;
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	UpnpPrintf(UPNP_INFO, GENA, __FILE__, __LINE__,
 		"GENA BEGIN NOTIFY ALL");
 
@@ -933,8 +962,10 @@ int genaNotifyAll(
 		goto ExitFunction;
 	}
 
-	strcpy(UDN_copy, UDN);
+	memset(UDN_copy, 0, strlen(UDN) + 1);
-	strcpy(servId_copy, servId);
+	strncpy(UDN_copy, UDN, strlen(UDN));
+	memset(servId_copy, 0, strlen(servId) + 1);
+	strncpy(servId_copy, servId, strlen(servId));
 
 	ret = GeneratePropertySet(VarNames, VarValues, var_count, &propertySet);
 	if (ret != XML_SUCCESS) {
@@ -975,7 +1006,10 @@ int genaNotifyAll(
 				thread_struct->servId = servId_copy;
 				thread_struct->headers = headers;
 				thread_struct->propertySet = propertySet;
-				strcpy(thread_struct->sid, finger->sid);
+				memset(thread_struct->sid, 0,
+					sizeof(thread_struct->sid));
+				strncpy(thread_struct->sid, finger->sid,
+					sizeof(thread_struct->sid) - 1);
 				thread_struct->eventKey = finger->eventKey++;
 				thread_struct->device_handle = device_handle;
 				/* if overflow, wrap to 1 */
@@ -1045,14 +1079,22 @@ static int respond_ok(
     int return_code;
     char timeout_str[100];
     int upnp_timeout = UPNP_TIMEOUT;
+    int rc = 0;
 
     http_CalcResponseVersion( request->major_version,
                               request->minor_version, &major, &minor );
 
     if( time_out >= 0 ) {
-        sprintf( timeout_str, "TIMEOUT: Second-%d", time_out );
+        rc = snprintf( timeout_str, sizeof ( timeout_str ),
+                       "TIMEOUT: Second-%d", time_out );
     } else {
-        strcpy( timeout_str, "TIMEOUT: Second-infinite" );
+        memset( timeout_str, 0, sizeof( timeout_str ) );
+        strncpy( timeout_str, "TIMEOUT: Second-infinite",
+                 sizeof ( timeout_str ) - 1);
+    }
+    if (rc < 0 || (unsigned int) rc >= sizeof ( timeout_str ) ) {
+        error_respond( info, HTTP_INTERNAL_SERVER_ERROR, request ); 
+        return UPNP_E_OUTOF_MEMORY;
     }
 
     membuffer_init( &response );
@@ -1184,6 +1226,9 @@ void gena_process_subscription_request(
 	char *event_url_path = NULL;
 	memptr callback_hdr;
 	memptr timeout_hdr;
+	int rc = 0;
+
+	memset(&request_struct, 0, sizeof(request_struct));
 
 	UpnpPrintf(UPNP_INFO, GENA, __FILE__, __LINE__,
 		"Subscription Request Received:\n");
@@ -1314,10 +1359,12 @@ void gena_process_subscription_request(
 	/* generate SID */
 	uuid_create(&uid);
 	uuid_unpack(&uid, temp_sid);
-	sprintf(sub->sid, "uuid:%s", temp_sid);
+	rc = snprintf(sub->sid, sizeof(sub->sid), "uuid:%s", temp_sid);
 
 	/* respond OK */
-	if (respond_ok(info, time_out, sub, request) != UPNP_E_SUCCESS) {
+	if (rc < 0 || (unsigned int) rc >= sizeof(sub->sid) ||
+		(respond_ok(info, time_out,
+		sub, request) != UPNP_E_SUCCESS)) {
 		freeSubscriptionList(sub);
 		HandleUnlock();
 		goto exit_function;
@@ -1330,7 +1377,8 @@ void gena_process_subscription_request(
 	/* finally generate callback for init table dump */
 	request_struct.ServiceId = service->serviceId;
 	request_struct.UDN = service->UDN;
-	strcpy((char *)request_struct.Sid, sub->sid);
+	strncpy((char *)request_struct.Sid, sub->sid,
+		sizeof(request_struct.Sid) - 1);
 
 	/* copy callback */
 	callback_fun = handle_info->Callback;

upnp/src/genlib/client_table/client_table.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -44,7 +45,7 @@
 
 
 #ifdef INCLUDE_CLIENT_APIS
-
+#if EXCLUDE_GENA == 0
 
 #include <stdlib.h> /* for calloc(), free() */
 
@@ -324,6 +325,6 @@ ClientSubscription *GetClientSubActualSID(ClientSubscription *head, token *sid)
 	return next;
 }
 
-
+#endif /* EXCLUDE_GENA */
- #endif /* INCLUDE_CLIENT_APIS */
+#endif /* INCLUDE_CLIENT_APIS */
 

upnp/src/genlib/miniserver/miniserver.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation
  * All rights reserved.
+ * Copyright (C) 2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -31,6 +32,8 @@
 
 #include "config.h"
 
+#if EXCLUDE_MINISERVER == 0
+
 /*!
  * \file
  *
@@ -259,6 +262,8 @@ static UPNP_INLINE void schedule_request_job(
 	struct mserv_request_t *request;
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	request = (struct mserv_request_t *)malloc(
 		sizeof (struct mserv_request_t));
 	if (request == NULL) {
@@ -329,7 +334,7 @@ static int receive_from_stopSock(SOCKET ssock, fd_set *set)
 	socklen_t clientLen;
 	struct sockaddr_storage clientAddr;
 	char requestBuf[256];
-	char buf_ntop[64];
+	char buf_ntop[INET6_ADDRSTRLEN];
 
 	if (FD_ISSET(ssock, set)) {
 		clientLen = sizeof(clientAddr);
@@ -512,6 +517,7 @@ static int get_miniserver_sockets(
 	struct sockaddr_in6* serverAddr6 = (struct sockaddr_in6*)&__ss_v6;
 	SOCKET listenfd6;
 	uint16_t actual_port6;
+	int onOff;
 #endif
 	int ret_code;
 	int reuseaddr_on = 0;
@@ -527,8 +533,17 @@ static int get_miniserver_sockets(
 #ifdef UPNP_ENABLE_IPV6
 	listenfd6 = socket(AF_INET6, SOCK_STREAM, 0);
 	if (listenfd6 == INVALID_SOCKET) {
+		sock_close(listenfd4);
 		return UPNP_E_OUTOF_SOCKET;
 	}
+	onOff = 1;
+	sockError = setsockopt(listenfd6, IPPROTO_IPV6, IPV6_V6ONLY,
+			 (char *)&onOff, sizeof(onOff));
+	if (sockError == SOCKET_ERROR) {
+		sock_close(listenfd4);
+		sock_close(listenfd6);
+		return UPNP_E_SOCKET_BIND;
+	}
 #endif
 	/* As per the IANA specifications for the use of ports by applications
 	 * override the listen port passed in with the first available. */
@@ -835,6 +850,8 @@ int StartMiniServer(
 	MiniServerSockArray *miniSocket;
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	if (gMServState != MSERV_IDLE) {
 		/* miniserver running. */
 		return UPNP_E_INTERNAL_ERROR;
@@ -955,3 +972,4 @@ int StopMiniServer()
 
 	return 0;
 }
+#endif /* EXCLUDE_MINISERVER */

upnp/src/genlib/net/http/httpparser.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -126,7 +127,7 @@ str_int_entry Http_Header_Names[NUM_HTTP_HEADER_NAMES] = {
 ************************************************************************/
 static UPNP_INLINE void scanner_init(OUT scanner_t *scanner, IN membuffer *bufptr)
 {
-	scanner->cursor = 0;
+	scanner->cursor = (size_t)0;
 	scanner->msg = bufptr;
 	scanner->entire_msg_loaded = FALSE;
 }
@@ -142,7 +143,7 @@ static UPNP_INLINE void scanner_init(OUT scanner_t *scanner, IN membuffer *bufpt
 ************************************************************************/
 static UPNP_INLINE int is_separator_char(IN char c)
 {
-    return strchr(" \t()<>@,;:\\\"/[]?={}", c) != NULL;
+    return strchr(" \t()<>@,;:\\\"/[]?={}", (int)c) != NULL;
 }
 
 /************************************************************************
@@ -248,7 +249,7 @@ static parse_status_t scanner_get_token(
 			/* possibly more valid chars */
 			return PARSE_INCOMPLETE;
 		/* calc token length */
-		token->length = (size_t)(cursor - token->buf);
+		token->length = (size_t)cursor - (size_t)token->buf;
 	} else if (c == ' ' || c == '\t') {
 		token->buf = cursor++;
 		token_type = TT_WHITESPACE;
@@ -257,7 +258,7 @@ static parse_status_t scanner_get_token(
 		if (!scanner->entire_msg_loaded && cursor == null_terminator)
 			/* possibly more chars */
 			return PARSE_INCOMPLETE;
-		token->length = (size_t)(cursor - token->buf);
+		token->length = (size_t)cursor - (size_t)token->buf;
 	} else if (c == TOKCHAR_CR) {
 		/* scan CRLF */
 		token->buf = cursor++;
@@ -267,16 +268,16 @@ static parse_status_t scanner_get_token(
 		if (*cursor != TOKCHAR_LF) {
 			/* couldn't match CRLF; match as CR */
 			token_type = TT_CTRL;	/* ctrl char */
-			token->length = 1;
+			token->length = (size_t)1;
 		} else {
 			/* got CRLF */
-			token->length = 2;
+			token->length = (size_t)2;
 			token_type = TT_CRLF;
 			cursor++;
 		}
 	} else if (c == TOKCHAR_LF) {	/* accept \n as CRLF */
 		token->buf = cursor++;
-		token->length = 1;
+		token->length = (size_t)1;
 		token_type = TT_CRLF;
 	} else if (c == '"') {
 		/* quoted text */
@@ -303,7 +304,7 @@ static parse_status_t scanner_get_token(
 				return PARSE_FAILURE;
 		}
 		if (got_end_quote)
-			token->length = (size_t)(cursor - token->buf);
+			token->length = (size_t)cursor - (size_t)token->buf;
 		else {	/* incomplete */
 
 			assert(cursor == null_terminator);
@@ -313,12 +314,12 @@ static parse_status_t scanner_get_token(
 		/* scan separator */
 		token->buf = cursor++;
 		token_type = TT_SEPARATOR;
-		token->length = 1;
+		token->length = (size_t)1;
 	} else if (is_control_char(c)) {
 		/* scan ctrl char */
 		token->buf = cursor++;
 		token_type = TT_CTRL;
-		token->length = 1;
+		token->length = (size_t)1;
 	} else
 		return PARSE_FAILURE;
 
@@ -405,7 +406,7 @@ void httpmsg_init(INOUT http_message_t *msg)
 {
     msg->initialized = 1;
     msg->entity.buf = NULL;
-    msg->entity.length = 0;
+    msg->entity.length = ( size_t ) 0;
     ListInit( &msg->headers, httpmsg_compare, httpheader_free );
     membuffer_init( &msg->msg );
     membuffer_init( &msg->status_msg );
@@ -519,11 +520,11 @@ http_header_t *httpmsg_find_hdr(
 *
 * Description :	skips blank lines at the start of a msg.
 *
-* Return : int ;
+* Return : parse_status_t ;
 *
 * Note :
 ************************************************************************/
-static UPNP_INLINE int skip_blank_lines(INOUT scanner_t *scanner)
+static UPNP_INLINE parse_status_t skip_blank_lines(INOUT scanner_t *scanner)
 {
 	memptr token;
 	token_type_t tok_type;
@@ -532,9 +533,10 @@ static UPNP_INLINE int skip_blank_lines(INOUT scanner_t *scanner)
 	/* skip ws, crlf */
 	do {
 		status = scanner_get_token(scanner, &token, &tok_type);
-	} while (status == PARSE_OK &&
+	} while (status == (parse_status_t)PARSE_OK &&
-		 (tok_type == TT_WHITESPACE || tok_type == TT_CRLF));
+		 (tok_type == (token_type_t)TT_WHITESPACE ||
-	if (status == PARSE_OK) {
+		 tok_type == (token_type_t)TT_CRLF));
+	if (status == (parse_status_t)PARSE_OK) {
 		/* pushback a non-whitespace token */
 		scanner->cursor -= token.length;
 	}
@@ -557,7 +559,7 @@ static UPNP_INLINE int skip_blank_lines(INOUT scanner_t *scanner)
 *
 * Note :
 ************************************************************************/
-static UPNP_INLINE int skip_lws(INOUT scanner_t *scanner)
+static UPNP_INLINE parse_status_t skip_lws(INOUT scanner_t *scanner)
 {
     memptr token;
     token_type_t tok_type;
@@ -571,13 +573,14 @@ static UPNP_INLINE int skip_lws(INOUT scanner_t *scanner)
 
         /* get CRLF or WS */
         status = scanner_get_token( scanner, &token, &tok_type );
-        if( status == PARSE_OK ) {
+        if( status == ( parse_status_t ) PARSE_OK ) {
-            if( tok_type == TT_CRLF ) {
+            if( tok_type == ( token_type_t ) TT_CRLF ) {
                 /* get WS */
                 status = scanner_get_token( scanner, &token, &tok_type );
             }
 
-            if( status == PARSE_OK && tok_type == TT_WHITESPACE ) {
+            if( status == ( parse_status_t ) PARSE_OK &&
+		tok_type == ( token_type_t ) TT_WHITESPACE ) {
                 matched = TRUE;
             } else {
                 /* did not match LWS; pushback token(s) */
@@ -587,7 +590,8 @@ static UPNP_INLINE int skip_lws(INOUT scanner_t *scanner)
     } while( matched );
 
     /* if entire msg is loaded, ignore an 'incomplete' warning */
-    if( status == PARSE_INCOMPLETE && scanner->entire_msg_loaded ) {
+    if( status == ( parse_status_t ) PARSE_INCOMPLETE &&
+	scanner->entire_msg_loaded ) {
         status = PARSE_OK;
     }
 
@@ -623,13 +627,14 @@ static UPNP_INLINE parse_status_t match_non_ws_string(
 
     save_cursor = scanner->cursor;
 
-    str->length = 0;
+    str->length = ( size_t ) 0;
     str->buf = scanner_get_str( scanner );  /* point to next char in input */
 
     while( !done ) {
         status = scanner_get_token( scanner, &token, &tok_type );
-        if( status == PARSE_OK &&
+        if( status == ( parse_status_t ) PARSE_OK &&
-            tok_type != TT_WHITESPACE && tok_type != TT_CRLF ) {
+            tok_type != ( token_type_t ) TT_WHITESPACE &&
+            tok_type != ( token_type_t ) TT_CRLF ) {
             /* append non-ws token */
             str->length += token.length;
         } else {
@@ -637,15 +642,16 @@ static UPNP_INLINE parse_status_t match_non_ws_string(
         }
     }
 
-    if( status == PARSE_OK ) {
+    if( status == ( parse_status_t ) PARSE_OK ) {
         /* last token was WS; push it back in */
         scanner->cursor -= token.length;
     }
     /* tolerate 'incomplete' msg */
-    if( status == PARSE_OK ||
+    if( status == ( parse_status_t ) PARSE_OK ||
-        ( status == PARSE_INCOMPLETE && scanner->entire_msg_loaded )
+        ( status == ( parse_status_t ) PARSE_INCOMPLETE &&
+        scanner->entire_msg_loaded )
          ) {
-        if( str->length == 0 ) {
+        if( str->length == ( size_t ) 0 ) {
             /* no strings found */
             return PARSE_NO_MATCH;
         } else {
@@ -686,7 +692,7 @@ static UPNP_INLINE parse_status_t match_raw_value(
     parse_status_t status;
     int done = FALSE;
     int saw_crlf = FALSE;
-    size_t pos_at_crlf = 0;
+    size_t pos_at_crlf = ( size_t ) 0;
     size_t save_pos;
     char c;
 
@@ -694,13 +700,13 @@ static UPNP_INLINE parse_status_t match_raw_value(
 
     /* value points to start of input */
     raw_value->buf = scanner_get_str( scanner );
-    raw_value->length = 0;
+    raw_value->length = ( size_t ) 0;
 
     while( !done ) {
         status = scanner_get_token( scanner, &token, &tok_type );
-        if( status == PARSE_OK ) {
+        if( status == ( parse_status_t ) PARSE_OK ) {
             if( !saw_crlf ) {
-                if( tok_type == TT_CRLF ) {
+                if( tok_type == ( token_type_t ) TT_CRLF ) {
                     /* CRLF could end value */
                     saw_crlf = TRUE;
 
@@ -711,7 +717,7 @@ static UPNP_INLINE parse_status_t match_raw_value(
                 raw_value->length += token.length;
             } else              /* already seen CRLF */
             {
-                if( tok_type == TT_WHITESPACE ) {
+                if( tok_type == ( token_type_t ) TT_WHITESPACE ) {
                     /* start again; forget CRLF */
                     saw_crlf = FALSE;
                     raw_value->length += token.length;
@@ -730,11 +736,11 @@ static UPNP_INLINE parse_status_t match_raw_value(
         }
     }
 
-    if( status == PARSE_OK ) {
+    if( status == ( parse_status_t ) PARSE_OK ) {
         /* trim whitespace on right side of value */
-        while( raw_value->length > 0 ) {
+        while( raw_value->length > ( size_t ) 0 ) {
             /* get last char */
-            c = raw_value->buf[raw_value->length - 1];
+            c = raw_value->buf[raw_value->length - ( size_t ) 1];
 
             if( c != ' ' && c != '\t' &&
                 c != TOKCHAR_CR && c != TOKCHAR_LF ) {
@@ -768,7 +774,7 @@ static UPNP_INLINE parse_status_t match_raw_value(
 *   PARSE_FAILURE		-- bad input
 *   PARSE_INCOMPLETE
 ************************************************************************/
-static UPNP_INLINE int match_int(
+static UPNP_INLINE parse_status_t match_int(
 	INOUT scanner_t *scanner,
 	IN int base,
 	OUT int *value)
@@ -782,8 +788,8 @@ static UPNP_INLINE int match_int(
 
 	save_pos = scanner->cursor;
 	status = scanner_get_token(scanner, &token, &tok_type);
-	if (status == PARSE_OK) {
+	if (status == (parse_status_t)PARSE_OK) {
-		if (tok_type == TT_IDENTIFIER) {
+		if (tok_type == (token_type_t)TT_IDENTIFIER) {
 			errno = 0;
 			num = strtol(token.buf, &end_ptr, base);
 			/* all and only those chars in token should be used for num */
@@ -798,7 +804,7 @@ static UPNP_INLINE int match_int(
 			status = PARSE_NO_MATCH;
 		}
 	}
-	if (status != PARSE_OK) {
+	if (status != (parse_status_t)PARSE_OK) {
 		/* restore scanner position for bad values */
 		scanner->cursor = save_pos;
 	}
@@ -822,7 +828,7 @@ static UPNP_INLINE int match_int(
 *   PARSE_FAILURE
 *   PARSE_INCOMPLETE
 ************************************************************************/
-static UPNP_INLINE int
+static UPNP_INLINE parse_status_t 
 read_until_crlf( INOUT scanner_t * scanner,
                  OUT memptr * str )
 {
@@ -837,9 +843,10 @@ read_until_crlf( INOUT scanner_t * scanner,
     /* read until we hit a crlf */
     do {
         status = scanner_get_token( scanner, &token, &tok_type );
-    } while( status == PARSE_OK && tok_type != TT_CRLF );
+    } while( status == ( parse_status_t ) PARSE_OK &&
+	tok_type != ( token_type_t ) TT_CRLF );
 
-    if( status == PARSE_OK ) {
+    if( status == ( parse_status_t ) PARSE_OK ) {
         /* pushback crlf in stream */
         scanner->cursor -= token.length;
 
@@ -944,7 +951,7 @@ match_char( INOUT scanner_t * scanner,
 *
 * Note :
 ************************************************************************/
-static int vfmatch(
+static parse_status_t vfmatch(
 	INOUT scanner_t *scanner,
 	IN const char *fmt,
 	va_list argp)
@@ -970,8 +977,8 @@ static int vfmatch(
     save_pos = scanner->cursor;
 
     status = PARSE_OK;
-    while( ( ( c = *fmt_ptr++ ) != 0 ) && ( status == PARSE_OK )
+    while( ( ( c = *fmt_ptr++ ) != 0 ) &&
-         ) {
+	 ( status == ( parse_status_t ) PARSE_OK ) ) {
         if( c == '%' ) {
             c = *fmt_ptr++;
             switch ( c ) {
@@ -985,7 +992,8 @@ static int vfmatch(
                     assert( str_ptr != NULL );
                     status = scanner_get_token( scanner, str_ptr,
                                                 &tok_type );
-                    if( status == PARSE_OK && tok_type != TT_IDENTIFIER ) {
+                    if( status == ( parse_status_t ) PARSE_OK &&
+			tok_type != ( token_type_t ) TT_IDENTIFIER ) {
                         /* not an identifier */
                         status = PARSE_NO_MATCH;
                     }
@@ -993,7 +1001,8 @@ static int vfmatch(
                 case 'c':      /* crlf */
                     status = scanner_get_token( scanner,
                                                 &token, &tok_type );
-                    if( status == PARSE_OK && tok_type != TT_CRLF ) {
+                    if( status == ( parse_status_t ) PARSE_OK &&
+			tok_type != ( token_type_t ) TT_CRLF ) {
                         /* not CRLF token */
                         status = PARSE_NO_MATCH;
                     }
@@ -1014,7 +1023,7 @@ static int vfmatch(
                     }
                     assert( str_ptr != NULL );
                     status = match_non_ws_string( scanner, str_ptr );
-                    if( c == 'U' && status == PARSE_OK ) {
+                    if( c == 'U' && status == ( parse_status_t ) PARSE_OK ) {
                         uri_ptr = va_arg( argp, uri_type * );
                         assert( uri_ptr != NULL );
                         stat = parse_uri( str_ptr->buf, str_ptr->length,
@@ -1043,7 +1052,8 @@ static int vfmatch(
                     str_ptr = ( memptr * ) va_arg( argp, memptr * );
                     status =
                         scanner_get_token( scanner, str_ptr, &tok_type );
-                    if( status == PARSE_OK && tok_type != TT_QUOTEDSTRING ) {
+                    if( status == ( parse_status_t ) PARSE_OK &&
+			tok_type != ( token_type_t ) TT_QUOTEDSTRING ) {
                         status = PARSE_NO_MATCH;    /* not a quoted string */
                     }
                     break;
@@ -1051,7 +1061,8 @@ static int vfmatch(
 	      	    /* optional whitespace */
                     status = scanner_get_token( scanner,
                                                 &token, &tok_type );
-                    if( status == PARSE_OK && tok_type != TT_WHITESPACE ) {
+                    if( status == ( parse_status_t ) PARSE_OK &&
+			tok_type != ( token_type_t ) TT_WHITESPACE ) {
                         /* restore non-whitespace token */
                         scanner->cursor -= token.length;
                     }
@@ -1085,7 +1096,8 @@ static int vfmatch(
                 case '\t':     /* Whitespace */
                     status = scanner_get_token( scanner,
                                                 &token, &tok_type );
-                    if( status == PARSE_OK && tok_type != TT_WHITESPACE ) {
+                    if( status == ( parse_status_t ) PARSE_OK &&
+			tok_type != (token_type_t) TT_WHITESPACE ) {
                         /* not whitespace token */
                         status = PARSE_NO_MATCH;
                     }
@@ -1097,7 +1109,7 @@ static int vfmatch(
             }
         }
     }
-    if( status != PARSE_OK ) {
+    if( status != ( parse_status_t ) PARSE_OK ) {
         /* on error, restore original scanner pos */
         scanner->cursor = save_pos;
     }
@@ -1121,12 +1133,12 @@ static int vfmatch(
 *   PARSE_NO_MATCH
 *   PARSE_INCOMPLETE
 ************************************************************************/
-static int match(
+static parse_status_t match(
 	INOUT scanner_t *scanner,
 	IN const char *fmt,
 	...)
 {
-	int ret_code;
+	parse_status_t ret_code;
 	va_list args;
 
 	va_start(args, fmt);
@@ -1153,13 +1165,13 @@ static int match(
 *   PARSE_NO_MATCH -- failure to match pattern 'fmt'
 *   PARSE_FAILURE	-- 'str' is bad input
 ************************************************************************/
-int
+parse_status_t
 matchstr( IN char *str,
           IN size_t slen,
           IN const char *fmt,
           ... )
 {
-    int ret_code;
+    parse_status_t ret_code;
     char save_char;
     scanner_t scanner;
     membuffer buf;
@@ -1242,7 +1254,7 @@ parser_parse_requestline( INOUT http_parser_t * parser )
     assert( parser->position == POS_REQUEST_LINE );
 
     status = skip_blank_lines( &parser->scanner );
-    if( status != PARSE_OK ) {
+    if( status != ( parse_status_t ) PARSE_OK ) {
         return status;
     }
     /*simple get http 0.9 as described in http 1.0 spec */
@@ -1250,7 +1262,7 @@ parser_parse_requestline( INOUT http_parser_t * parser )
     status =
         match( &parser->scanner, "%s\t%S%w%c", &method_str, &url_str );
 
-    if( status == PARSE_OK ) {
+    if( status == ( parse_status_t ) PARSE_OK ) {
 
         index =
             map_str_to_int( method_str.buf, method_str.length,
@@ -1289,7 +1301,7 @@ parser_parse_requestline( INOUT http_parser_t * parser )
     status = match( &parser->scanner,
                     "%s\t%S\t%ihttp%w/%w%L%c", &method_str, &url_str,
                     &version_str );
-    if( status != PARSE_OK ) {
+    if( status != ( parse_status_t ) PARSE_OK ) {
         return status;
     }
     /* store url */
@@ -1303,17 +1315,6 @@ parser_parse_requestline( INOUT http_parser_t * parser )
         HTTP_SUCCESS ) {
         return PARSE_FAILURE;
     }
-    /* scan version */
-    save_char = version_str.buf[version_str.length];
-    version_str.buf[version_str.length] = '\0'; /* null-terminate */
-    num_scanned = sscanf( version_str.buf, "%d . %d",
-                          &hmsg->major_version, &hmsg->minor_version );
-    version_str.buf[version_str.length] = save_char;    /* restore */
-    if( num_scanned != 2 ||
-        hmsg->major_version < 0 || hmsg->minor_version < 0 ) {
-        /* error; bad http version */
-        return PARSE_FAILURE;
-    }
 
     index =
         map_str_to_int( method_str.buf, method_str.length,
@@ -1324,7 +1325,24 @@ parser_parse_requestline( INOUT http_parser_t * parser )
         return PARSE_FAILURE;
     }
 
-    hmsg->method = Http_Method_Table[index].id;
+    /* scan version */
+    save_char = version_str.buf[version_str.length];
+    version_str.buf[version_str.length] = '\0'; /* null-terminate */
+    num_scanned = sscanf( version_str.buf, "%d . %d",
+                          &hmsg->major_version, &hmsg->minor_version );
+    version_str.buf[version_str.length] = save_char;    /* restore */
+    if (num_scanned != 2 ||
+        /* HTTP version equals to 1.0 should fail for MSEARCH as required by the
+         * UPnP certification tool */
+        hmsg->major_version < 0 ||
+	( hmsg->major_version == 1 && hmsg->minor_version < 1 &&
+	  Http_Method_Table[index].id == HTTPMETHOD_MSEARCH )) {
+        parser->http_error_code = HTTP_HTTP_VERSION_NOT_SUPPORTED;
+        /* error; bad http version */
+        return PARSE_FAILURE;
+    }
+
+    hmsg->method = ( http_method_t ) Http_Method_Table[index].id;
     parser->position = POS_HEADERS; /* move to headers */
 
     return PARSE_OK;
@@ -1357,14 +1375,14 @@ parse_status_t parser_parse_responseline(INOUT http_parser_t *parser)
 	assert(parser->position == POS_RESPONSE_LINE);
 
 	status = skip_blank_lines(&parser->scanner);
-	if (status != PARSE_OK)
+	if (status != ( parse_status_t) PARSE_OK)
 		return status;
 	/* response line */
 	/*status = match( &parser->scanner, "%ihttp%w/%w%d\t.\t%d\t%d\t%L%c", */
 	/*  &hmsg->major_version, &hmsg->minor_version, */
 	/*  &hmsg->status_code, &hmsg->status_msg ); */
 	status = match(&parser->scanner, "%ihttp%w/%w%L%c", &line);
-	if (status != PARSE_OK)
+	if (status != ( parse_status_t ) PARSE_OK)
 		return status;
 	save_char = line.buf[line.length];
 	line.buf[line.length] = '\0';	/* null-terminate */
@@ -1373,10 +1391,9 @@ parse_status_t parser_parse_responseline(INOUT http_parser_t *parser)
 			     &hmsg->major_version, &hmsg->minor_version,
 			     &hmsg->status_code);
 	line.buf[line.length] = save_char;	/* restore */
-	if (num_scanned != 3 || hmsg->major_version < 0 ||
+	if (num_scanned != 3 ||
-	    /* HTTP version equals to 1.0 should fail as required by the
+	    hmsg->major_version < 0 || hmsg->minor_version < 0 ||
-	     * UPnP certification tool */
+	    hmsg->status_code < 0)
-	    hmsg->minor_version < 1 || hmsg->status_code < 0)
 		/* bad response line */
 		return PARSE_FAILURE;
 	/* point to status msg */
@@ -1397,7 +1414,7 @@ parse_status_t parser_parse_responseline(INOUT http_parser_t *parser)
 	while (*p == ' ' || *p == '\t')
 		p++;
 	/* now, p is at start of status msg */
-	n = line.length - (size_t)(p - line.buf);
+	n = line.length - ((size_t)p - (size_t)line.buf);
 	if (membuffer_assign(&hmsg->status_msg, p, n) != 0) {
 		/* out of mem */
 		parser->http_error_code = HTTP_INTERNAL_SERVER_ERROR;
@@ -1437,33 +1454,35 @@ parse_status_t parser_parse_headers(INOUT http_parser_t *parser)
 	char save_char;
 	int ret2;
 
-	assert(parser->position == POS_HEADERS ||
+	assert(parser->position == (parser_pos_t)POS_HEADERS ||
 	       parser->ent_position == ENTREAD_CHUNKY_HEADERS);
 
 	while (TRUE) {
 		save_pos = scanner->cursor;
 		/* check end of headers */
 		status = scanner_get_token(scanner, &token, &tok_type);
-		if (status != PARSE_OK) {
+		if (status != (parse_status_t)PARSE_OK) {
 			return status;
 		}
-		if (tok_type == TT_CRLF) {
+		switch (tok_type) {
+		case TT_CRLF:
 			/* end of headers */
 			if ((parser->msg.is_request)
-			    && (parser->msg.method == HTTPMETHOD_POST)) {
+			    && (parser->msg.method == (http_method_t)HTTPMETHOD_POST)) {
 				parser->position = POS_COMPLETE;	/*post entity parsing */
 				/*is handled separately  */
 				return PARSE_SUCCESS;
 			}
 			parser->position = POS_ENTITY;	/* read entity next */
 			return PARSE_OK;
-		}
+		case TT_IDENTIFIER:
-		/* not end; read header */
+			/* not end; read header */
-		if (tok_type != TT_IDENTIFIER) {
+			break;
+		default:
 			return PARSE_FAILURE;	/* didn't see header name */
 		}
 		status = match(scanner, " : %R%c", &hdr_value);
-		if (status != PARSE_OK) {
+		if (status != (parse_status_t)PARSE_OK) {
 			/* pushback tokens; useful only on INCOMPLETE error */
 			scanner->cursor = save_pos;
 			return status;
@@ -1501,10 +1520,10 @@ parse_status_t parser_parse_headers(INOUT http_parser_t *parser)
 			membuffer_init(&header->name_buf);
 			membuffer_init(&header->value);
 			/* value can be 0 length */
-			if (hdr_value.length == 0) {
+			if (hdr_value.length == (size_t)0) {
 				/* FIXME: Is this a bug? buf is not const. */
 				hdr_value.buf = "\0";
-				hdr_value.length = 1;
+				hdr_value.length = (size_t)1;
 			}
 			/* save in header in buffers */
 			if (membuffer_assign(&header->name_buf, token.buf, token.length) ||
@@ -1519,14 +1538,14 @@ parse_status_t parser_parse_headers(INOUT http_parser_t *parser)
 			header->name_id = header_id;
 			ListAddTail(&parser->msg.headers, header);
 			/*NNS:          ret = dlist_append( &parser->msg.headers, header ); */
-/** TODO: remove that? */
+/** TODO: remove that? Yes as ret is not set anymore
 			if (ret == UPNP_E_OUTOF_MEMORY) {
 				parser->http_error_code =
 				    HTTP_INTERNAL_SERVER_ERROR;
 				return PARSE_FAILURE;
 			}
-/** end of remove that? */
+end of remove that? */
-		} else if (hdr_value.length > 0) {
+		} else if (hdr_value.length > (size_t)0) {
 			/* append value to existing header */
 			/* append space */
 			ret = membuffer_append_str(&orig_header->value, ", ");
@@ -1614,13 +1633,13 @@ static UPNP_INLINE parse_status_t parser_parse_chunky_body(
 	size_t save_pos;
 
 	/* if 'chunk_size' of bytes have been read; read next chunk */
-	if ((int)(parser->msg.msg.length - parser->scanner.cursor) >= parser->chunk_size) {
+	if ((parser->msg.msg.length - parser->scanner.cursor) >= parser->chunk_size) {
 		/* move to next chunk */
 		parser->scanner.cursor += parser->chunk_size;
 		save_pos = parser->scanner.cursor;
 		/* discard CRLF */
 		status = match(&parser->scanner, "%c");
-		if (status != PARSE_OK) {
+		if (status != (parse_status_t)PARSE_OK) {
 			/*move back */
 			parser->scanner.cursor -= parser->chunk_size;
 			/*parser->scanner.cursor = save_pos; */
@@ -1659,7 +1678,7 @@ parser_parse_chunky_headers( INOUT http_parser_t * parser )
 
     save_pos = parser->scanner.cursor;
     status = parser_parse_headers( parser );
-    if( status == PARSE_OK ) {
+    if( status == ( parse_status_t ) PARSE_OK ) {
         /* finally, done with the whole msg */
         parser->position = POS_COMPLETE;
 
@@ -1705,7 +1724,7 @@ parser_parse_chunky_entity( INOUT http_parser_t * parser )
 
     /* get size of chunk, discard extension, discard CRLF */
     status = match( scanner, "%x%L%c", &parser->chunk_size, &dummy );
-    if( status != PARSE_OK ) {
+    if( status != ( parse_status_t ) PARSE_OK ) {
         scanner->cursor = save_pos;
         UpnpPrintf( UPNP_INFO, HTTP, __FILE__, __LINE__,
             "CHUNK COULD NOT BE PARSED\n" );
@@ -1716,7 +1735,7 @@ parser_parse_chunky_entity( INOUT http_parser_t * parser )
                       ( scanner->cursor - save_pos ) );
     scanner->cursor = save_pos; /* adjust scanner too */
 
-    if( parser->chunk_size == 0 ) {
+    if( parser->chunk_size == (size_t)0 ) {
         /* done reading entity; determine length of entity */
         parser->msg.entity.length = parser->scanner.cursor -
             parser->entity_start_position + parser->msg.amount_discarded;
@@ -1789,7 +1808,7 @@ parser_get_entity_read_method( INOUT http_parser_t * parser )
 
     /* entity points to start of msg body */
     parser->msg.entity.buf = scanner_get_str( &parser->scanner );
-    parser->msg.entity.length = 0;
+    parser->msg.entity.length = ( size_t ) 0;
 
     /* remember start of body */
     parser->entity_start_position = parser->scanner.cursor;
@@ -1821,11 +1840,11 @@ parser_get_entity_read_method( INOUT http_parser_t * parser )
         if( response_code == 204 ||
             response_code == 304 ||
             ( response_code >= 100 && response_code <= 199 ) ||
-            hmsg->request_method == HTTPMETHOD_HEAD ||
+            hmsg->request_method == ( http_method_t ) HTTPMETHOD_HEAD ||
-            hmsg->request_method == HTTPMETHOD_MSEARCH ||
+            hmsg->request_method == ( http_method_t ) HTTPMETHOD_MSEARCH ||
-            hmsg->request_method == HTTPMETHOD_SUBSCRIBE ||
+            hmsg->request_method == ( http_method_t ) HTTPMETHOD_SUBSCRIBE ||
-            hmsg->request_method == HTTPMETHOD_UNSUBSCRIBE ||
+            hmsg->request_method == ( http_method_t ) HTTPMETHOD_UNSUBSCRIBE ||
-            hmsg->request_method == HTTPMETHOD_NOTIFY ) {
+            hmsg->request_method == ( http_method_t ) HTTPMETHOD_NOTIFY ) {
             parser->position = POS_COMPLETE;
             return PARSE_SUCCESS;
         }
@@ -1854,7 +1873,7 @@ parser_get_entity_read_method( INOUT http_parser_t * parser )
     if( hmsg->is_request ) {
         /* set hack flag for NOTIFY methods; if set to true this is */
         /*  a valid SSDP notify msg */
-        if( hmsg->method == HTTPMETHOD_NOTIFY ) {
+        if( hmsg->method == ( http_method_t ) HTTPMETHOD_NOTIFY ) {
             parser->valid_ssdp_notify_hack = TRUE;
         }
 
@@ -1916,7 +1935,7 @@ parser_parse_entity( INOUT http_parser_t * parser )
                 assert( 0 );
         }
 
-    } while( status == PARSE_CONTINUE_1 );
+    } while( status == ( parse_status_t ) PARSE_CONTINUE_1 );
 
     return status;
 }
@@ -1959,7 +1978,7 @@ parser_response_init( OUT http_parser_t * parser,
     parser_init( parser );
     parser->msg.is_request = FALSE;
     parser->msg.request_method = request_method;
-    parser->msg.amount_discarded = 0;
+    parser->msg.amount_discarded = (size_t)0;
     parser->position = POS_RESPONSE_LINE;
 }
 
@@ -2013,7 +2032,7 @@ parser_parse( INOUT http_parser_t * parser )
                 }
         }
 
-    } while( status == PARSE_OK );
+    } while( status == ( parse_status_t ) PARSE_OK );
 
     return status;
 
@@ -2072,7 +2091,7 @@ int raw_to_int(IN memptr *raw_value, IN int base)
 	long num;
 	char *end_ptr;
 
-	if (raw_value->length == 0)
+	if (raw_value->length == (size_t)0)
 		return -1;
 	errno = 0;
 	num = strtol(raw_value->buf, &end_ptr, base);

upnp/src/genlib/net/http/httpreadwrite.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -58,6 +59,7 @@
 #ifdef WIN32
 	#include <malloc.h>
 	#define fseeko fseek
+	#define snprintf _snprintf
 #else
 	#include <arpa/inet.h>
 	#include <sys/types.h>
@@ -74,8 +76,8 @@
 const int CHUNK_HEADER_SIZE = 10;
 const int CHUNK_TAIL_SIZE = 10;
 */
-#define CHUNK_HEADER_SIZE 10
+#define CHUNK_HEADER_SIZE (size_t)10
-#define CHUNK_TAIL_SIZE 10
+#define CHUNK_TAIL_SIZE (size_t)10
 
 #ifndef UPNP_ENABLE_BLOCKING_TCP_CONNECTIONS
 
@@ -170,13 +172,13 @@ int http_FixUrl(IN uri_type *url, OUT uri_type *fixed_url)
 	if (token_string_casecmp(&fixed_url->scheme, "http") != 0) {
 		return UPNP_E_INVALID_URL;
 	}
-	if( fixed_url->hostport.text.size == 0 ) {
+	if( fixed_url->hostport.text.size == ( size_t ) 0 ) {
 		return UPNP_E_INVALID_URL;
 	}
 	/* set pathquery to "/" if it is empty */
-	if (fixed_url->pathquery.size == 0) {
+	if (fixed_url->pathquery.size == (size_t)0) {
 		fixed_url->pathquery.buff = temp_path;
-		fixed_url->pathquery.size = 1;
+		fixed_url->pathquery.size = (size_t)1;
 	}
 
 	return UPNP_E_SUCCESS;
@@ -218,12 +220,14 @@ SOCKET http_Connect(
 	SOCKET connfd;
 	socklen_t sockaddr_len;
 	int ret_connect;
+	char errorBuffer[ERROR_BUFFER_LEN];
 
 	http_FixUrl(destination_url, url);
 
-	connfd = socket(url->hostport.IPaddress.ss_family, SOCK_STREAM, 0);
+	connfd = socket((int)url->hostport.IPaddress.ss_family,
-	if (connfd == -1) {
+		SOCK_STREAM, 0);
-		return UPNP_E_OUTOF_SOCKET;
+	if (connfd == INVALID_SOCKET) {
+		return (SOCKET)(UPNP_E_OUTOF_SOCKET);
 	}
 	sockaddr_len = (socklen_t)(url->hostport.IPaddress.ss_family == AF_INET6 ?
 		sizeof(struct sockaddr_in6) : sizeof(struct sockaddr_in));
@@ -234,9 +238,13 @@ SOCKET http_Connect(
 		UpnpPrintf(UPNP_CRITICAL, HTTP, __FILE__, __LINE__,
 			"connect error: %d\n", WSAGetLastError());
 #endif
-		shutdown(connfd, SD_BOTH);
+		if (shutdown(connfd, SD_BOTH) == -1) {
+			strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
+			UpnpPrintf(UPNP_INFO, HTTP, __FILE__, __LINE__,
+				   "Error in shutdown: %s\n", errorBuffer);
+		}
 		UpnpCloseSocket(connfd);
-		return UPNP_E_SOCKET_CONNECT;
+		return (SOCKET)(UPNP_E_SOCKET_CONNECT);
 	}
 
 	return connfd;
@@ -275,7 +283,7 @@ int http_RecvMessage(
 	int ok_on_close = FALSE;
 	char buf[2 * 1024];
 
-	if (request_method == HTTPMETHOD_UNKNOWN) {
+	if (request_method == (http_method_t)HTTPMETHOD_UNKNOWN) {
 		parser_request_init(parser);
 	} else {
 		parser_response_init(parser, request_method);
@@ -286,12 +294,13 @@ int http_RecvMessage(
 		if (num_read > 0) {
 			/* got data */
 			status = parser_append(parser, buf, (size_t)num_read);
-			if (status == PARSE_SUCCESS) {
+			switch (status) {
+			case PARSE_SUCCESS:
 				UpnpPrintf( UPNP_INFO, HTTP, __FILE__, __LINE__,
 					"<<< (RECVD) <<<\n%s\n-----------------\n",
 					parser->msg.msg.buf );
 				print_http_headers( &parser->msg );
-				if (g_maxContentLength > 0 && parser->content_length > (unsigned int)g_maxContentLength) {
+				if (g_maxContentLength > (size_t)0 && parser->content_length > (unsigned int)g_maxContentLength) {
 					*http_error_code = HTTP_REQ_ENTITY_TOO_LARGE;
 					line = __LINE__;
 					ret = UPNP_E_OUTOF_BOUNDS;
@@ -300,19 +309,22 @@ int http_RecvMessage(
 				line = __LINE__;
 				ret = 0;
 				goto ExitFunction;
-			} else if (status == PARSE_FAILURE) {
+			case PARSE_FAILURE:
 				*http_error_code = parser->http_error_code;
 				line = __LINE__;
 				ret = UPNP_E_BAD_HTTPMSG;
 				goto ExitFunction;
-			} else if (status == PARSE_INCOMPLETE_ENTITY) {
+			case PARSE_INCOMPLETE_ENTITY:
 				/* read until close */
 				ok_on_close = TRUE;
-			} else if (status == PARSE_CONTINUE_1) {
+				break;
+			case PARSE_CONTINUE_1:
 				/* Web post request. */
 				line = __LINE__;
 				ret = PARSE_SUCCESS;
 				goto ExitFunction;
+			default:
+				break;
 			}
 		} else if (num_read == 0) {
 			if (ok_on_close) {
@@ -365,10 +377,11 @@ int http_SendMessage(SOCKINFO *info, int *TimeOut, const char *fmt, ...)
 	size_t buf_length;
 	size_t num_read;
 	size_t num_written;
-	size_t amount_to_be_read = 0;
+	size_t amount_to_be_read = (size_t)0;
 	/* 10 byte allocated for chunk header. */
 	size_t Data_Buf_Size = WEB_SERVER_BUF_SIZE;
 
+	memset(Chunk_Header, 0, sizeof(Chunk_Header));
 	va_start(argp, fmt);
 	while ((c = *fmt++) != 0) {
 		if (c == 'I') {
@@ -402,12 +415,12 @@ int http_SendMessage(SOCKINFO *info, int *TimeOut, const char *fmt, ...)
 				if (virtualDirCallback.seek(Fp, Instr->RangeOffset,
 				    SEEK_CUR) != 0) {
 					RetVal = UPNP_E_FILE_READ_ERROR;
-					goto ExitFunction;
+					goto Cleanup_File;
 				}
 			} else if (Instr && Instr->IsRangeActive) {
 				if (fseeko(Fp, Instr->RangeOffset, SEEK_CUR) != 0) {
 					RetVal = UPNP_E_FILE_READ_ERROR;
-					goto ExitFunction;
+					goto Cleanup_File;
 				}
 			}
 			while (amount_to_be_read) {
@@ -419,7 +432,7 @@ int http_SendMessage(SOCKINFO *info, int *TimeOut, const char *fmt, ...)
 						nr = virtualDirCallback.read(Fp, file_buf, n);
 						num_read = (size_t)nr;
 					} else {
-						num_read = fread(file_buf, 1, n, Fp);
+						num_read = fread(file_buf, (size_t)1, n, Fp);
 					}
 					amount_to_be_read -= num_read;
 					if (Instr->ReadSendSize < 0) {
@@ -427,9 +440,9 @@ int http_SendMessage(SOCKINFO *info, int *TimeOut, const char *fmt, ...)
 						amount_to_be_read = Data_Buf_Size;
 					}
 				} else {
-					num_read = fread(file_buf, 1, Data_Buf_Size, Fp);
+					num_read = fread(file_buf, (size_t)1, Data_Buf_Size, Fp);
 				}
-				if (num_read == 0) {
+				if (num_read == (size_t)0) {
 					/* EOF so no more to send. */
 					if (Instr && Instr->IsChunkActive) {
 						const char *str = "0\r\n\r\n";
@@ -443,12 +456,20 @@ int http_SendMessage(SOCKINFO *info, int *TimeOut, const char *fmt, ...)
 				}
 				/* Create chunk for the current buffer. */
 				if (Instr && Instr->IsChunkActive) {
+					int rc;
 					/* Copy CRLF at the end of the chunk */
-					memcpy(file_buf + num_read, "\r\n", 2);
+					memcpy(file_buf + num_read, "\r\n", (size_t)2);
 					/* Hex length for the chunk size. */
-					sprintf(Chunk_Header, "%" PRIzx, num_read);
+					memset(Chunk_Header, 0,
-					/*itoa(num_read,Chunk_Header,16);  */
+						sizeof(Chunk_Header));
-					strcat(Chunk_Header, "\r\n");
+					rc = snprintf(Chunk_Header,
+						sizeof(Chunk_Header) - strlen ("\r\n"),
+						"%" PRIzx, num_read);
+					if (rc < 0 || (unsigned int) rc >= sizeof(Chunk_Header) - strlen ("\r\n")) {
+						RetVal = UPNP_E_INTERNAL_ERROR;
+						goto Cleanup_File;
+					}
+					strncat(Chunk_Header, "\r\n", strlen ("\r\n"));
 					/* Copy the chunk size header  */
 					memcpy(file_buf - strlen(Chunk_Header),
 					       Chunk_Header,
@@ -458,10 +479,10 @@ int http_SendMessage(SOCKINFO *info, int *TimeOut, const char *fmt, ...)
 					/*printf("Sending %s\n",file_buf-strlen(Chunk_Header)); */
 					nw = sock_write(info,
 						file_buf - strlen(Chunk_Header),
-						num_read + strlen(Chunk_Header) + 2,
+						num_read + strlen(Chunk_Header) + (size_t)2,
 						TimeOut);
 					num_written = (size_t)nw;
-					if (nw <= 0 || num_written != num_read + strlen(Chunk_Header) + 2)
+					if (nw <= 0 || num_written != num_read + strlen(Chunk_Header) + (size_t)2)
 						/* Send error nothing we can do. */
 						goto Cleanup_File;
 				} else {
@@ -488,12 +509,13 @@ Cleanup_File:
 			/* memory buffer */
 			buf = va_arg(argp, char *);
 			buf_length = va_arg(argp, size_t);
-			if (buf_length > 0) {
+			if (buf_length > (size_t)0) {
 				nw = sock_write(info, buf, buf_length, TimeOut);
 				num_written = (size_t)nw;
 				UpnpPrintf(UPNP_INFO, HTTP, __FILE__, __LINE__,
 					   ">>> (SENT) >>>\n"
-					   "%.*s\nbuf_length=%zd, num_written=%zd\n""------------\n",
+					   "%.*s\nbuf_length=%" PRIzd ", num_written=%" PRIzd "\n"
+					   "------------\n",
 					   (int)buf_length, buf, buf_length, num_written);
 				if (num_written != buf_length) {
 					RetVal = 0;
@@ -547,8 +569,8 @@ int http_RequestAndResponse(
 	SOCKINFO info;
 
 	tcp_connection = socket(
-		destination->hostport.IPaddress.ss_family, SOCK_STREAM, 0);
+		(int)destination->hostport.IPaddress.ss_family, SOCK_STREAM, 0);
-	if (tcp_connection == -1) {
+	if (tcp_connection == INVALID_SOCKET) {
 		parser_response_init(response, req_method);
 		return UPNP_E_SOCKET_ERROR;
 	}
@@ -624,7 +646,7 @@ int http_Download( IN const char *url_str,
 	memptr ctype;
 	size_t copy_len;
 	membuffer request;
-	char *urlPath = alloca(strlen(url_str) + 1);
+	char *urlPath = alloca(strlen(url_str) + (size_t)1);
 
 	/*ret_code = parse_uri( (char*)url_str, strlen(url_str), &url ); */
 	UpnpPrintf(UPNP_INFO, HTTP, __FILE__, __LINE__,
@@ -634,17 +656,20 @@ int http_Download( IN const char *url_str,
 		return ret_code;
 	/* make msg */
 	membuffer_init(&request);
-	strcpy(urlPath, url_str);
+	memset(urlPath, 0, strlen(url_str) + (size_t)1);
+	strncpy(urlPath, url_str, strlen(url_str));
 	hoststr = strstr(urlPath, "//");
 	if (hoststr == NULL)
 		return UPNP_E_INVALID_URL;
 	hoststr += 2;
 	temp = strchr(hoststr, '/');
-	if (temp == NULL)
+	if (temp) {
-		return UPNP_E_INVALID_URL;
+		*temp = '\0';
-	*temp = '\0';
+		hostlen = strlen(hoststr);
-	hostlen = strlen(hoststr);
+		*temp = '/';
-	*temp = '/';
+	} else {
+		hostlen = strlen(hoststr);
+	}
 	UpnpPrintf(UPNP_INFO, HTTP, __FILE__, __LINE__,
 		   "HOSTNAME : %s Length : %" PRIzu "\n", hoststr, hostlen);
 	ret_code = http_MakeMessage(&request, 1, 1,
@@ -679,15 +704,15 @@ int http_Download( IN const char *url_str,
 			*content_type = '\0';	/* no content-type */
 		} else {
 			/* safety */
-			copy_len = ctype.length < LINE_SIZE - 1 ?
+			copy_len = ctype.length < LINE_SIZE - (size_t)1 ?
-			    ctype.length : LINE_SIZE - 1;
+			    ctype.length : LINE_SIZE - (size_t)1;
 
 			memcpy(content_type, ctype.buf, copy_len);
 			content_type[copy_len] = '\0';
 		}
 	}
 	/* extract doc from msg */
-	if ((*doc_length = response.msg.entity.length) == 0) {
+	if ((*doc_length = response.msg.entity.length) == (size_t)0) {
 		/* 0-length msg */
 		*document = NULL;
 	} else if (response.msg.status_code == HTTP_OK) {
@@ -697,13 +722,18 @@ int http_Download( IN const char *url_str,
 		msg_length = response.msg.msg.length;	/* save for posterity    */
 		msg_start = membuffer_detach(&response.msg.msg);	/* whole msg */
 		/* move entity to the start; copy null-terminator too */
-		memmove(msg_start, entity_start, *doc_length + 1);
+		memmove(msg_start, entity_start, *doc_length + (size_t)1);
 		/* save mem for body only */
-		*document = realloc(msg_start, *doc_length + 1);	/*LEAK_FIX_MK */
+		*document = realloc(msg_start, *doc_length + (size_t)1);	/*LEAK_FIX_MK */
 		/* *document = Realloc( msg_start,msg_length, *doc_length + 1 ); LEAK_FIX_MK */
 		/* shrink can't fail */
 		assert(msg_length > *doc_length);
 		assert(*document != NULL);
+		if (msg_length <= *doc_length || *document == NULL)
+			UpnpPrintf(UPNP_INFO, HTTP, __FILE__, __LINE__,
+				"msg_length(%" PRIzu ") <= *doc_length(%"
+				PRIzu ") or document is NULL",
+				msg_length, *doc_length);
 	}
 	if (response.msg.status_code == HTTP_OK) {
 		ret_code = 0;	/* success */
@@ -745,8 +775,8 @@ int MakePostMessage(const char *url_str, membuffer *request,
 	uri_type *url, int contentLength, const char *contentType)
 {
 	int ret_code = 0;
-	char *urlPath = alloca(strlen(url_str) + 1);
+	char *urlPath = alloca(strlen(url_str) + (size_t)1);
-	size_t hostlen = 0;
+	size_t hostlen = (size_t)0;
 	char *hoststr;
 	char *temp;
 
@@ -757,7 +787,8 @@ int MakePostMessage(const char *url_str, membuffer *request,
 		return ret_code;
 	/* make msg */
 	membuffer_init(request);
-	strcpy(urlPath, url_str);
+	memset(urlPath, 0, strlen(url_str) + (size_t)1);
+	strncpy(urlPath, url_str, strlen(url_str));
 	hoststr = strstr(urlPath, "//");
 	if (hoststr == NULL)
 		return UPNP_E_INVALID_URL;
@@ -833,29 +864,29 @@ int http_WriteHttpPost( IN void *Handle,
 {
 	http_post_handle_t *handle = (http_post_handle_t *)Handle;
 	char *tempbuf = NULL;
-	size_t tempbufSize = 0;
+	size_t tempbufSize = (size_t)0;
 	int freeTempbuf = 0;
 	int numWritten = 0;
 
 	if (!handle || !size || !buf) {
 		if (size)
-			*size = 0;
+			*size = (size_t)0;
 		return UPNP_E_INVALID_PARAM;
 	}
 	if (handle->contentLength == UPNP_USING_CHUNKED) {
 		if (*size) {
-			size_t tempSize = 0;
+			size_t tempSize = *size +
-			tempbuf = malloc(*size +
+				CHUNK_HEADER_SIZE + CHUNK_TAIL_SIZE;
-				CHUNK_HEADER_SIZE + CHUNK_TAIL_SIZE);
+			tempbuf = malloc(tempSize);
 			if (!tempbuf)
 				return UPNP_E_OUTOF_MEMORY;
 			/* begin chunk */
-			sprintf(tempbuf, "%" PRIzx "\r\n", *size);
+			snprintf(tempbuf, tempSize, "%" PRIzx "\r\n", *size);
 			tempSize = strlen(tempbuf);
 			memcpy(tempbuf + tempSize, buf, *size);
-			memcpy(tempbuf + tempSize + *size, "\r\n", 2);
+			memcpy(tempbuf + tempSize + *size, "\r\n", (size_t)2);
 			/* end of chunk */
-			tempbufSize = tempSize + *size + 2;
+			tempbufSize = tempSize + *size + (size_t)2;
 			freeTempbuf = 1;
 		}
 	} else {
@@ -867,7 +898,7 @@ int http_WriteHttpPost( IN void *Handle,
 	if (freeTempbuf)
 		free(tempbuf);
 	if (numWritten < 0) {
-		*size = 0;
+		*size = (size_t)0;
 		return numWritten;
 	} else {
 		*size = (size_t)numWritten;
@@ -967,9 +998,9 @@ int http_OpenHttpPost(
 	if (!handle)
 		return UPNP_E_OUTOF_MEMORY;
 	handle->contentLength = contentLength;
-	tcp_connection = socket(url.hostport.IPaddress.ss_family,
+	tcp_connection = socket((int)url.hostport.IPaddress.ss_family,
 		SOCK_STREAM, 0);
-	if (tcp_connection == -1) {
+	if (tcp_connection == INVALID_SOCKET) {
 		ret_code = UPNP_E_SOCKET_ERROR;
 		goto errorHandler;
 	}
@@ -1030,10 +1061,10 @@ int MakeGetMessage(const char *url_str, const char *proxy_str,
 	membuffer *request, uri_type *url)
 {
 	int ret_code;
-	char *urlPath = alloca(strlen(url_str) + 1);
+	char *urlPath = alloca(strlen(url_str) + (size_t)1);
-	size_t querylen = 0;
+	size_t querylen = (size_t)0;
 	const char *querystr;
-	size_t hostlen = 0;
+	size_t hostlen = (size_t)0;
 	char *hoststr, *temp;
 
 	UpnpPrintf(UPNP_INFO, HTTP, __FILE__, __LINE__,
@@ -1043,7 +1074,8 @@ int MakeGetMessage(const char *url_str, const char *proxy_str,
 		return ret_code;
 	/* make msg */
 	membuffer_init(request);
-	strcpy(urlPath, url_str);
+	memset(urlPath, 0, strlen(url_str) + (size_t)1);
+	strncpy(urlPath, url_str, strlen(url_str));
 	hoststr = strstr(urlPath, "//");
 	if (hoststr == NULL)
 		return UPNP_E_INVALID_URL;
@@ -1109,13 +1141,17 @@ static int ReadResponseLineAndHeaders(
 
 	/*read response line */
 	status = parser_parse_responseline(parser);
-	if (status == PARSE_OK)
+	switch (status) {
+	case PARSE_OK:
 		done = 1;
-	else if (status == PARSE_INCOMPLETE)
+		break;
+	case PARSE_INCOMPLETE:
 		done = 0;
-	else
+		break;
+	default:
 		/*error */
 		return status;
+	}
 	while (!done) {
 		num_read = sock_read(info, buf, sizeof(buf), timeout_secs);
 		if (num_read > 0) {
@@ -1129,11 +1165,14 @@ static int ReadResponseLineAndHeaders(
 				return PARSE_FAILURE;
 			}
 			status = parser_parse_responseline(parser);
-			if (status == PARSE_OK) {
+			switch (status) {
+			case PARSE_OK:
 				done = 1;
-			} else if (status == PARSE_INCOMPLETE) {
+				break;
+			case PARSE_INCOMPLETE:
 				done = 0;
-			} else {
+				break;
+			default:
 				/*error */
 				return status;
 			}
@@ -1148,9 +1187,10 @@ static int ReadResponseLineAndHeaders(
 	}
 	done = 0;
 	status = parser_parse_headers(parser);
-	if ((status == PARSE_OK) && (parser->position == POS_ENTITY))
+	if ((status == (parse_status_t)PARSE_OK) &&
+		(parser->position == (parser_pos_t)POS_ENTITY))
 		done = 1;
-	else if (status == PARSE_INCOMPLETE)
+	else if (status == (parse_status_t)PARSE_INCOMPLETE)
 		done = 0;
 	else
 		/*error */
@@ -1168,9 +1208,10 @@ static int ReadResponseLineAndHeaders(
 				return PARSE_FAILURE;
 			}
 			status = parser_parse_headers(parser);
-			if (status == PARSE_OK && parser->position == POS_ENTITY)
+			if (status == (parse_status_t)PARSE_OK &&
+				parser->position == (parser_pos_t)POS_ENTITY)
 				done = 1;
-			else if (status == PARSE_INCOMPLETE)
+			else if (status == (parse_status_t)PARSE_INCOMPLETE)
 				done = 0;
 			else
 				/*error */
@@ -1221,31 +1262,35 @@ int http_ReadHttpGet(
 	char tempbuf[2 * 1024];
 	int ret_code = 0;
 
-	if (!handle || !size || (*size > 0 && !buf)) {
+	if (!handle || !size || (*size > (size_t)0 && !buf)) {
 		if (size)
-			*size = 0;
+			*size = (size_t)0;
 		return UPNP_E_INVALID_PARAM;
 	}
 	/* first parse what has already been gotten */
-	if (handle->response.position != POS_COMPLETE)
+	if (handle->response.position != (parser_pos_t)POS_COMPLETE)
 		status = parser_parse_entity(&handle->response);
 	else
 		status = PARSE_SUCCESS;
-	if (status == PARSE_INCOMPLETE_ENTITY)
+	switch (status) {
+	case PARSE_INCOMPLETE_ENTITY:
 		/* read until close */
 		ok_on_close = TRUE;
-	else if ((status != PARSE_SUCCESS)
+		break;
-		   && (status != PARSE_CONTINUE_1)
+	case PARSE_SUCCESS:
-		   && (status != PARSE_INCOMPLETE)) {
+	case PARSE_CONTINUE_1:
+	case PARSE_INCOMPLETE:
+		break;
+	default:
 		/*error */
-		*size = 0;
+		*size = (size_t)0;
 		return UPNP_E_BAD_RESPONSE;
 	}
 	/* read more if necessary entity */
 	while (handle->response.msg.amount_discarded + *size >
 	       handle->response.msg.entity.length &&
 	       !handle->cancel &&
-	       handle->response.position != POS_COMPLETE) {
+	       handle->response.position != (parser_pos_t)POS_COMPLETE) {
 		num_read = sock_read(&handle->sock_info, tempbuf,
 			sizeof(tempbuf), &timeout);
 		if (num_read > 0) {
@@ -1256,18 +1301,22 @@ int http_ReadHttpGet(
 				/* set failure status */
 				handle->response.http_error_code =
 				    HTTP_INTERNAL_SERVER_ERROR;
-				*size = 0;
+				*size = (size_t)0;
 				return PARSE_FAILURE;
 			}
 			status = parser_parse_entity(&handle->response);
-			if (status == PARSE_INCOMPLETE_ENTITY) {
+			switch (status) {
+			case PARSE_INCOMPLETE_ENTITY:
 				/* read until close */
 				ok_on_close = TRUE;
-			} else if ((status != PARSE_SUCCESS)
+				break;
-				   && (status != PARSE_CONTINUE_1)
+			case PARSE_SUCCESS:
-				   && (status != PARSE_INCOMPLETE)) {
+			case PARSE_CONTINUE_1:
+			case PARSE_INCOMPLETE:
+				break;
+			default:
 				/*error */
-				*size = 0;
+				*size = (size_t)0;
 				return UPNP_E_BAD_RESPONSE;
 			}
 		} else if (num_read == 0) {
@@ -1278,12 +1327,12 @@ int http_ReadHttpGet(
 				handle->response.position = POS_COMPLETE;
 			} else {
 				/* partial msg */
-				*size = 0;
+				*size = (size_t)0;
 				handle->response.http_error_code = HTTP_BAD_REQUEST;	/* or response */
 				return UPNP_E_BAD_HTTPMSG;
 			}
 		} else {
-			*size = 0;
+			*size = (size_t)0;
 			return num_read;
 		}
 	}
@@ -1296,7 +1345,7 @@ int http_ReadHttpGet(
 		*size = handle->response.msg.entity.length -
 			handle->response.msg.amount_discarded;
 	/* copy data to user buffer. delete copied data */
-	if (*size > 0) {
+	if (*size > (size_t)0) {
 		memcpy(buf, &handle->response.msg.msg.buf[handle->response.entity_start_position],
 			*size);
 		membuffer_delete(&handle->response.msg.msg,
@@ -1445,8 +1494,8 @@ int http_OpenHttpGetProxy(const char *url_str, const char *proxy_str,
 	handle->cancel = 0;
 	parser_response_init(&handle->response, HTTPMETHOD_GET);
 	tcp_connection =
-	    socket(peer->hostport.IPaddress.ss_family, SOCK_STREAM, 0);
+	    socket((int)peer->hostport.IPaddress.ss_family, SOCK_STREAM, 0);
-	if (tcp_connection == -1) {
+	if (tcp_connection == INVALID_SOCKET) {
 		ret_code = UPNP_E_SOCKET_ERROR;
 		goto errorHandler;
 	}
@@ -1472,15 +1521,18 @@ int http_OpenHttpGetProxy(const char *url_str, const char *proxy_str,
 		sock_destroy(&handle->sock_info, SD_BOTH);
 		goto errorHandler;
 	}
-	status = ReadResponseLineAndHeaders(&handle->sock_info,
+	if (ReadResponseLineAndHeaders(&handle->sock_info,
-					    &handle->response, &timeout,
+				       &handle->response, &timeout,
-					    &http_error_code);
+				       &http_error_code) != (int)PARSE_OK) {
-	if (status != PARSE_OK) {
 		ret_code = UPNP_E_BAD_RESPONSE;
 		goto errorHandler;
 	}
 	status = parser_get_entity_read_method(&handle->response);
-	if (status != PARSE_CONTINUE_1 && status != PARSE_SUCCESS) {
+	switch (status) {
+	case PARSE_CONTINUE_1:
+	case PARSE_SUCCESS:
+		break;
+	default:
 		ret_code = UPNP_E_BAD_RESPONSE;
 		goto errorHandler;
 	}
@@ -1491,7 +1543,7 @@ int http_OpenHttpGetProxy(const char *url_str, const char *proxy_str,
 		*contentType = NULL;
 	else
 		*contentType = ctype.buf;
-	if (handle->response.position == POS_COMPLETE)
+	if (handle->response.position == (parser_pos_t)POS_COMPLETE)
 		*contentLength = 0;
 	else if (handle->response.ent_position == ENTREAD_USING_CHUNKED)
 		*contentLength = UPNP_USING_CHUNKED;
@@ -1539,7 +1591,7 @@ int http_SendStatusResponse(IN SOCKINFO *info, IN int http_status_code,
 	http_CalcResponseVersion(request_major_version, request_minor_version,
 				 &response_major, &response_minor);
 	membuffer_init(&membuf);
-	membuf.size_inc = 70;
+	membuf.size_inc = (size_t)70;
 	/* response start line */
 	ret = http_MakeMessage(&membuf, response_major, response_minor, "RSCB",
 			       http_status_code, http_status_code);
@@ -1580,7 +1632,9 @@ int http_MakeMessage(membuffer *buf, int http_major_version,
 	const char *weekday_str = "Sun\0Mon\0Tue\0Wed\0Thu\0Fri\0Sat";
 	const char *month_str = "Jan\0Feb\0Mar\0Apr\0May\0Jun\0"
 	    "Jul\0Aug\0Sep\0Oct\0Nov\0Dec";
+	int rc = 0;
 
+	memset(tempbuf, 0, sizeof(tempbuf));
 	va_start(argp, fmt);
 	while ((c = *fmt++) != 0) {
 		if (c == 's') {
@@ -1610,26 +1664,29 @@ int http_MakeMessage(membuffer *buf, int http_major_version,
 			/* mem buffer */
 			s = (char *)va_arg(argp, char *);
 			UpnpPrintf(UPNP_ALL, HTTP, __FILE__, __LINE__,
-				"Adding a char Buffer starting with: %c\n", s[0]);
+				"Adding a char Buffer starting with: %c\n", (int)s[0]);
 			assert(s);
 			length = (size_t) va_arg(argp, size_t);
 			if (membuffer_append(buf, s, length))
 				goto error_handler;
 		} else if (c == 'c') {
 			/* crlf */
-			if (membuffer_append(buf, "\r\n", 2))
+			if (membuffer_append(buf, "\r\n", (size_t)2))
 				goto error_handler;
 		} else if (c == 'd') {
 			/* integer */
 			num = (size_t)va_arg(argp, int);
-			sprintf(tempbuf, "%" PRIzu, num);
+			rc = snprintf(tempbuf, sizeof(tempbuf), "%" PRIzu, num);
-			if (membuffer_append(buf, tempbuf, strlen(tempbuf)))
+			if (rc < 0 || (unsigned int) rc >= sizeof(tempbuf) ||
+				membuffer_append(buf, tempbuf, strlen(tempbuf)))
 				goto error_handler;
 		} else if (c == 'h') {
 			/* off_t */
 			bignum = (off_t) va_arg(argp, off_t);
-			sprintf(tempbuf, "%" PRId64, (int64_t) bignum);
+			rc = snprintf(tempbuf, sizeof(tempbuf), "%" PRId64,
-			if (membuffer_append(buf, tempbuf, strlen(tempbuf)))
+				(int64_t) bignum);
+			if (rc < 0 || (unsigned int) rc >= sizeof(tempbuf) ||
+				membuffer_append(buf, tempbuf, strlen(tempbuf)))
 				goto error_handler;
 		} else if (c == 't' || c == 'D') {
 			/* date */
@@ -1646,13 +1703,16 @@ int http_MakeMessage(membuffer *buf, int http_major_version,
 			}
 			assert(loc_time);
 			date = gmtime(loc_time);
-			sprintf(tempbuf,
+			if (date == NULL)
+				goto error_handler;
+			rc = snprintf(tempbuf, sizeof(tempbuf),
 				"%s%s, %02d %s %d %02d:%02d:%02d GMT%s",
 				start_str, &weekday_str[date->tm_wday * 4],
 				date->tm_mday, &month_str[date->tm_mon * 4],
 				date->tm_year + 1900, date->tm_hour,
 				date->tm_min, date->tm_sec, end_str);
-			if (membuffer_append(buf, tempbuf, strlen(tempbuf)))
+			if (rc < 0 || (unsigned int) rc >= sizeof(tempbuf) ||
+				membuffer_append(buf, tempbuf, strlen(tempbuf)))
 				goto error_handler;
 		} else if (c == 'L') {
 			/* Add CONTENT-LANGUAGE header only if WEB_SERVER_CONTENT_LANGUAGE */
@@ -1686,7 +1746,7 @@ int http_MakeMessage(membuffer *buf, int http_major_version,
 		} else if (c == 'S' || c == 'U') {
 			/* SERVER or USER-AGENT header */
 			temp_str = (c == 'S') ? "SERVER: " : "USER-AGENT: ";
-			get_sdk_info(tempbuf);
+			get_sdk_info(tempbuf, sizeof(tempbuf));
 			if (http_MakeMessage(buf, http_major_version, http_minor_version,
 					     "ss", temp_str, tempbuf) != 0)
 				goto error_handler;
@@ -1703,21 +1763,24 @@ int http_MakeMessage(membuffer *buf, int http_major_version,
 			/*   e.g.: 'HTTP/1.1 200 OK' code */
 			status_code = (int)va_arg(argp, int);
 			assert(status_code > 0);
-			sprintf(tempbuf, "HTTP/%d.%d %d ",
+			rc = snprintf(tempbuf, sizeof(tempbuf), "HTTP/%d.%d %d ",
 				http_major_version, http_minor_version,
 				status_code);
 			/* str */
 			status_msg = http_get_code_text(status_code);
-			if (http_MakeMessage(buf, http_major_version, http_minor_version,
+			if (rc < 0 || (unsigned int) rc >= sizeof(tempbuf) ||
+				http_MakeMessage(buf, http_major_version, http_minor_version,
 					     "ssc", tempbuf, status_msg) != 0)
 				goto error_handler;
 		} else if (c == 'B') {
 			/* body of a simple reply */
 			status_code = (int)va_arg(argp, int);
-			sprintf(tempbuf, "%s%d %s%s",
+			rc = snprintf(tempbuf, sizeof(tempbuf), "%s%d %s%s",
 				"<html><body><h1>",
 				status_code, http_get_code_text(status_code),
 				"</h1></body></html>");
+			if (rc < 0 || (unsigned int) rc >= sizeof(tempbuf))
+				goto error_handler;
 			bignum = (off_t)strlen(tempbuf);
 			if (http_MakeMessage(buf, http_major_version, http_minor_version,
 					     "NTcs", bignum,	/* content-length */
@@ -1830,7 +1893,7 @@ int MakeGetMessageEx( const char *url_str,
 {
 	int errCode = UPNP_E_SUCCESS;
 	char *urlPath = NULL;
-	size_t hostlen = 0;
+	size_t hostlen = (size_t)0;
 	char *hoststr, *temp;
 
 	do {
@@ -1843,13 +1906,13 @@ int MakeGetMessageEx( const char *url_str,
 		}
 		/* make msg */
 		membuffer_init(request);
-		urlPath = alloca(strlen(url_str) + 1);
+		urlPath = alloca(strlen(url_str) + (size_t)1);
 		if (!urlPath) {
 			errCode = UPNP_E_OUTOF_MEMORY;
 			break;
 		}
-		memset(urlPath, 0, strlen(url_str) + 1);
+		memset(urlPath, 0, strlen(url_str) + (size_t)1);
-		strcpy(urlPath, url_str);
+		strncpy(urlPath, url_str, strlen(url_str));
 		hoststr = strstr(urlPath, "//");
 		if (hoststr == NULL) {
 			errCode = UPNP_E_INVALID_URL;
@@ -1934,6 +1997,9 @@ int http_OpenHttpGetEx(
 	int errCode = UPNP_E_SUCCESS;
 	/* char rangeBuf[SIZE_RANGE_BUFFER]; */
 	struct SendInstruction rangeBuf;
+	int rc = 0;
+
+	membuffer_init(&request);
 
 	do {
 		/* Checking Input parameters */
@@ -1951,8 +2017,10 @@ int http_OpenHttpGetEx(
 			break;
 		}
 		memset(&rangeBuf, 0, sizeof(rangeBuf));
-		sprintf(rangeBuf.RangeHeader,
+		rc = snprintf(rangeBuf.RangeHeader, sizeof(rangeBuf.RangeHeader),
 			"Range: bytes=%d-%d\r\n", lowRange, highRange);
+		if (rc < 0 || (unsigned int) rc >= sizeof(rangeBuf.RangeHeader))
+			break;
 		membuffer_init(&request);
 		errCode = MakeGetMessageEx(url_str, &request, &url, &rangeBuf);
 		if (errCode != UPNP_E_SUCCESS)
@@ -1964,8 +2032,9 @@ int http_OpenHttpGetEx(
 		}
 		memset(handle, 0, sizeof(*handle));
 		parser_response_init(&handle->response, HTTPMETHOD_GET);
-		tcp_connection = socket(url.hostport.IPaddress.ss_family, SOCK_STREAM, 0);
+		tcp_connection = socket((int)url.hostport.IPaddress.ss_family,
-		if (tcp_connection == -1) {
+			SOCK_STREAM, 0);
+		if (tcp_connection == INVALID_SOCKET) {
 			errCode = UPNP_E_SOCKET_ERROR;
 			free(handle);
 			break;
@@ -1995,15 +2064,15 @@ int http_OpenHttpGetEx(
 			free(handle);
 			break;
 		}
-		status = ReadResponseLineAndHeaders(&handle->sock_info,
+		if (ReadResponseLineAndHeaders(&handle->sock_info,
-			&handle->response, &timeout, &http_error_code);
+			&handle->response, &timeout, &http_error_code) != (int)PARSE_OK) {
-		if (status != PARSE_OK) {
 			errCode = UPNP_E_BAD_RESPONSE;
 			free(handle);
 			break;
 		}
 		status = parser_get_entity_read_method(&handle->response);
-		if (status != PARSE_CONTINUE_1 && status != PARSE_SUCCESS) {
+		if (status != (parse_status_t)PARSE_CONTINUE_1 &&
+			status != (parse_status_t)PARSE_SUCCESS) {
 			errCode = UPNP_E_BAD_RESPONSE;
 			free(handle);
 			break;
@@ -2016,7 +2085,7 @@ int http_OpenHttpGetEx(
 			*contentType = NULL;
 		else
 			*contentType = ctype.buf;
-		if (handle->response.position == POS_COMPLETE)
+		if (handle->response.position == (parser_pos_t)POS_COMPLETE)
 			*contentLength = 0;
 		else if(handle->response.ent_position == ENTREAD_USING_CHUNKED)
 			*contentLength = UPNP_USING_CHUNKED;
@@ -2038,6 +2107,7 @@ int http_OpenHttpGetEx(
  *
  * Parameters:
  *	OUT char *info;	buffer to store the operating system information
+ *	IN size_t infoSize; size of buffer
  *
  * Description:
  *	Returns the server information for the operating system
@@ -2046,14 +2116,14 @@ int http_OpenHttpGetEx(
  *	UPNP_INLINE void
  ************************************************************************/
 /* 'info' should have a size of at least 100 bytes */
-void get_sdk_info(OUT char *info)
+void get_sdk_info(OUT char *info, IN size_t infoSize)
 {
 #ifdef WIN32
 	OSVERSIONINFO versioninfo;
 	versioninfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
 
 	if (GetVersionEx(&versioninfo) != 0)
-		sprintf(info,
+		snprintf(info, infoSize,
 			"%d.%d.%d %d/%s, UPnP/1.0, Portable SDK for UPnP devices/"
 			PACKAGE_VERSION "\r\n", versioninfo.dwMajorVersion,
 			versioninfo.dwMinorVersion, versioninfo.dwBuildNumber,
@@ -2067,7 +2137,7 @@ void get_sdk_info(OUT char *info)
 	ret_code = uname(&sys_info);
 	if (ret_code == -1)
 		*info = '\0';
-	sprintf(info,
+	snprintf(info, infoSize,
 		"%s/%s, UPnP/1.0, Portable SDK for UPnP devices/"
 		PACKAGE_VERSION "\r\n", sys_info.sysname, sys_info.release);
 #endif

upnp/src/genlib/net/http/parsetools.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation
  * All rights reserved.
+ * Copyright (c) 2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -51,9 +52,13 @@ int has_xml_content_type(http_message_t *hmsg)
 	assert(hmsg);
 
 	/* find 'content-type' header which must have text/xml */
-	if (httpmsg_find_hdr(hmsg, HDR_CONTENT_TYPE, &hdr_value) &&
+	if (httpmsg_find_hdr(hmsg, HDR_CONTENT_TYPE, &hdr_value)) {
-	    matchstr(hdr_value.buf, hdr_value.length, "%itext%w/%wxml" ) == PARSE_OK) {
+		switch (matchstr(hdr_value.buf, hdr_value.length, "%itext%w/%wxml" )) {
-		return TRUE;
+		case PARSE_OK:
+			return TRUE;
+		default:
+			break;
+		}
 	}
 	return FALSE;
 }

upnp/src/genlib/net/http/statcodes.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation
  * All rights reserved.
+ * Copyright (c) 2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -128,7 +129,7 @@ init_table( IN const char *encoded_str,
 
     for( i = 0; i < tbl_size; i++ ) {
         table[i] = s;
-        s += strlen( s ) + 1;   /* next entry */
+        s += strlen( s ) + (size_t)1;   /* next entry */
     }
 }
 
@@ -179,7 +180,7 @@ http_get_code_text( int statusCode )
         init_tables();
     }
 
-    if( statusCode < 100 && statusCode >= 600 ) {
+    if( statusCode < 100 || statusCode >= 600 ) {
         return NULL;
     }
 

upnp/src/genlib/net/http/webserver.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -38,6 +39,8 @@
 
 #include "config.h"
 
+#if EXCLUDE_WEB_SERVER == 0
+
 #include "webserver.h"
 
 #include "httpparser.h"
@@ -59,6 +62,10 @@
 #include <fcntl.h>
 #include <sys/stat.h>
 
+#ifdef WIN32
+	 #define snprintf _snprintf
+#endif
+
 /*!
  * Response Types.
  */
@@ -299,6 +306,7 @@ static UPNP_INLINE int get_content_type(
 	int ctype_found = FALSE;
 	char *temp = NULL;
 	size_t length = 0;
+	int rc = 0;
 
 	(*content_type) = NULL;
 	/* get ext */
@@ -315,7 +323,11 @@ static UPNP_INLINE int get_content_type(
 	temp = malloc(length);
 	if (!temp)
 		return UPNP_E_OUTOF_MEMORY;
-	sprintf(temp, "%s/%s", type, subtype);
+	rc = snprintf(temp, length, "%s/%s", type, subtype);
+	if (rc < 0 || (unsigned int) rc >= length) {
+		free(temp);
+		return UPNP_E_OUTOF_MEMORY;
+	}
 	(*content_type) = ixmlCloneDOMString(temp);
 	free(temp);
 	if (!content_type)
@@ -501,6 +513,7 @@ static int get_file_info(
 	FILE *fp;
 	int rc = 0;
 
+	ixmlFreeDOMString(info->content_type);	
 	info->content_type = NULL;
 	code = stat(filename, &s);
 	if (code == -1)
@@ -759,6 +772,7 @@ static int CreateHTTPRangeResponseHeader(
 	off_t FirstByte, LastByte;
 	char *RangeInput;
 	char *Ptr;
+	int rc = 0;
 
 	Instr->IsRangeActive = 1;
 	Instr->ReadSendSize = FileLength;
@@ -767,7 +781,8 @@ static int CreateHTTPRangeResponseHeader(
 	RangeInput = malloc(strlen(ByteRangeSpecifier) + 1);
 	if (!RangeInput)
 		return UPNP_E_OUTOF_MEMORY;
-	strcpy(RangeInput, ByteRangeSpecifier);
+	memset(RangeInput, 0, strlen(ByteRangeSpecifier) + 1);
+	strncpy(RangeInput, ByteRangeSpecifier, strlen(ByteRangeSpecifier));
 	/* CONTENT-RANGE: bytes 222-3333/4000  HTTP_PARTIAL_CONTENT */
 	if (StrStr(RangeInput, "bytes") == NULL ||
 	    (Ptr = StrStr(RangeInput, "=")) == NULL) {
@@ -792,27 +807,38 @@ static int CreateHTTPRangeResponseHeader(
 			Instr->RangeOffset = FirstByte;
 			Instr->ReadSendSize = LastByte - FirstByte + 1;
 			/* Data between two range. */
-			sprintf(Instr->RangeHeader,
+			rc = snprintf(Instr->RangeHeader,
+				sizeof(Instr->RangeHeader),
 				"CONTENT-RANGE: bytes %" PRId64
 				"-%" PRId64 "/%" PRId64 "\r\n",
 				(int64_t)FirstByte,
 				(int64_t)LastByte,
 				(int64_t)FileLength);
+			if (rc < 0 || (unsigned int) rc >= sizeof(Instr->RangeHeader)) {
+				free(RangeInput);
+				return UPNP_E_OUTOF_MEMORY;
+			}
 		} else if (FirstByte >= 0 && LastByte == -1
 			   && FirstByte < FileLength) {
 			Instr->RangeOffset = FirstByte;
 			Instr->ReadSendSize = FileLength - FirstByte;
-			sprintf(Instr->RangeHeader,
+			rc = snprintf(Instr->RangeHeader,
+				sizeof(Instr->RangeHeader),
 				"CONTENT-RANGE: bytes %" PRId64
 				"-%" PRId64 "/%" PRId64 "\r\n",
 				(int64_t)FirstByte,
 				(int64_t)(FileLength - 1),
 				(int64_t)FileLength);
+			if (rc < 0 || (unsigned int) rc >= sizeof(Instr->RangeHeader)) {
+				free(RangeInput);
+				return UPNP_E_OUTOF_MEMORY;
+			}
 		} else if (FirstByte == -1 && LastByte > 0) {
 			if (LastByte >= FileLength) {
 				Instr->RangeOffset = 0;
 				Instr->ReadSendSize = FileLength;
-				sprintf(Instr->RangeHeader,
+				rc = snprintf(Instr->RangeHeader,
+					sizeof(Instr->RangeHeader),
 					"CONTENT-RANGE: bytes 0-%" PRId64
 					"/%" PRId64 "\r\n",
 					(int64_t)(FileLength - 1),
@@ -820,13 +846,18 @@ static int CreateHTTPRangeResponseHeader(
 			} else {
 				Instr->RangeOffset = FileLength - LastByte;
 				Instr->ReadSendSize = LastByte;
-				sprintf(Instr->RangeHeader,
+				rc = snprintf(Instr->RangeHeader,
+					sizeof(Instr->RangeHeader),
 					"CONTENT-RANGE: bytes %" PRId64
 					"-%" PRId64 "/%" PRId64 "\r\n",
 					(int64_t)(FileLength - LastByte + 1),
 					(int64_t)FileLength,
 					(int64_t)FileLength);
 			}
+			if (rc < 0 || (unsigned int) rc >= sizeof(Instr->RangeHeader)) {
+				free(RangeInput);
+				return UPNP_E_OUTOF_MEMORY;
+			}
 		} else {
 			free(RangeInput);
 			return HTTP_REQUEST_RANGE_NOT_SATISFIABLE;
@@ -863,8 +894,9 @@ static int CheckOtherHTTPHeaders(
 	/*NNS: dlist_node* node; */
 	int index, RetCode = HTTP_OK;
 	char *TmpBuf;
+	size_t TmpBufSize = LINE_SIZE;
 
-	TmpBuf = (char *)malloc(LINE_SIZE);
+	TmpBuf = (char *)malloc(TmpBufSize);
 	if (!TmpBuf)
 		return UPNP_E_OUTOF_MEMORY;
 	node = ListHead(&Req->headers);
@@ -874,9 +906,10 @@ static int CheckOtherHTTPHeaders(
 		index = map_str_to_int((const char *)header->name.buf,
 				header->name.length, Http_Header_Names,
 				NUM_HTTP_HEADER_NAMES, FALSE);
-		if (header->value.length >= LINE_SIZE) {
+		if (header->value.length >= TmpBufSize) {
 			free(TmpBuf);
-			TmpBuf = (char *)malloc(header->value.length + 1);
+			TmpBufSize = header->value.length + 1;
+			TmpBuf = (char *)malloc(TmpBufSize);
 			if (!TmpBuf)
 				return UPNP_E_OUTOF_MEMORY;
 		}
@@ -908,8 +941,14 @@ static int CheckOtherHTTPHeaders(
 				}
 				break;
 			case HDR_ACCEPT_LANGUAGE:
-				memcpy(RespInstr->AcceptLanguageHeader, TmpBuf,
+				if (header->value.length + 1 > sizeof(RespInstr->AcceptLanguageHeader)) {
-				       sizeof(RespInstr->AcceptLanguageHeader) - 1);
+					size_t length = sizeof(RespInstr->AcceptLanguageHeader) - 1;
+					memcpy(RespInstr->AcceptLanguageHeader, TmpBuf, length);
+					RespInstr->AcceptLanguageHeader[length] = '\0';
+				} else {
+					memcpy(RespInstr->AcceptLanguageHeader, TmpBuf,
+						header->value.length + 1);
+				}
 				break;
 			default:
 				/*
@@ -1001,6 +1040,7 @@ static int process_request(
 	       req->method == HTTPMETHOD_POST ||
 	       req->method == HTTPMETHOD_SIMPLEGET);
 	/* init */
+	memset(&finfo, 0, sizeof(finfo));
 	request_doc = NULL;
 	finfo.content_type = NULL;
 	alias_grabbed = FALSE;
@@ -1308,7 +1348,7 @@ static int http_RecvPostMessage(
 	int ok_on_close = FALSE;
 	size_t entity_offset = 0;
 	int num_read = 0;
-	int ret_code = 0;
+	int ret_code = HTTP_OK;
 
 	if (Instr && Instr->IsVirtualFile) {
 		Fp = (virtualDirCallback.open) (filename, UPNP_WRITE);
@@ -1331,8 +1371,8 @@ static int http_RecvPostMessage(
 			   && (status != PARSE_CONTINUE_1)
 			   && (status != PARSE_INCOMPLETE)) {
 			/* error */
-			fclose(Fp);
+			ret_code = HTTP_BAD_REQUEST;
-			return HTTP_BAD_REQUEST;
+			goto ExitFunction;
 		}
 		/* read more if necessary entity */
 		while (entity_offset + Data_Buf_Size > parser->msg.entity.length &&
@@ -1340,13 +1380,13 @@ static int http_RecvPostMessage(
 			num_read = sock_read(info, Buf, sizeof(Buf), &Timeout);
 			if (num_read > 0) {
 				/* append data to buffer */
-				ret_code = membuffer_append(&parser->msg.msg,
+				if (membuffer_append(&parser->msg.msg,
-					Buf, (size_t)num_read);
+					Buf, (size_t)num_read) != 0) {
-				if (ret_code != 0) {
 					/* set failure status */
 					parser->http_error_code =
 					    HTTP_INTERNAL_SERVER_ERROR;
-					return HTTP_INTERNAL_SERVER_ERROR;
+					ret_code = HTTP_INTERNAL_SERVER_ERROR;
+					goto ExitFunction;
 				}
 				status = parser_parse_entity(parser);
 				if (status == PARSE_INCOMPLETE_ENTITY) {
@@ -1355,7 +1395,8 @@ static int http_RecvPostMessage(
 				} else if ((status != PARSE_SUCCESS)
 					   && (status != PARSE_CONTINUE_1)
 					   && (status != PARSE_INCOMPLETE)) {
-					return HTTP_BAD_REQUEST;
+					ret_code = HTTP_BAD_REQUEST;
+					goto ExitFunction;
 				}
 			} else if (num_read == 0) {
 				if (ok_on_close) {
@@ -1367,10 +1408,12 @@ static int http_RecvPostMessage(
 				} else {
 					/* partial msg or response */
 					parser->http_error_code = HTTP_BAD_REQUEST;
-					return HTTP_BAD_REQUEST;
+					ret_code = HTTP_BAD_REQUEST;
+					goto ExitFunction;
 				}
 			} else {
-				return num_read;
+				ret_code = num_read;
+				goto ExitFunction;
 			}
 		}
 		if ((entity_offset + Data_Buf_Size) > parser->msg.entity.length) {
@@ -1384,25 +1427,26 @@ static int http_RecvPostMessage(
 		if (Instr->IsVirtualFile) {
 			int n = virtualDirCallback.write(Fp, Buf, Data_Buf_Size);
 			if (n < 0) {
-				virtualDirCallback.close(Fp);
+				ret_code = HTTP_INTERNAL_SERVER_ERROR;
-				return HTTP_INTERNAL_SERVER_ERROR;
+				goto ExitFunction;
 			}
 		} else {
 			size_t n = fwrite(Buf, 1, Data_Buf_Size, Fp);
 			if (n != Data_Buf_Size) {
-				fclose(Fp);
+				ret_code = HTTP_INTERNAL_SERVER_ERROR;
-				return HTTP_INTERNAL_SERVER_ERROR;
+				goto ExitFunction;
 			}
 		}
 	} while (parser->position != POS_COMPLETE ||
 		 entity_offset != parser->msg.entity.length);
-	if (Instr->IsVirtualFile) {
+ExitFunction:
+	if (Instr && Instr->IsVirtualFile) {
 		virtualDirCallback.close(Fp);
 	} else {
 		fclose(Fp);
 	}
 
-	return HTTP_OK;
+	return ret_code;
 }
 
 void web_server_callback(http_parser_t *parser, INOUT http_message_t *req,
@@ -1488,4 +1532,5 @@ void web_server_callback(http_parser_t *parser, INOUT http_message_t *req,
 	membuffer_destroy(&headers);
 	membuffer_destroy(&filename);
 }
+#endif /* EXCLUDE_WEB_SERVER */
 

upnp/src/genlib/net/sock.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -45,6 +46,10 @@
 
 #include "unixutil.h"	/* for socklen_t, EAFNOSUPPORT */
 #include "upnp.h"
+#include "UpnpStdInt.h" /* for ssize_t */
+
+#include "upnpdebug.h"
+#include "upnputil.h"
 
 #include <assert.h>
 #include <errno.h>
@@ -85,13 +90,18 @@ int sock_init_with_ip(SOCKINFO *info, SOCKET sockfd,
 int sock_destroy(SOCKINFO *info, int ShutdownMethod)
 {
 	int ret = UPNP_E_SUCCESS;
+	char errorBuffer[ERROR_BUFFER_LEN];
 
-	if (info->socket != -1) {
+	if (info->socket != INVALID_SOCKET) {
-		shutdown(info->socket, ShutdownMethod);
+		if (shutdown(info->socket, ShutdownMethod) == -1) {
+			strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
+			UpnpPrintf(UPNP_INFO, HTTP, __FILE__, __LINE__,
+				   "Error in shutdown: %s\n", errorBuffer);
+		}
 		if (sock_close(info->socket) == -1) {
 			ret = UPNP_E_SOCKET_ERROR;
 		}
-		info->socket = -1;
+		info->socket = INVALID_SOCKET;
 	}
 
 	return ret;
@@ -112,7 +122,7 @@ static int sock_read_write(
 	/*! [out] Buffer to get data to or send data from. */
 	char *buffer,
 	/*! [in] Size of the buffer. */
-	int bufsize,
+	size_t bufsize,
 	/*! [in] timeout value. */
 	int *timeoutSecs,
 	/*! [in] Boolean value specifying read or write option. */
@@ -126,8 +136,8 @@ static int sock_read_write(
 	time_t start_time = time(NULL);
 	SOCKET sockfd = info->socket;
 	long bytes_sent = 0;
-	long byte_left = 0;
+	size_t byte_left = (size_t)0;
-	long num_written;
+	ssize_t num_written;
 
 	if (*timeoutSecs < 0)
 		return UPNP_E_TIMEDOUT;
@@ -166,14 +176,14 @@ static int sock_read_write(
 #endif
 		if (bRead) {
 			/* read data. */
-			numBytes = (long)recv(sockfd, buffer, (size_t)bufsize, MSG_NOSIGNAL);
+			numBytes = (long)recv(sockfd, buffer, bufsize, MSG_NOSIGNAL);
 		} else {
 			byte_left = bufsize;
 			bytes_sent = 0;
-			while (byte_left > 0) {
+			while (byte_left != (size_t)0) {
 				/* write data. */
 				num_written = send(sockfd,
-					buffer + bytes_sent, (size_t)byte_left,
+					buffer + bytes_sent, byte_left,
 					MSG_DONTROUTE | MSG_NOSIGNAL);
 				if (num_written == -1) {
 #ifdef SO_NOSIGPIPE
@@ -182,7 +192,7 @@ static int sock_read_write(
 #endif
 					return (int)num_written;
 				}
-				byte_left = byte_left - num_written;
+				byte_left -= (size_t)num_written;
 				bytes_sent += num_written;
 			}
 			numBytes = bytes_sent;
@@ -200,12 +210,12 @@ static int sock_read_write(
 	return (int)numBytes;
 }
 
-int sock_read(SOCKINFO *info, char *buffer, int bufsize, int *timeoutSecs)
+int sock_read(SOCKINFO *info, char *buffer, size_t bufsize, int *timeoutSecs)
 {
 	return sock_read_write(info, buffer, bufsize, timeoutSecs, TRUE);
 }
 
-int sock_write(SOCKINFO *info, const char *buffer, int bufsize, int *timeoutSecs)
+int sock_write(SOCKINFO *info, const char *buffer, size_t bufsize, int *timeoutSecs)
 {
 	/* Consciently removing constness. */
 	return sock_read_write(info, (char *)buffer, bufsize, timeoutSecs, FALSE);

upnp/src/genlib/net/uri/uri.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -43,6 +44,9 @@
 		#include <lwres/netdb.h>
 	#endif
 #endif
+#ifdef WIN32
+	#define snprintf _snprintf
+#endif
 #include <assert.h>
 
 
@@ -65,7 +69,7 @@ static int is_reserved(
 	/*! [in] Char to be matched for RESERVED characters. */
 	char in)
 {
-	if (strchr(RESERVED, in)) {
+	if (strchr(RESERVED, (int)in)) {
 		return 1;
 	} else {
 		return 0;
@@ -83,7 +87,7 @@ int is_mark(
 	/*! [in] Char to be matched for MARKED characters. */
 	char in)
 {
-	if (strchr(MARK, in)) {
+	if (strchr(MARK, (int)in)) {
 		return 1;
 	} else {
 		return 0;
@@ -132,17 +136,17 @@ int replace_escaped(char *in, size_t index, size_t *max)
 {
 	int tempInt = 0;
 	char tempChar = 0;
-	size_t i = 0;
+	size_t i = (size_t)0;
-	size_t j = 0;
+	size_t j = (size_t)0;
 
-	if (in[index] == '%' && isxdigit(in[index + 1]) && isxdigit(in[index + 2])) {
+	if (in[index] == '%' && isxdigit(in[index + (size_t)1]) && isxdigit(in[index + (size_t)2])) {
 		/* Note the "%2x", makes sure that we convert a maximum of two
 		 * characters. */
-		if (sscanf(&in[index + 1], "%2x", &tempInt) != 1) {
+		if (sscanf(&in[index + (size_t)1], "%2x", &tempInt) != 1) {
 			return 0;
 		}
 		tempChar = (char)tempInt;
-		for (i = index + 3, j = index; j < *max; i++, j++) {
+		for (i = index + (size_t)3, j = index; j < *max; i++, j++) {
 			in[j] = tempChar;
 			if (i < *max) {
 				tempChar = in[i];
@@ -150,7 +154,7 @@ int replace_escaped(char *in, size_t index, size_t *max)
 				tempChar = 0;
 			}
 		}
-		*max -= 2;
+		*max -= (size_t)2;
 		return 1;
 	} else {
 		return 0;
@@ -172,12 +176,12 @@ static size_t parse_uric(
 	/*! [out] Token object where the string of characters is copied. */
 	token *out)
 {
-	size_t i = 0;
+	size_t i = (size_t)0;
 
 	while (i < max &&
 	       (is_unreserved(in[i]) ||
 	        is_reserved(in[i])   ||
-	        ((i + 2 < max) && is_escaped(&in[i])))) {
+	        ((i + (size_t)2 < max) && is_escaped(&in[i])))) {
 		i++;
 	}
 
@@ -209,12 +213,12 @@ static void copy_token(
 
 int copy_URL_list(URL_list *in, URL_list *out)
 {
-    size_t len = strlen(in->URLs) + 1;
+    size_t len = strlen(in->URLs) + (size_t)1;
-    size_t i = 0;
+    size_t i = (size_t)0;
 
     out->URLs = NULL;
     out->parsedURLs = NULL;
-    out->size = 0;
+    out->size = (size_t)0;
 
     out->URLs = malloc(len);
     out->parsedURLs = malloc(sizeof(uri_type) * in->size);
@@ -222,7 +226,7 @@ int copy_URL_list(URL_list *in, URL_list *out)
     if ( !out->URLs || !out->parsedURLs)
         return UPNP_E_OUTOF_MEMORY;
     memcpy(out->URLs, in->URLs, len);
-    for( i = 0; i < in->size; i++ ) {
+    for( i = (size_t)0; i < in->size; i++ ) {
         /*copy the parsed uri */
         out->parsedURLs[i].type = in->parsedURLs[i].type;
         copy_token( &in->parsedURLs[i].scheme, in->URLs,
@@ -253,7 +257,7 @@ void free_URL_list(URL_list *list)
 	if (list->parsedURLs) {
 		free(list->parsedURLs);
 	}
-	list->size = 0;
+	list->size = (size_t)0;
 }
 
 
@@ -309,9 +313,18 @@ int token_cmp(token *in1, token *in2)
 		return memcmp(in1->buff, in2->buff, in1->size);
 }
 
-int parse_hostport(
+/*!
+ * \brief Parses a string representing a host and port (e.g. "127.127.0.1:80"
+ * or "localhost") and fills out a hostport_type struct with internet address
+ * and a token representing the full host and port.
+ *
+ * Uses gethostbyname.
+ */
+static int parse_hostport(
+	/*! [in] String of characters representing host and port. */
 	const char *in,
-	size_t max,
+	/*! [out] Output parameter where the host and port are represented as
+	 * an internet address. */
 	hostport_type *out)
 {
 	char workbuf[256];
@@ -328,8 +341,9 @@ int parse_hostport(
 	int ret;
 
 	memset(out, 0, sizeof(hostport_type));
+	memset(workbuf, 0, sizeof(workbuf));
 	/* Work on a copy of the input string. */
-	strncpy(workbuf, in, sizeof(workbuf));
+	strncpy(workbuf, in, sizeof(workbuf) - 1);
 	c = workbuf;
 	if (*c == '[') {
 		/* IPv6 addresses are enclosed in square brackets. */
@@ -373,13 +387,17 @@ int parse_hostport(
 
 			ret = getaddrinfo(srvname, NULL, &hints, &res0);
 			if (ret == 0) {
-				for (res = res0; res; res = res->ai_next) {
+				for (res = res0; res && !ret; res = res->ai_next) {
-					if (res->ai_family == AF_INET ||
+					switch (res->ai_family) {
-					    res->ai_family == AF_INET6) {
+					case AF_INET:
+					case AF_INET6:
 						/* Found a valid IPv4 or IPv6 address. */
 						memcpy(&out->IPaddress,
 						       res->ai_addr,
 						       res->ai_addrlen);
+						ret=1;
+						break;
+					default:
 						break;
 					}
 				}
@@ -404,24 +422,27 @@ int parse_hostport(
 			return UPNP_E_INVALID_URL;
 	} else
 		/* Port was not specified, use default port. */
-		port = 80;
+		port = 80u;
 	/* The length of the host and port string can be calculated by */
 	/* subtracting pointers. */
-	hostport_size = (size_t)(c - workbuf);
+	hostport_size = (size_t)c - (size_t)workbuf;
 	/* Fill in the 'out' information. */
-	if (af == AF_INET) {
+	switch (af) {
-		sai4->sin_family = AF_INET;
+	case AF_INET:
+		sai4->sin_family = (sa_family_t)af;
 		sai4->sin_port = htons(port);
 		ret = inet_pton(AF_INET, srvname, &sai4->sin_addr);
-	} else if (af == AF_INET6) {
+		break;
-		sai6->sin6_family = AF_INET6;
+	case AF_INET6:
+		sai6->sin6_family = (sa_family_t)af;
 		sai6->sin6_port = htons(port);
 		sai6->sin6_scope_id = gIF_INDEX;
 		ret = inet_pton(AF_INET6, srvname, &sai6->sin6_addr);
-	} else {
+		break;
+	default:
 		/* IP address was set by the hostname (getaddrinfo). */
 		/* Override port: */
-		if (out->IPaddress.ss_family == AF_INET)
+		if (out->IPaddress.ss_family == (sa_family_t)AF_INET)
 			sai4->sin_port = htons(port);
 		else
 			sai6->sin6_port = htons(port);
@@ -434,7 +455,6 @@ int parse_hostport(
 	out->text.buff = in;
 
 	return (int)hostport_size;
-	max = max;
 }
 
 /*!
@@ -455,19 +475,19 @@ static size_t parse_scheme(
 	/*! [out] Output parameter whose buffer is filled in with the scheme. */
 	token *out)
 {
-    size_t i = 0;
+    size_t i = (size_t)0;
 
-    out->size = 0;
+    out->size = (size_t)0;
     out->buff = NULL;
 
-    if( ( max == 0 ) || ( !isalpha( in[0] ) ) )
+    if( ( max == (size_t)0 ) || ( !isalpha( in[0] ) ) )
-        return 0;
+        return (size_t)0;
 
     i++;
     while( ( i < max ) && ( in[i] != ':' ) ) {
         if( !( isalnum( in[i] ) || ( in[i] == '+' ) || ( in[i] == '-' )
                || ( in[i] == '.' ) ) )
-            return 0;
+            return (size_t)0;
         i++;
     }
     if( i < max ) {
@@ -476,15 +496,15 @@ static size_t parse_scheme(
         return i;
     }
 
-    return 0;
+    return (size_t)0;
 }
 
 
 int remove_escaped_chars(INOUT char *in, INOUT size_t *size)
 {
-	size_t i = 0;
+	size_t i = (size_t)0;
 
-	for (i = 0; i < *size; i++) {
+	for (i = (size_t)0; i < *size; i++) {
 		replace_escaped(in, i, size);
 	}
 
@@ -562,20 +582,17 @@ char *resolve_rel_url(char *base_url, char *rel_url)
 {
     uri_type base;
     uri_type rel;
-    char temp_path = '/';
 
-    size_t i = 0;
+    size_t i = (size_t)0;
     char *finger = NULL;
 
     char *last_slash = NULL;
 
     char *out = NULL;
-    char *out_finger = NULL;
 
     if( base_url && rel_url ) {
         out =
-            ( char * )malloc( strlen( base_url ) + strlen( rel_url ) + 2 );
+            ( char * )malloc( strlen( base_url ) + strlen( rel_url ) + (size_t)2 );
-        out_finger = out;
     } else {
         if( rel_url )
             return strdup( rel_url );
@@ -586,50 +603,59 @@ char *resolve_rel_url(char *base_url, char *rel_url)
     if( out == NULL ) {
         return NULL;
     }
+    memset( out, 0, strlen( base_url ) + strlen( rel_url ) + (size_t)2 );
 
     if( ( parse_uri( rel_url, strlen( rel_url ), &rel ) ) == HTTP_SUCCESS ) {
 
-        if( rel.type == ABSOLUTE ) {
+        if( rel.type == ( enum uriType) ABSOLUTE ) {
 
-            strcpy( out, rel_url );
+            strncpy( out, rel_url, strlen ( rel_url ) );
         } else {
 
             if( ( parse_uri( base_url, strlen( base_url ), &base ) ==
                   HTTP_SUCCESS )
-                && ( base.type == ABSOLUTE ) ) {
+                && ( base.type == ( enum uriType ) ABSOLUTE ) ) {
 
-                if( strlen( rel_url ) == 0 ) {
+                if( strlen( rel_url ) == (size_t)0 ) {
-                    strcpy( out, base_url );
+                    strncpy( out, base_url, strlen ( base_url ) );
                 } else {
+                    char *out_finger = out;
+                    assert( base.scheme.size + (size_t)1 /* ':' */ <= strlen ( base_url ) );
                     memcpy( out, base.scheme.buff, base.scheme.size );
                     out_finger += base.scheme.size;
                     ( *out_finger ) = ':';
                     out_finger++;
 
-                    if( rel.hostport.text.size > 0 ) {
+                    if( rel.hostport.text.size > (size_t)0 ) {
-                        sprintf( out_finger, "%s", rel_url );
+                        snprintf( out_finger, strlen( rel_url ) + (size_t)1,
+                                  "%s", rel_url );
                     } else {
-                        if( base.hostport.text.size > 0 ) {
+                        if( base.hostport.text.size > (size_t)0 ) {
-                            memcpy( out_finger, "//", 2 );
+                            assert( base.scheme.size + (size_t)1
+                                + base.hostport.text.size + (size_t)2 /* "//" */ <= strlen ( base_url ) );
+                            memcpy( out_finger, "//", (size_t)2 );
                             out_finger += 2;
                             memcpy( out_finger, base.hostport.text.buff,
                                     base.hostport.text.size );
                             out_finger += base.hostport.text.size;
                         }
 
-                        if( rel.path_type == ABS_PATH ) {
+                        if( rel.path_type == ( enum pathType ) ABS_PATH ) {
-                            strcpy( out_finger, rel_url );
+                            strncpy( out_finger, rel_url, strlen ( rel_url ) );
 
                         } else {
+                            char temp_path = '/';
 
-                            if( base.pathquery.size == 0 ) {
+                            if( base.pathquery.size == (size_t)0 ) {
-                                base.pathquery.size = 1;
+                                base.pathquery.size = (size_t)1;
                                 base.pathquery.buff = &temp_path;
                             }
 
+                            assert( base.scheme.size + (size_t)1 + base.hostport.text.size + (size_t)2
+                                + base.pathquery.size <= strlen ( base_url ) + (size_t)1 /* temp_path */);
                             finger = out_finger;
                             last_slash = finger;
-                            i = 0;
+                            i = (size_t)0;
                             while( ( i < base.pathquery.size ) &&
                                    ( base.pathquery.buff[i] != '?' ) ) {
                                 ( *finger ) = base.pathquery.buff[i];
@@ -639,7 +665,7 @@ char *resolve_rel_url(char *base_url, char *rel_url)
                                 finger++;
 
                             }
-                            strcpy( last_slash, rel_url );
+                            strncpy( last_slash, rel_url, strlen ( rel_url ) );
                             if( remove_dots( out_finger,
                                              strlen( out_finger ) ) !=
                                 UPNP_E_SUCCESS ) {
@@ -671,8 +697,8 @@ char *resolve_rel_url(char *base_url, char *rel_url)
 int parse_uri(const char *in, size_t max, uri_type *out)
 {
 	int begin_path = 0;
-	size_t begin_hostport = 0;
+	size_t begin_hostport = (size_t)0;
-	size_t begin_fragment = 0;
+	size_t begin_fragment = (size_t)0;
 
 	begin_hostport = parse_scheme(in, max, &out->scheme);
 	if (begin_hostport) {
@@ -683,12 +709,11 @@ int parse_uri(const char *in, size_t max, uri_type *out)
 		out->type = RELATIVE;
 		out->path_type = REL_PATH;
 	}
-	if (begin_hostport + 1 < max &&
+	if (begin_hostport + (size_t)1 < max &&
 	    in[begin_hostport] == '/' &&
-	    in[begin_hostport + 1] == '/') {
+	    in[begin_hostport + (size_t)1] == '/') {
-		begin_hostport += 2;
+		begin_hostport += (size_t)2;
 		begin_path = parse_hostport(&in[begin_hostport],
-			max - begin_hostport,
 			&out->hostport);
 		if (begin_path >= 0) {
 			begin_path += (int)begin_hostport;
@@ -710,7 +735,7 @@ int parse_uri(const char *in, size_t max, uri_type *out)
 			   &out->fragment);
 	} else {
 		out->fragment.buff = NULL;
-		out->fragment.size = 0;
+		out->fragment.size = (size_t)0;
 	}
 
 	return HTTP_SUCCESS;
@@ -724,10 +749,10 @@ int parse_uri_and_unescape(char *in, size_t max, uri_type *out)
 		return ret;
 	}
 
-	if (out->pathquery.size > 0) {
+	if (out->pathquery.size > (size_t)0) {
 		remove_escaped_chars((char *)out->pathquery.buff, &out->pathquery.size);
 	}
-	if (out->fragment.size > 0) {
+	if (out->fragment.size > (size_t)0) {
 		remove_escaped_chars((char *)out->fragment.buff, &out->fragment.size);
 	}
 

upnp/src/genlib/service_table/service_table.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -42,6 +43,7 @@
 
 #ifdef INCLUDE_DEVICE_APIS
 
+#if EXCLUDE_GENA == 0
 /************************************************************************
 *	Function :	copy_subscription
 *
@@ -321,6 +323,7 @@ FindServiceEventURLPath( service_table * table,
 
     return NULL;
 }
+#endif /* EXCLUDE_GENA */
 
 /************************************************************************
 *	Function :	FindServiceControlURLPath
@@ -338,6 +341,7 @@ FindServiceEventURLPath( service_table * table,
 *
 *	Note :
 ************************************************************************/
+#if EXCLUDE_SOAP == 0
 service_info *
 FindServiceControlURLPath( service_table * table,
                            const char *controlURLPath )
@@ -369,6 +373,7 @@ FindServiceControlURLPath( service_table * table,
     return NULL;
 
 }
+#endif /* EXCLUDE_SOAP */
 
 /************************************************************************
 *	Function :	printService
@@ -514,6 +519,7 @@ void printServiceTable(
     printServiceList( table->serviceList, level, module );}
 #endif
 
+#if EXCLUDE_GENA == 0
 /************************************************************************
 *	Function :	freeService
 *
@@ -737,8 +743,8 @@ service_info *getServiceList(
 	service_info *current = NULL;
 	service_info *previous = NULL;
 	IXML_NodeList *serviceNodeList = NULL;
-	long unsigned int NumOfServices = 0;
+	long unsigned int NumOfServices = 0lu;
-	long unsigned int i = 0;
+	long unsigned int i = 0lu;
 	int fail = 0;
 
 	if (getSubElement("UDN", node, &UDN) &&
@@ -747,7 +753,7 @@ service_info *getServiceList(
 			(IXML_Element *)serviceList, "service");
 		if (serviceNodeList != NULL) {
 			NumOfServices = ixmlNodeList_length(serviceNodeList);
-			for (i = 0; i < NumOfServices; i++) {
+			for (i = 0lu; i < NumOfServices; i++) {
 				current_service =
 				    ixmlNodeList_item(serviceNodeList, i);
 				fail = 0;
@@ -761,6 +767,7 @@ service_info *getServiceList(
 				}
 				if (!current) {
 					freeServiceList(head);
+					ixmlNodeList_free(serviceNodeList);
 					return NULL;
 				}
 				current->next = NULL;
@@ -860,8 +867,8 @@ getAllServiceList( IXML_Node * node,
 	IXML_NodeList *deviceList = NULL;
 	IXML_Node *currentDevice = NULL;
 
-	long unsigned int NumOfDevices = 0;
+	long unsigned int NumOfDevices = 0lu;
-	long unsigned int i = 0;
+	long unsigned int i = 0lu;
 
 	(*out_end) = NULL;
 
@@ -869,7 +876,7 @@ getAllServiceList( IXML_Node * node,
 		(IXML_Element *)node, "device");
 	if (deviceList) {
 		NumOfDevices = ixmlNodeList_length(deviceList);
-		for (i = 0; i < NumOfDevices; i++) {
+		for (i = 0lu; i < NumOfDevices; i++) {
 			currentDevice = ixmlNodeList_item(deviceList, i);
 			if (head) {
 				end->next = getServiceList(currentDevice,
@@ -912,12 +919,11 @@ removeServiceTable( IXML_Node * node,
     IXML_Node *currentUDN = NULL;
     DOMString UDN = NULL;
     IXML_NodeList *deviceList = NULL;
-    IXML_Node *currentDevice = NULL;
     service_info *current_service = NULL;
     service_info *start_search = NULL;
     service_info *prev_service = NULL;
-    long unsigned int NumOfDevices = 0;
+    long unsigned int NumOfDevices = 0lu;
-    long unsigned int i = 0;
+    long unsigned int i = 0lu;
 
     if( getSubElement( "root", node, &root ) ) {
         current_service = in->serviceList;
@@ -927,8 +933,7 @@ removeServiceTable( IXML_Node * node,
                                               "device" );
         if( deviceList != NULL ) {
             NumOfDevices = ixmlNodeList_length( deviceList );
-            for( i = 0; i < NumOfDevices; i++ ) {
+            for( i = 0lu; i < NumOfDevices; i++ ) {
-                currentDevice = ixmlNodeList_item( deviceList, i );
                 if( ( start_search )
                     && ( ( getSubElement( "UDN", node, &currentUDN ) )
                          && ( UDN = getElementValue( currentUDN ) ) ) ) {
@@ -939,7 +944,8 @@ removeServiceTable( IXML_Node * node,
                     while( ( current_service )
                            && ( strcmp( current_service->UDN, UDN ) ) ) {
                         current_service = current_service->next;
-                        prev_service = current_service->next;
+			if( current_service != NULL) 
+                        	prev_service = current_service->next;
                     }
                     while( ( current_service )
                            && ( !strcmp( current_service->UDN, UDN ) ) ) {
@@ -954,6 +960,8 @@ removeServiceTable( IXML_Node * node,
                         freeService( current_service );
                         current_service = start_search;
                     }
+                    ixmlFreeDOMString( UDN );
+                    UDN = NULL;
                 }
             }
 
@@ -1060,6 +1068,7 @@ getServiceTable( IXML_Node * node,
 
     return 0;
 }
+#endif /* EXCLUDE_GENA */
 
 #endif /* INCLUDE_DEVICE_APIS */
 

upnp/src/genlib/util/membuffer.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -48,7 +49,7 @@ char *str_alloc(const char *str, size_t str_len)
 {
 	char *s;
 
-	s = (char *)malloc(str_len + 1);
+	s = (char *)malloc(str_len + (size_t)1);
 	if (s == NULL) {
 		return NULL;	/* no mem */
 	}
@@ -96,8 +97,8 @@ static UPNP_INLINE void membuffer_initialize(
 	membuffer *m)
 {
 	m->buf = NULL;
-	m->length = 0;
+	m->length = (size_t)0;
-	m->capacity = 0;
+	m->capacity = (size_t)0;
 }
 
 int membuffer_set_size(membuffer *m, size_t new_length)
@@ -128,14 +129,14 @@ int membuffer_set_size(membuffer *m, size_t new_length)
 
 	assert(alloc_len >= new_length);
 
-	temp_buf = realloc(m->buf, alloc_len + 1);	/*LEAK_FIX_MK */
+	temp_buf = realloc(m->buf, alloc_len + (size_t)1);	/*LEAK_FIX_MK */
 
 	/*temp_buf = Realloc( m->buf,m->length, alloc_len + 1 );LEAK_FIX_MK */
 
 	if (temp_buf == NULL) {
 		/* try smaller size */
 		alloc_len = new_length;
-		temp_buf = realloc(m->buf, alloc_len + 1);	/*LEAK_FIX_MK */
+		temp_buf = realloc(m->buf, alloc_len + (size_t)1);	/*LEAK_FIX_MK */
 		/*temp_buf = Realloc( m->buf,m->length, alloc_len + 1 );LEAK_FIX_MK */
 
 		if (temp_buf == NULL) {
@@ -250,7 +251,7 @@ void membuffer_delete(membuffer * m, size_t index, size_t num_bytes)
 	if (index + num_bytes > m->length) {
 		num_bytes = m->length - index;
 		/* every thing at and after index purged */
-		copy_len = 0;
+		copy_len = (size_t)0;
 	} else {
 		/* calc num bytes after deleted string */
 		copy_len = m->length - (index + num_bytes);
@@ -261,6 +262,8 @@ void membuffer_delete(membuffer * m, size_t index, size_t num_bytes)
 	return_value = membuffer_set_size(m, new_length);
 	/* shrinking should always work */
 	assert(return_value == 0);
+	if (return_value != 0)
+		return;
 
 	/* don't modify until buffer is set */
 	m->length = new_length;

upnp/src/genlib/util/util.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved.  
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -44,14 +45,14 @@
 
 void linecopy(char dest[LINE_SIZE], const char *src)
 {
-	strncpy(dest, src, LINE_SIZE - 1);
+	strncpy(dest, src, LINE_SIZE - (size_t)1);
 	/* null-terminate if len(src) >= LINE_SIZE. */
 	dest[LINE_SIZE - 1] = '\0';
 }
 
 void namecopy(char dest[NAME_SIZE], const char *src)
 {
-	strncpy(dest, src, NAME_SIZE - 1);
+	strncpy(dest, src, NAME_SIZE - (size_t)1);
 	/* null-terminate if len(src) >= NAME_SIZE. */
 	dest[NAME_SIZE - 1] = '\0';
 }
@@ -60,7 +61,7 @@ void linecopylen(char dest[LINE_SIZE], const char *src, size_t srclen)
 {
 	size_t len;
 
-	len = srclen < (LINE_SIZE - 1) ? srclen : (LINE_SIZE - 1);
+	len = srclen < (LINE_SIZE - (size_t)1) ? srclen : (LINE_SIZE - (size_t)1);
 	strncpy(dest, src, len);
 	dest[len] = '\0';
 }

upnp/src/inc/config.h

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation
  * All rights reserved.
+ * Copyright (c) 2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -125,7 +126,7 @@
  *
  * @{
  */
-#define THREAD_STACK_SIZE 0
+#define THREAD_STACK_SIZE (size_t)0
 /* @} */
 
 
@@ -178,7 +179,7 @@
  *
  * @{
  */
-#define SSDP_PAUSE  100
+#define SSDP_PAUSE  100u
 /* @} */
 
 /*!
@@ -189,7 +190,7 @@
  *
  * @{
  */
-#define WEB_SERVER_BUF_SIZE  (1024*1024)
+#define WEB_SERVER_BUF_SIZE  (size_t)(1024*1024)
 /* @} */
 
 /*!
@@ -435,11 +436,34 @@
 #endif
 
 
-/* configure --enable-webserver --enable-device */
+/* configure --enable-webserver */
 #if UPNP_HAVE_WEBSERVER
 #	define INTERNAL_WEB_SERVER	1
 #endif
 
+/* configure --enable-ssdp */
+#undef EXCLUDE_SSDP
+#if UPNP_HAVE_SSDP
+#       define EXCLUDE_SSSDP 0
+#else
+#       define EXCLUDE_SSSDP 1
+#endif
+
+/* configure --enable-soap */
+#undef EXCLUDE_SOAP
+#if UPNP_HAVE_SOAP
+#	define EXCLUDE_SOAP 0
+#else
+#	define EXCLUDE_SOAP 1
+#endif
+
+/* configure --enable-gena */
+#undef EXCLUDE_GENA
+#if UPNP_HAVE_GENA
+#       define EXCLUDE_GENA 0
+#else
+#       define EXCLUDE_GENA 1
+#endif
 
 #undef  EXCLUDE_WEB_SERVER
 #undef  EXCLUDE_MINISERVER

upnp/src/inc/httpparser.h

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -217,7 +218,7 @@ typedef struct {
 	parser_pos_t position;
 	int ent_position;
 	unsigned int content_length;
-	int chunk_size;
+	size_t chunk_size;
        /*! offset in the the raw message buffer, which contains the message body.
         *  preceding this are the headers of the messsage. */
 	size_t entity_start_position;
@@ -429,7 +430,7 @@ parse_status_t parser_append( INOUT http_parser_t* parser,
 *   PARSE_NO_MATCH -- failure to match pattern 'fmt'					
 *   PARSE_FAILURE	-- 'str' is bad input							
 ************************************************************************/
-int matchstr( IN char *str, IN size_t slen, IN const char* fmt, ... );
+parse_status_t matchstr( IN char *str, IN size_t slen, IN const char* fmt, ... );
 
 /************************************************************************
 * Function: raw_to_int													

upnp/src/inc/httpreadwrite.h

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation
  * All rights reserved.
+ * Copyright (c) 2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -558,6 +559,7 @@ int http_OpenHttpGetEx(IN const char *url_str,
  *
  * Parameters:
  *	OUT char *info;	buffer to store the operating system information
+ *	IN size_t infoSize; size of buffer
  *
  * Description:
  *	Returns the server information for the operating system
@@ -565,7 +567,7 @@ int http_OpenHttpGetEx(IN const char *url_str,
  * Return:
  *	UPNP_INLINE void
  ************************************************************************/
-void get_sdk_info( OUT char *info );
+void get_sdk_info( OUT char *info, IN size_t infoSize );
 
 #ifdef __cplusplus
 }	/* #extern "C" */

upnp/src/inc/membuffer.h

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation
  * All rights reserved.
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -62,7 +63,7 @@ typedef struct {
 	/*! used to increase size; MUST be > 0; (read/write). */
 	size_t size_inc;
 	/*! default value of size_inc. */
-#define MEMBUF_DEF_SIZE_INC 5
+#define MEMBUF_DEF_SIZE_INC (size_t)5
 } membuffer;
 
 #ifdef __cplusplus

upnp/src/inc/service_table.h

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -49,7 +50,7 @@ extern "C" {
 #include <stdio.h>
 #include <time.h>
 
-#define SID_SIZE  41
+#define SID_SIZE  (size_t)41
 
 #ifdef INCLUDE_DEVICE_APIS
 

upnp/src/inc/sock.h

@@ -5,6 +5,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -74,7 +75,7 @@ static UPNP_INLINE int sock_close(
 {
 	int ret = -1;
 
-	if (sock != -1)
+	if (sock != INVALID_SOCKET)
 		ret = UpnpCloseSocket(sock);
 
 	return ret;
@@ -143,7 +144,7 @@ int sock_read(
 	/*! [out] Buffer to get data to. */
 	char* buffer,
 	/*! [in] Size of the buffer. */
-	int bufsize,
+	size_t bufsize,
 	/*! [in,out] timeout value. */
 	int *timeoutSecs);
 
@@ -161,7 +162,7 @@ int sock_write(
 	/*! [in] Buffer to send data from. */
 	const char *buffer,
 	/*! [in] Size of the buffer. */
-	int bufsize,
+	size_t bufsize,
 	/*! [in,out] timeout value. */
 	int *timeoutSecs);
 

upnp/src/inc/ssdplib.h

@@ -5,6 +5,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (C) 2011-2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -72,7 +73,7 @@ typedef enum SsdpSearchType {
 	SSDP_SERVICE
 } SType;
 
-#define BUFSIZE   2500
+#define BUFSIZE   (size_t)2500
 #define SSDP_IP   "239.255.255.250"
 #define SSDP_IPV6_LINKLOCAL "FF02::C"
 #define SSDP_IPV6_SITELOCAL "FF05::C"
@@ -353,7 +354,13 @@ int DeviceAdvertisement(
 	/* [in] Service duration in sec. */
 	int Duration,
 	/* [in] Device address family. */
-	int AddressFamily);
+	int AddressFamily,
+	/* [in] PowerState as defined by UPnP Low Power. */
+	int PowerState,
+	/* [in] SleepPeriod as defined by UPnP Low Power. */
+	int SleepPeriod,
+	/* [in] RegistrationState as defined by UPnP Low Power. */
+	int RegistrationState);
 
 /*!
  * \brief Creates the reply packet based on the input parameter, and send it
@@ -375,7 +382,13 @@ int SendReply(
 	/* [in] Life time of this device. */
 	int Duration, 
 	/* [in] . */
-	int ByType );
+	int ByType,
+	/* [in] PowerState as defined by UPnP Low Power. */
+	int PowerState,
+	/* [in] SleepPeriod as defined by UPnP Low Power. */
+	int SleepPeriod,
+	/* [in] RegistrationState as defined by UPnP Low Power. */
+	int RegistrationState);
 
 /*!
  * \brief Creates the reply packet based on the input parameter, and send it
@@ -395,7 +408,13 @@ int DeviceReply(
 	/* [in] Location of Device description document. */
 	char *Location, 
 	/* [in] Life time of this device. */
-	int Duration);
+	int Duration,
+	/* [in] PowerState as defined by UPnP Low Power. */
+	int PowerState,
+	/* [in] SleepPeriod as defined by UPnP Low Power. */
+	int SleepPeriod,
+	/* [in] RegistrationState as defined by UPnP Low Power. */
+	int RegistrationState);
 
 /*!
  * \brief Creates the advertisement packet based on the input parameter,
@@ -413,7 +432,13 @@ int ServiceAdvertisement(
 	/* [in] Life time of this device. */
 	int Duration,
 	/* [in] Device address family. */
-	int AddressFamily);
+	int AddressFamily,
+	/* [in] PowerState as defined by UPnP Low Power. */
+	int PowerState,
+	/* [in] SleepPeriod as defined by UPnP Low Power. */
+	int SleepPeriod,
+	/* [in] RegistrationState as defined by UPnP Low Power. */
+	int RegistrationState);
 
 /*!
  * \brief Creates the advertisement packet based on the input parameter,
@@ -431,7 +456,13 @@ int ServiceReply(
 	/* [in] Location of Device description document. */
 	char *Location,
 	/* [in] Life time of this device. */
-	int Duration);
+	int Duration,
+	/* [in] PowerState as defined by UPnP Low Power. */
+	int PowerState,
+	/* [in] SleepPeriod as defined by UPnP Low Power. */
+	int SleepPeriod,
+	/* [in] RegistrationState as defined by UPnP Low Power. */
+	int RegistrationState);
 
 /*!
  * \brief Creates a HTTP service shutdown request packet and sends it to the
@@ -449,7 +480,13 @@ int ServiceShutdown(
 	/* [in] Service duration in sec. */
 	int Duration,
 	/* [in] Device address family. */
-	int AddressFamily);
+	int AddressFamily,
+	/* [in] PowerState as defined by UPnP Low Power. */
+	int PowerState,
+	/* [in] SleepPeriod as defined by UPnP Low Power. */
+	int SleepPeriod,
+	/* [in] RegistrationState as defined by UPnP Low Power. */
+	int RegistrationState);
 
 /*!
  * \brief Creates a HTTP device shutdown request packet and send it to the
@@ -464,14 +501,18 @@ int DeviceShutdown(
 	int RootDev,
 	/* [in] Device UDN. */
 	char *Udn, 
-	/* [in] . */
-	char *_Server, 
 	/* [in] Location URL. */
 	char *Location, 
 	/* [in] Device duration in sec. */
 	int Duration,
 	/* [in] Device address family. */
-	int AddressFamily);
+	int AddressFamily,
+	/* [in] PowerState as defined by UPnP Low Power. */
+	int PowerState,
+	/* [in] SleepPeriod as defined by UPnP Low Power. */
+	int SleepPeriod,
+	/* [in] RegistrationState as defined by UPnP Low Power. */
+	int RegistrationState);
 
 /* @} SSDP Device Functions */
 

upnp/src/inc/upnpapi.h

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (C) 2011-2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -55,7 +56,7 @@
 #define DEFAULT_MAXAGE 1800
 
 #define DEFAULT_SOAP_CONTENT_LENGTH 16000
-#define MAX_SOAP_CONTENT_LENGTH 32000
+#define MAX_SOAP_CONTENT_LENGTH (size_t)32000
 
 extern size_t g_maxContentLength;
 
@@ -87,6 +88,12 @@ struct Handle_Info
 	char  DescXML[LINE_SIZE];
 	/* Advertisement timeout */
 	int MaxAge;
+	/* Power State as defined by UPnP Low Power. */
+	int PowerState;
+	/* Sleep Period as defined by UPnP Low Power. */
+	int SleepPeriod;
+	/* Registration State as defined by UPnP Low Power. */
+	int RegistrationState;
 	/*! Description parsed in terms of DOM document. */
 	IXML_Document *DescDocument;
 	/*! List of devices in the description document. */
@@ -167,7 +174,7 @@ Upnp_Handle_Type GetClientHandleInfo(
  */
 Upnp_Handle_Type GetDeviceHandleInfo(
 	/*! [in] Address family. */
-	const int AddressFamily,
+	int AddressFamily,
 	/*! [out] Device handle pointer. */
 	int *device_handle_out, 
 	/*! [out] Device handle structure passed by this function. */
@@ -175,10 +182,8 @@ Upnp_Handle_Type GetDeviceHandleInfo(
 
 
 extern char gIF_NAME[LINE_SIZE];
-/*! INET_ADDRSTRLEN. */
+extern char gIF_IPV4[INET_ADDRSTRLEN];
-extern char gIF_IPV4[22];
+extern char gIF_IPV6[INET6_ADDRSTRLEN];
-/*! INET6_ADDRSTRLEN. */
-extern char gIF_IPV6[65];
 
 extern char gIF_IPV6_ULA_GUA[INET6_ADDRSTRLEN];
 

upnp/src/inc/upnputil.h

@@ -5,6 +5,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation
  * All rights reserved.
+ * Copyright (c) 2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -109,10 +110,11 @@ void linecopylen(
 #endif
 
 /* Size of the errorBuffer variable, passed to the strerror_r() function */
-#define ERROR_BUFFER_LEN 256
+#define ERROR_BUFFER_LEN (size_t)256
 
 /* C specific */
-#ifndef __cplusplus
+/* VC needs these in C++ mode too (do other compilers?) */
+#if !defined(__cplusplus) || defined(UPNP_USE_MSVCPP)
 	#ifdef WIN32
 		#ifndef S_ISREG
 			#define S_ISREG(m) (((m) & S_IFMT) == S_IFREG)
@@ -130,7 +132,7 @@ void linecopylen(
 		#define max(a, b)   (((a)>(b))? (a):(b))
 		#define min(a, b)   (((a)<(b))? (a):(b))
 	#endif /* WIN32 */
-#endif /* __cplusplus */
+#endif /* !defined(__cplusplus) || defined(UPNP_USE_MSVCPP) */
 
 #endif /* UTIL_H */
 

upnp/src/inc/uri.h

@@ -52,7 +52,10 @@
 #include <time.h>
 
 #ifdef WIN32
-	#include "inet_pton.h"
+	#ifndef UPNP_USE_MSVCPP
+		/* VC Winsocks2 includes these functions */
+		#include "inet_pton.h"
+	#endif
 #else
 	#include <netdb.h>      /* for struct addrinfo */
 #endif
@@ -273,22 +276,6 @@ int token_cmp(
 	/*! [in] Second token object used for the comparison. */
 	token *in2);
 
-/*!
- * \brief Parses a string representing a host and port (e.g. "127.127.0.1:80"
- * or "localhost") and fills out a hostport_type struct with internet address
- * and a token representing the full host and port.
- *
- * Uses gethostbyname.
- */
-int parse_hostport(
-	/*! [in] String of characters representing host and port. */
-	const char *in,
-	/*! [in] Sets a maximum limit. */
-	size_t max,
-	/*! [out] Output parameter where the host and port are represented as
-	 * an internet address. */
-	hostport_type *out);
-
 /*!
  * \brief Removes http escaped characters such as: "%20" and replaces them with
  * their character representation. i.e. "hello%20foo" -> "hello foo".

upnp/src/soap/soap_ctrlpt.c

@@ -379,7 +379,7 @@ get_response_value( IN http_message_t * hmsg,
 	char *node_str = NULL;
 	const char *temp_str = NULL;
 	DOMString error_node_str = NULL;
-	int err_code = UPNP_E_BAD_RESPONSE; /* default error */ ;
+	int err_code = UPNP_E_BAD_RESPONSE; /* default error */
 	int done = FALSE;
 	const char *names[5];
 	const DOMString nodeValue;

upnp/src/soap/soap_device.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -192,7 +193,8 @@ static void send_error_response(
 	char err_code_str[30];
 	membuffer headers;
 
-	sprintf(err_code_str, "%d", error_code);
+	memset(err_code_str, 0, sizeof(err_code_str));
+	snprintf(err_code_str, sizeof(err_code_str), "%d", error_code);
 	/* calc body len */
 	content_length = (off_t) (strlen(start_body) + strlen(err_code_str) +
 				  strlen(mid_body) + strlen(err_msg) +
@@ -322,7 +324,6 @@ static UPNP_INLINE int get_action_node(
 			goto error_handler;
 		ret_code = ixmlParseBufferEx(ActNodeName, RespNode);
 		if (ret_code != IXML_SUCCESS) {
-			ixmlFreeDOMString(ActNodeName);
 			ret_code = -1;
 			goto error_handler;
 		}

upnp/src/ssdp/ssdp_ctrlpt.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (C) 2012 France Telecom All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -58,6 +59,7 @@
 
 #ifdef WIN32
 #include <string.h>
+#define snprintf _snprintf
 #endif /* WIN32 */
 
 /*!
@@ -98,6 +100,8 @@ void ssdp_handle_ctrlpt_msg(http_message_t *hmsg, struct sockaddr_storage *dest_
 	ResultData *threadData = NULL;
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	/* we are assuming that there can be only one client supported at a time */
 	HandleReadLock();
 
@@ -128,7 +132,7 @@ void ssdp_handle_ctrlpt_msg(http_message_t *hmsg, struct sockaddr_storage *dest_
 		linecopylen(param.Date, hdr_value.buf, hdr_value.length);
 	}
 	/* dest addr */
-	memcpy(&param.DestAddr, dest_addr, sizeof(struct sockaddr_in));
+	memcpy(&param.DestAddr, dest_addr, sizeof(struct sockaddr_storage));
 	/* EXT */
 	param.Ext[0] = '\0';
 	if (httpmsg_find_hdr(hmsg, HDR_EXT, &hdr_value) != NULL) {
@@ -146,9 +150,9 @@ void ssdp_handle_ctrlpt_msg(http_message_t *hmsg, struct sockaddr_storage *dest_
 		linecopylen(param.Os, hdr_value.buf, hdr_value.length);
 	}
 	/* clear everything */
-	param.DeviceId[0] = '\0';
+	memset(param.DeviceId, 0, sizeof(param.DeviceId));
-	param.DeviceType[0] = '\0';
+	memset(param.DeviceType, 0, sizeof(param.DeviceType));
-	param.ServiceType[0] = '\0';
+	memset(param.ServiceType, 0, sizeof(param.ServiceType));
 	/* not used; version is in ServiceType */
 	param.ServiceVer[0] = '\0';
 	event.UDN[0] = '\0';
@@ -169,9 +173,11 @@ void ssdp_handle_ctrlpt_msg(http_message_t *hmsg, struct sockaddr_storage *dest_
 		hdr_value.buf[hdr_value.length] = save_char;
 	}
 	if (nt_found || usn_found) {
-		strcpy(param.DeviceId, event.UDN);
+		strncpy(param.DeviceId, event.UDN, sizeof(param.DeviceId) - 1);
-		strcpy(param.DeviceType, event.DeviceType);
+		strncpy(param.DeviceType, event.DeviceType,
-		strcpy(param.ServiceType, event.ServiceType);
+			sizeof(param.DeviceType) - 1);
+		strncpy(param.ServiceType, event.ServiceType,
+			sizeof(param.ServiceType) - 1);
 	}
 	/* ADVERT. OR BYEBYE */
 	if (hmsg->is_request) {
@@ -302,9 +308,11 @@ void ssdp_handle_ctrlpt_msg(http_message_t *hmsg, struct sockaddr_storage *dest_
  * \brief Creates a HTTP search request packet depending on the input
  * parameter.
  */
-static void CreateClientRequestPacket(
+static int CreateClientRequestPacket(
-	/*! [in] Output string in HTTP format. */
+	/*! [in,out] Output string in HTTP format. */
-	IN char *RqstBuf,
+	INOUT char *RqstBuf,
+	/*! [in] RqstBuf size. */
+	IN size_t RqstBufSize,
 	/*! [in] Search Target. */
 	IN int Mx,
 	/*! [in] Number of seconds to wait to collect all the responses. */
@@ -312,65 +320,134 @@ static void CreateClientRequestPacket(
 	/*! [in] search address family. */
 	IN int AddressFamily)
 {
+	int rc;
 	char TempBuf[COMMAND_LEN];
+	const char *command = "M-SEARCH * HTTP/1.1\r\n";
+	const char *man = "MAN: \"ssdp:discover\"\r\n";
 
-	strcpy(RqstBuf, "M-SEARCH * HTTP/1.1\r\n");
+	memset(TempBuf, 0, sizeof(TempBuf));
+	if (RqstBufSize <= strlen(command))
+		return UPNP_E_INTERNAL_ERROR;
+	strcpy(RqstBuf, command);
 
-	if (AddressFamily == AF_INET) {
+	switch (AddressFamily) {
-		sprintf(TempBuf, "HOST: %s:%d\r\n", SSDP_IP, SSDP_PORT);
+	case AF_INET:
-	} else if (AddressFamily == AF_INET6) {
+		rc = snprintf(TempBuf, sizeof(TempBuf), "HOST: %s:%d\r\n", SSDP_IP,
-		sprintf(TempBuf, "HOST: [%s]:%d\r\n", SSDP_IPV6_LINKLOCAL,
 			SSDP_PORT);
+		break;
+	case AF_INET6:
+		rc = snprintf(TempBuf, sizeof(TempBuf), "HOST: [%s]:%d\r\n",
+			SSDP_IPV6_LINKLOCAL, SSDP_PORT);
+		break;
+	default:
+		return UPNP_E_INVALID_ARGUMENT;
 	}
+	if (rc < 0 || (unsigned int) rc >= sizeof(TempBuf))
+		return UPNP_E_INTERNAL_ERROR;
+
+	if (RqstBufSize <= strlen(RqstBuf) + strlen(TempBuf))
+		return UPNP_E_BUFFER_TOO_SMALL;
 	strcat(RqstBuf, TempBuf);
-	strcat(RqstBuf, "MAN: \"ssdp:discover\"\r\n");
+
+	if (RqstBufSize <= strlen(RqstBuf) + strlen(man))
+		return UPNP_E_BUFFER_TOO_SMALL;
+	strcat(RqstBuf, man);
 
 	if (Mx > 0) {
-		sprintf(TempBuf, "MX: %d\r\n", Mx);
+		rc = snprintf(TempBuf, sizeof(TempBuf), "MX: %d\r\n", Mx);
+		if (rc < 0 || (unsigned int) rc >= sizeof(TempBuf))
+			return UPNP_E_INTERNAL_ERROR;
+		if (RqstBufSize <= strlen(RqstBuf) + strlen(TempBuf))
+			return UPNP_E_BUFFER_TOO_SMALL;
 		strcat(RqstBuf, TempBuf);
 	}
 
 	if (SearchTarget != NULL) {
-		sprintf(TempBuf, "ST: %s\r\n", SearchTarget);
+		rc = snprintf(TempBuf, sizeof(TempBuf), "ST: %s\r\n", SearchTarget);
+		if (rc < 0 || (unsigned int) rc >= sizeof(TempBuf))
+			return UPNP_E_INTERNAL_ERROR;
+		if (RqstBufSize <= strlen(RqstBuf) + strlen(TempBuf))
+			return UPNP_E_BUFFER_TOO_SMALL;
 		strcat(RqstBuf, TempBuf);
 	}
+	if (RqstBufSize <= strlen(RqstBuf) + strlen("\r\n"))
+		return UPNP_E_BUFFER_TOO_SMALL;
 	strcat(RqstBuf, "\r\n");
+
+	return UPNP_E_SUCCESS;
 }
 
 /*!
  * \brief
  */
-static void CreateClientRequestPacketUlaGua(
+#ifdef UPNP_ENABLE_IPV6
-	/*! [in] . */
+static int CreateClientRequestPacketUlaGua(
+	/*! [in,out] . */
 	char *RqstBuf,
 	/*! [in] . */
+	size_t RqstBufSize,
+	/*! [in] . */
 	int Mx,
 	/*! [in] . */
 	char *SearchTarget,
 	/*! [in] . */
 	int AddressFamily)
 {
+	int rc;
 	char TempBuf[COMMAND_LEN];
+	const char *command = "M-SEARCH * HTTP/1.1\r\n";
+	const char *man = "MAN: \"ssdp:discover\"\r\n";
 
-	strcpy(RqstBuf, "M-SEARCH * HTTP/1.1\r\n");
+	memset(TempBuf, 0, sizeof(TempBuf));
-	if (AddressFamily == AF_INET) {
+	if (RqstBufSize <= strlen(command))
-		sprintf(TempBuf, "HOST: %s:%d\r\n", SSDP_IP, SSDP_PORT);
+		return UPNP_E_INTERNAL_ERROR;
-	} else if (AddressFamily == AF_INET6) {
+	strcpy(RqstBuf, command);
-		sprintf(TempBuf, "HOST: [%s]:%d\r\n", SSDP_IPV6_SITELOCAL,
+	switch (AddressFamily) {
+	case AF_INET:
+		rc = snprintf(TempBuf, sizeof(TempBuf), "HOST: %s:%d\r\n", SSDP_IP,
 			SSDP_PORT);
+		break;
+	case AF_INET6:
+		rc = snprintf(TempBuf, sizeof(TempBuf), "HOST: [%s]:%d\r\n",
+			SSDP_IPV6_SITELOCAL, SSDP_PORT);
+		break;
+	default:
+		return UPNP_E_INVALID_ARGUMENT;
 	}
+	if (rc < 0 || (unsigned int) rc >= sizeof(TempBuf))
+		return UPNP_E_INTERNAL_ERROR;
+
+	if (RqstBufSize <= strlen(RqstBuf) + strlen(TempBuf))
+		return UPNP_E_BUFFER_TOO_SMALL;
 	strcat(RqstBuf, TempBuf);
-	strcat(RqstBuf, "MAN: \"ssdp:discover\"\r\n");
+
+	if (RqstBufSize <= strlen(RqstBuf) + strlen(man))
+		return UPNP_E_BUFFER_TOO_SMALL;
+	strcat(RqstBuf, man);
+
 	if (Mx > 0) {
-		sprintf(TempBuf, "MX: %d\r\n", Mx);
+		rc = snprintf(TempBuf, sizeof(TempBuf), "MX: %d\r\n", Mx);
+		if (rc < 0 || (unsigned int) rc >= sizeof(TempBuf))
+			return UPNP_E_INTERNAL_ERROR;
+		if (RqstBufSize <= strlen(RqstBuf) + strlen(TempBuf))
+			return UPNP_E_BUFFER_TOO_SMALL;
 		strcat(RqstBuf, TempBuf);
 	}
 	if (SearchTarget) {
-		sprintf(TempBuf, "ST: %s\r\n", SearchTarget);
+		rc = snprintf(TempBuf, sizeof(TempBuf), "ST: %s\r\n", SearchTarget);
+		if (rc < 0 || (unsigned int) rc >= sizeof(TempBuf))
+			return UPNP_E_INTERNAL_ERROR;
+		if (RqstBufSize <= strlen(RqstBuf) + strlen(TempBuf))
+			return UPNP_E_BUFFER_TOO_SMALL;
 		strcat(RqstBuf, TempBuf);
 	}
+	if (RqstBufSize <= strlen(RqstBuf) + strlen("\r\n"))
+		return UPNP_E_BUFFER_TOO_SMALL;
 	strcat(RqstBuf, "\r\n");
+
+	return UPNP_E_SUCCESS;
 }
+#endif /* UPNP_ENABLE_IPV6 */
 
 /*!
  * \brief
@@ -428,12 +505,18 @@ int SearchByTarget(int Mx, char *St, void *Cookie)
 	int *id = NULL;
 	int ret = 0;
 	char ReqBufv4[BUFSIZE];
+#ifdef UPNP_ENABLE_IPV6
 	char ReqBufv6[BUFSIZE];
 	char ReqBufv6UlaGua[BUFSIZE];
+#endif
 	struct sockaddr_storage __ss_v4;
+#ifdef UPNP_ENABLE_IPV6
 	struct sockaddr_storage __ss_v6;
+#endif
 	struct sockaddr_in *destAddr4 = (struct sockaddr_in *)&__ss_v4;
+#ifdef UPNP_ENABLE_IPV6
 	struct sockaddr_in6 *destAddr6 = (struct sockaddr_in6 *)&__ss_v6;
+#endif
 	fd_set wrSet;
 	SsdpSearchArg *newArg = NULL;
 	int timeTillRead = 0;
@@ -441,11 +524,14 @@ int SearchByTarget(int Mx, char *St, void *Cookie)
 	struct Handle_Info *ctrlpt_info = NULL;
 	enum SsdpSearchType requestType;
 	unsigned long addrv4 = inet_addr(gIF_IPV4);
-	int max_fd = 0;
+	SOCKET max_fd = 0;
+	int retVal;
 
 	/*ThreadData *ThData; */
 	ThreadPoolJob job;
 
+	memset(&job, 0, sizeof(job));
+
 	requestType = ssdp_request_type1(St);
 	if (requestType == SSDP_SERROR)
 		return UPNP_E_INVALID_PARAM;
@@ -456,20 +542,30 @@ int SearchByTarget(int Mx, char *St, void *Cookie)
 		timeTillRead = MIN_SEARCH_TIME;
 	else if (timeTillRead > MAX_SEARCH_TIME)
 		timeTillRead = MAX_SEARCH_TIME;
-	CreateClientRequestPacket(ReqBufv4, timeTillRead, St, AF_INET);
+	retVal = CreateClientRequestPacket(ReqBufv4, sizeof(ReqBufv4), timeTillRead, St, AF_INET);
-	CreateClientRequestPacket(ReqBufv6, timeTillRead, St, AF_INET6);
+	if (retVal != UPNP_E_SUCCESS)
-	CreateClientRequestPacketUlaGua(ReqBufv6UlaGua, timeTillRead, St, AF_INET6);
+		return retVal;
+#ifdef UPNP_ENABLE_IPV6
+	retVal = CreateClientRequestPacket(ReqBufv6, sizeof(ReqBufv6), timeTillRead, St, AF_INET6);
+	if (retVal != UPNP_E_SUCCESS)
+		return retVal;
+	retVal = CreateClientRequestPacketUlaGua(ReqBufv6UlaGua, sizeof(ReqBufv6UlaGua), timeTillRead, St, AF_INET6);
+	if (retVal != UPNP_E_SUCCESS)
+		return retVal;
+#endif
 
 	memset(&__ss_v4, 0, sizeof(__ss_v4));
-	destAddr4->sin_family = AF_INET;
+	destAddr4->sin_family = (sa_family_t)AF_INET;
 	inet_pton(AF_INET, SSDP_IP, &destAddr4->sin_addr);
 	destAddr4->sin_port = htons(SSDP_PORT);
 
+#ifdef UPNP_ENABLE_IPV6
 	memset(&__ss_v6, 0, sizeof(__ss_v6));
-	destAddr6->sin6_family = AF_INET6;
+	destAddr6->sin6_family = (sa_family_t)AF_INET6;
 	inet_pton(AF_INET6, SSDP_IPV6_SITELOCAL, &destAddr6->sin6_addr);
 	destAddr6->sin6_port = htons(SSDP_PORT);
 	destAddr6->sin6_scope_id = gIF_INDEX;
+#endif
 
 	/* add search criteria to list */
 	HandleLock();
@@ -527,10 +623,13 @@ int SearchByTarget(int Mx, char *St, void *Cookie)
 		int NumCopy = 0;
 
 		while (NumCopy < NUM_SSDP_COPY) {
+			UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
+				   ">>> SSDP SEND M-SEARCH >>>\n%s\n",
+				   ReqBufv6UlaGua);
 			sendto(gSsdpReqSocket6,
 			       ReqBufv6UlaGua, strlen(ReqBufv6UlaGua), 0,
 			       (struct sockaddr *)&__ss_v6,
-			       sizeof(struct sockaddr_in));
+			       sizeof(struct sockaddr_in6));
 			NumCopy++;
 			imillisleep(SSDP_PAUSE);
 		}

upnp/src/ssdp/ssdp_device.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation
  * All rights reserved.
+ * Copyright (C) 2011-2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -55,6 +56,10 @@
 #include <stdio.h>
 #include <string.h>
 
+#ifdef WIN32
+	#define snprintf _snprintf
+#endif
+
 #define MSGTYPE_SHUTDOWN	0
 #define MSGTYPE_ADVERTISEMENT	1
 #define MSGTYPE_REPLY		2
@@ -89,6 +94,8 @@ void ssdp_handle_device_request(http_message_t *hmsg, struct sockaddr_storage *d
 	int replyTime;
 	int maxAge;
 
+	memset(&job, 0, sizeof(job));
+
 	/* check man hdr. */
 	if (httpmsg_find_hdr(hmsg, HDR_MAN, &hdr_value) == NULL ||
 	    memptr_cmp(&hdr_value, "\"ssdp:discover\"") != 0)
@@ -112,8 +119,11 @@ void ssdp_handle_device_request(http_message_t *hmsg, struct sockaddr_storage *d
 
 	HandleLock();
 	/* device info. */
-	if (GetDeviceHandleInfo(dest_addr->ss_family,
+	switch (GetDeviceHandleInfo((int)dest_addr->ss_family,
-				&handle, &dev_info) != HND_DEVICE) {
+				&handle, &dev_info)) {
+	case HND_DEVICE:
+		break;
+	default:
 		HandleUnlock();
 		/* no info found. */
 		return;
@@ -177,11 +187,11 @@ static int NewRequestHandler(
 	/* a/c to UPNP Spec */
 	int ttl = 4;
 	int hops = 1;
-	char buf_ntop[64];
+	char buf_ntop[INET6_ADDRSTRLEN];
 	int ret = UPNP_E_SUCCESS;
 
-	ReplySock = socket(DestAddr->sa_family, SOCK_DGRAM, 0);
+	ReplySock = socket((int)DestAddr->sa_family, SOCK_DGRAM, 0);
-	if (ReplySock == -1) {
+	if (ReplySock == INVALID_SOCKET) {
 		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
 		UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
 			   "SSDP_LIB: New Request Handler:"
@@ -190,7 +200,8 @@ static int NewRequestHandler(
 		return UPNP_E_OUTOF_SOCKET;
 	}
 
-	if (DestAddr->sa_family == AF_INET) {
+	switch (DestAddr->sa_family) {
+	case AF_INET:
 		inet_ntop(AF_INET, &((struct sockaddr_in *)DestAddr)->sin_addr,
 			  buf_ntop, sizeof(buf_ntop));
 		setsockopt(ReplySock, IPPROTO_IP, IP_MULTICAST_IF,
@@ -198,7 +209,8 @@ static int NewRequestHandler(
 		setsockopt(ReplySock, IPPROTO_IP, IP_MULTICAST_TTL,
 			   (char *)&ttl, sizeof(int));
 		socklen = sizeof(struct sockaddr_in);
-	} else if (DestAddr->sa_family == AF_INET6) {
+		break;
+	case AF_INET6:
 		inet_ntop(AF_INET6,
 			  &((struct sockaddr_in6 *)DestAddr)->sin6_addr,
 			  buf_ntop, sizeof(buf_ntop));
@@ -206,7 +218,8 @@ static int NewRequestHandler(
 			   (char *)&gIF_INDEX, sizeof(gIF_INDEX));
 		setsockopt(ReplySock, IPPROTO_IPV6, IPV6_MULTICAST_HOPS,
 			   (char *)&hops, sizeof(hops));
-	} else {
+		break;
+	default:
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Invalid destination address specified.");
 		ret = UPNP_E_NETWORK_ERROR;
@@ -231,7 +244,12 @@ static int NewRequestHandler(
 	}
 
  end_NewRequestHandler:
-	shutdown(ReplySock, SD_BOTH);
+	ret = shutdown(ReplySock, SD_BOTH);
+	if (ret == -1) {
+		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
+		UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
+			   "Error in shutdown: %s\n", errorBuffer);
+	}
 	UpnpCloseSocket(ReplySock);
 
 	return ret;
@@ -313,7 +331,13 @@ static void CreateServicePacket(
 	/*! [out] Output buffer filled with HTTP statement. */
 	char **packet,
 	/*! [in] Address family of the HTTP request. */
-	int AddressFamily)
+	int AddressFamily,
+	/*! [in] PowerState as defined by UPnP Low Power. */
+	int PowerState,
+	/*! [in] SleepPeriod as defined by UPnP Low Power. */
+	int SleepPeriod,
+	/*! [in] RegistrationState as defined by UPnP Low Power. */
+	int RegistrationState)
 {
 	int ret_code;
 	const char *nts;
@@ -323,10 +347,41 @@ static void CreateServicePacket(
 	 * Notf == 1 means service advertisement,
 	 * Notf == 2 means reply */
 	membuffer_init(&buf);
-	buf.size_inc = 30;
+	buf.size_inc = (size_t)30;
 	*packet = NULL;
 	if (msg_type == MSGTYPE_REPLY) {
-		ret_code = http_MakeMessage(&buf, 1, 1,
+		if (PowerState > 0) {
+#ifdef UPNP_HAVE_OPTSSDP
+			ret_code = http_MakeMessage(&buf, 1, 1,
+					    "R" "sdc" "D" "sc" "ssc" "ssc" "ssc"
+					    "S" "Xc" "ssc" "ssc"
+					    "sdc" "sdc" "sdcc", HTTP_OK,
+					    "CACHE-CONTROL: max-age=", duration,
+					    "EXT:", "LOCATION: ", location,
+					    "OPT: ",
+					    "\"http://schemas.upnp.org/upnp/1/0/\"; ns=01",
+					    "01-NLS: ", gUpnpSdkNLSuuid,
+					    X_USER_AGENT, "ST: ", nt, "USN: ",
+					    usn, "Powerstate: ", PowerState,
+					    "SleepPeriod: ", SleepPeriod,
+					    "RegistrationState: ",
+					    RegistrationState);
+#else
+                        ret_code = http_MakeMessage(&buf, 1, 1,
+					    "R" "sdc" "D" "sc" "ssc"
+					    "S" "ssc" "ssc"
+					    "sdc" "sdc" "sdcc", HTTP_OK,
+					    "CACHE-CONTROL: max-age=", duration,
+					    "EXT:", "LOCATION: ", location,
+					    "ST: ", nt, "USN: ",
+					    usn, "Powerstate: ", PowerState,
+					    "SleepPeriod: ", SleepPeriod,
+					    "RegistrationState: ",
+					    RegistrationState);
+#endif /* UPNP_HAVE_OPTSSDP */
+		} else {
+#ifdef UPNP_HAVE_OPTSSDP
+			ret_code = http_MakeMessage(&buf, 1, 1,
 					    "R" "sdc" "D" "sc" "ssc" "ssc" "ssc"
 					    "S" "Xc" "ssc" "sscc", HTTP_OK,
 					    "CACHE-CONTROL: max-age=", duration,
@@ -336,6 +391,15 @@ static void CreateServicePacket(
 					    "01-NLS: ", gUpnpSdkNLSuuid,
 					    X_USER_AGENT, "ST: ", nt, "USN: ",
 					    usn);
+#else
+			ret_code = http_MakeMessage(&buf, 1, 1,
+					    "R" "sdc" "D" "sc" "ssc"
+					    "S" "ssc" "sscc", HTTP_OK,
+					    "CACHE-CONTROL: max-age=", duration,
+					    "EXT:", "LOCATION: ", location,
+					    "ST: ", nt, "USN: ", usn);
+#endif /* UPNP_HAVE_OPTSSDP */
+		}
 		if (ret_code != 0) {
 			return;
 		}
@@ -350,15 +414,51 @@ static void CreateServicePacket(
 			nts = "ssdp:byebye";
 		/* NOTE: The CACHE-CONTROL and LOCATION headers are not present in
 		 * a shutdown msg, but are present here for MS WinMe interop. */
-		if (AddressFamily == AF_INET)
+		switch (AddressFamily) {
+		case AF_INET:
 			host = SSDP_IP;
-		else {
+			break;
+		default:
 			if (isUrlV6UlaGua(location))
 				host = "[" SSDP_IPV6_SITELOCAL "]";
 			else
 				host = "[" SSDP_IPV6_LINKLOCAL "]";
 		}
-		ret_code = http_MakeMessage(&buf, 1, 1,
+		if (PowerState > 0) {
+#ifdef UPNP_HAVE_OPTSSDP
+			ret_code = http_MakeMessage(&buf, 1, 1,
+					    "Q" "sssdc" "sdc" "ssc" "ssc" "ssc"
+					    "ssc" "ssc" "S" "Xc" "ssc"
+					    "sdc" "sdc" "sdcc",
+					    HTTPMETHOD_NOTIFY, "*", (size_t) 1,
+					    "HOST: ", host, ":", SSDP_PORT,
+					    "CACHE-CONTROL: max-age=", duration,
+					    "LOCATION: ", location, "OPT: ",
+					    "\"http://schemas.upnp.org/upnp/1/0/\"; ns=01",
+					    "01-NLS: ", gUpnpSdkNLSuuid, "NT: ",
+					    nt, "NTS: ", nts, X_USER_AGENT,
+					    "USN: ", usn, "Powerstate: ",
+					    PowerState, "SleepPeriod: ",
+					    SleepPeriod, "RegistrationState: ",
+					    RegistrationState);
+#else
+			ret_code = http_MakeMessage(&buf, 1, 1,
+					    "Q" "sssdc" "sdc" "ssc"
+					    "ssc" "ssc" "S" "ssc"
+					    "sdc" "sdc" "sdcc",
+					    HTTPMETHOD_NOTIFY, "*", (size_t) 1,
+					    "HOST: ", host, ":", SSDP_PORT,
+					    "CACHE-CONTROL: max-age=", duration,
+					    "LOCATION: ", location, "NT: ", nt,
+					    "NTS: ", nts,
+					    "USN: ", usn, "Powerstate: ",
+					    PowerState, "SleepPeriod: ",
+					    SleepPeriod, "RegistrationState: ",
+					    RegistrationState);
+#endif /* UPNP_HAVE_OPTSSDP */
+		} else {
+#ifdef UPNP_HAVE_OPTSSDP 
+			ret_code = http_MakeMessage(&buf, 1, 1,
 					    "Q" "sssdc" "sdc" "ssc" "ssc" "ssc"
 					    "ssc" "ssc" "S" "Xc" "sscc",
 					    HTTPMETHOD_NOTIFY, "*", (size_t) 1,
@@ -369,6 +469,17 @@ static void CreateServicePacket(
 					    "01-NLS: ", gUpnpSdkNLSuuid, "NT: ",
 					    nt, "NTS: ", nts, X_USER_AGENT,
 					    "USN: ", usn);
+#else
+			ret_code = http_MakeMessage(&buf, 1, 1,
+					    "Q" "sssdc" "sdc" "ssc"
+					    "ssc" "ssc" "S" "sscc",
+					    HTTPMETHOD_NOTIFY, "*", (size_t) 1,
+					    "HOST: ", host, ":", SSDP_PORT,
+					    "CACHE-CONTROL: max-age=", duration,
+					    "LOCATION: ", location, "NT: ", nt,
+					    "NTS: ", nts, "USN: ", usn);
+#endif /* UPNP_HAVE_OPTSSDP */
+		}
 		if (ret_code)
 			return;
 	} else
@@ -382,7 +493,8 @@ static void CreateServicePacket(
 }
 
 int DeviceAdvertisement(char *DevType, int RootDev, char *Udn, char *Location,
-			int Duration, int AddressFamily)
+			int Duration, int AddressFamily, int PowerState,
+			int SleepPeriod, int RegistrationState)
 {
 	struct sockaddr_storage __ss;
 	struct sockaddr_in *DestAddr4 = (struct sockaddr_in *)&__ss;
@@ -390,23 +502,27 @@ int DeviceAdvertisement(char *DevType, int RootDev, char *Udn, char *Location,
 	/* char Mil_Nt[LINE_SIZE] */
 	char Mil_Usn[LINE_SIZE];
 	char *msgs[3];
-	int ret_code = UPNP_E_SUCCESS;
+	int ret_code = UPNP_E_OUTOF_MEMORY;
+	int rc = 0;
 
 	UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
 		   "In function DeviceAdvertisement\n");
 	memset(&__ss, 0, sizeof(__ss));
-	if (AddressFamily == AF_INET) {
+	switch (AddressFamily) {
-		DestAddr4->sin_family = AF_INET;
+	case AF_INET:
+		DestAddr4->sin_family = (sa_family_t)AF_INET;
 		inet_pton(AF_INET, SSDP_IP, &DestAddr4->sin_addr);
 		DestAddr4->sin_port = htons(SSDP_PORT);
-	} else if (AddressFamily == AF_INET6) {
+		break;
-		DestAddr6->sin6_family = AF_INET6;
+	case AF_INET6:
+		DestAddr6->sin6_family = (sa_family_t)AF_INET6;
 		inet_pton(AF_INET6,
 			  (isUrlV6UlaGua(Location)) ? SSDP_IPV6_SITELOCAL :
 			  SSDP_IPV6_LINKLOCAL, &DestAddr6->sin6_addr);
 		DestAddr6->sin6_port = htons(SSDP_PORT);
 		DestAddr6->sin6_scope_id = gIF_INDEX;
-	} else {
+		break;
+	default:
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Invalid device address family.\n");
 	}
@@ -416,23 +532,28 @@ int DeviceAdvertisement(char *DevType, int RootDev, char *Udn, char *Location,
 	/* If deviceis a root device , here we need to send 3 advertisement
 	 * or reply */
 	if (RootDev) {
-		sprintf(Mil_Usn, "%s::upnp:rootdevice", Udn);
+		rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::upnp:rootdevice",
+			Udn);
+		if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+			goto error_handler;
 		CreateServicePacket(MSGTYPE_ADVERTISEMENT, "upnp:rootdevice",
 				    Mil_Usn, Location, Duration, &msgs[0],
-				    AddressFamily);
+				    AddressFamily, PowerState, SleepPeriod,
+				    RegistrationState);
 	}
 	/* both root and sub-devices need to send these two messages */
 	CreateServicePacket(MSGTYPE_ADVERTISEMENT, Udn, Udn,
-			    Location, Duration, &msgs[1], AddressFamily);
+			    Location, Duration, &msgs[1], AddressFamily,
-	sprintf(Mil_Usn, "%s::%s", Udn, DevType);
+			    PowerState, SleepPeriod, RegistrationState);
+	rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::%s", Udn, DevType);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+		goto error_handler;
 	CreateServicePacket(MSGTYPE_ADVERTISEMENT, DevType, Mil_Usn,
-			    Location, Duration, &msgs[2], AddressFamily);
+			    Location, Duration, &msgs[2], AddressFamily,
+			    PowerState, SleepPeriod, RegistrationState);
 	/* check error */
 	if ((RootDev && msgs[0] == NULL) || msgs[1] == NULL || msgs[2] == NULL) {
-		free(msgs[0]);
+		goto error_handler;
-		free(msgs[1]);
-		free(msgs[2]);
-		return UPNP_E_OUTOF_MEMORY;
 	}
 	/* send packets */
 	if (RootDev) {
@@ -445,6 +566,8 @@ int DeviceAdvertisement(char *DevType, int RootDev, char *Udn, char *Location,
 		ret_code =
 		    NewRequestHandler((struct sockaddr *)&__ss, 2, &msgs[1]);
 	}
+
+error_handler:
 	/* free msgs */
 	free(msgs[0]);
 	free(msgs[1]);
@@ -454,13 +577,15 @@ int DeviceAdvertisement(char *DevType, int RootDev, char *Udn, char *Location,
 }
 
 int SendReply(struct sockaddr *DestAddr, char *DevType, int RootDev,
-	      char *Udn, char *Location, int Duration, int ByType)
+	      char *Udn, char *Location, int Duration, int ByType,
+	      int PowerState, int SleepPeriod, int RegistrationState)
 {
-	int ret_code;
+	int ret_code = UPNP_E_OUTOF_MEMORY;
 	char *msgs[2];
 	int num_msgs;
 	char Mil_Usn[LINE_SIZE];
 	int i;
+	int rc = 0;
 
 	msgs[0] = NULL;
 	msgs[1] = NULL;
@@ -468,10 +593,14 @@ int SendReply(struct sockaddr *DestAddr, char *DevType, int RootDev,
 		/* one msg for root device */
 		num_msgs = 1;
 
-		sprintf(Mil_Usn, "%s::upnp:rootdevice", Udn);
+		rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::upnp:rootdevice",
+			Udn);
+		if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+			goto error_handler;
 		CreateServicePacket(MSGTYPE_REPLY, "upnp:rootdevice",
 				    Mil_Usn, Location, Duration, &msgs[0],
-				    DestAddr->sa_family);
+				    (int)DestAddr->sa_family, PowerState,
+				    SleepPeriod, RegistrationState);
 	} else {
 		/* two msgs for embedded devices */
 		num_msgs = 1;
@@ -480,23 +609,29 @@ int SendReply(struct sockaddr *DestAddr, char *DevType, int RootDev,
 		if (!ByType) {
 			CreateServicePacket(MSGTYPE_REPLY, Udn, Udn, Location,
 					    Duration, &msgs[0],
-					    DestAddr->sa_family);
+					    (int)DestAddr->sa_family, PowerState,
+					    SleepPeriod, RegistrationState);
 		} else {
-			sprintf(Mil_Usn, "%s::%s", Udn, DevType);
+			rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::%s", Udn,
+				DevType);
+			if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+				goto error_handler;
 			CreateServicePacket(MSGTYPE_REPLY, DevType, Mil_Usn,
 					    Location, Duration, &msgs[0],
-					    DestAddr->sa_family);
+					    (int)DestAddr->sa_family, PowerState,
+					    SleepPeriod, RegistrationState);
 		}
 	}
 	/* check error */
 	for (i = 0; i < num_msgs; i++) {
 		if (msgs[i] == NULL) {
-			free(msgs[0]);
+			goto error_handler;
-			return UPNP_E_OUTOF_MEMORY;
 		}
 	}
 	/* send msgs */
 	ret_code = NewRequestHandler(DestAddr, num_msgs, msgs);
+
+error_handler:
 	for (i = 0; i < num_msgs; i++) {
 		if (msgs[i] != NULL)
 			free(msgs[i]);
@@ -506,10 +641,12 @@ int SendReply(struct sockaddr *DestAddr, char *DevType, int RootDev,
 }
 
 int DeviceReply(struct sockaddr *DestAddr, char *DevType, int RootDev,
-		char *Udn, char *Location, int Duration)
+		char *Udn, char *Location, int Duration, int PowerState,
+		int SleepPeriod, int RegistrationState)
 {
 	char *szReq[3], Mil_Nt[LINE_SIZE], Mil_Usn[LINE_SIZE];
-	int RetVal;
+	int RetVal = UPNP_E_OUTOF_MEMORY;
+	int rc = 0;
 
 	szReq[0] = NULL;
 	szReq[1] = NULL;
@@ -517,27 +654,38 @@ int DeviceReply(struct sockaddr *DestAddr, char *DevType, int RootDev,
 	/* create 2 or 3 msgs */
 	if (RootDev) {
 		/* 3 replies for root device */
-		strcpy(Mil_Nt, "upnp:rootdevice");
+		memset(Mil_Nt, 0, sizeof(Mil_Nt));
-		sprintf(Mil_Usn, "%s::upnp:rootdevice", Udn);
+		strncpy(Mil_Nt, "upnp:rootdevice", sizeof(Mil_Nt) - 1);
+		rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::upnp:rootdevice", Udn);
+		if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+			goto error_handler;
 		CreateServicePacket(MSGTYPE_REPLY, Mil_Nt, Mil_Usn,
 				    Location, Duration, &szReq[0],
-				    DestAddr->sa_family);
+				    (int)DestAddr->sa_family, PowerState,
+				    SleepPeriod, RegistrationState);
 	}
-	sprintf(Mil_Nt, "%s", Udn);
+	rc = snprintf(Mil_Nt, sizeof(Mil_Nt), "%s", Udn);
-	sprintf(Mil_Usn, "%s", Udn);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Nt))
+		goto error_handler;
+	rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s", Udn);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+		goto error_handler;
 	CreateServicePacket(MSGTYPE_REPLY, Mil_Nt, Mil_Usn,
-			    Location, Duration, &szReq[1], DestAddr->sa_family);
+			    Location, Duration, &szReq[1], (int)DestAddr->sa_family,
-	sprintf(Mil_Nt, "%s", DevType);
+			    PowerState, SleepPeriod, RegistrationState);
-	sprintf(Mil_Usn, "%s::%s", Udn, DevType);
+	rc = snprintf(Mil_Nt, sizeof(Mil_Nt), "%s", DevType);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Nt))
+		goto error_handler;
+	rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::%s", Udn, DevType);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+		goto error_handler;
 	CreateServicePacket(MSGTYPE_REPLY, Mil_Nt, Mil_Usn,
-			    Location, Duration, &szReq[2], DestAddr->sa_family);
+			    Location, Duration, &szReq[2], (int)DestAddr->sa_family,
+			    PowerState, SleepPeriod, RegistrationState);
 	/* check error */
 	if ((RootDev && szReq[0] == NULL) ||
 	    szReq[1] == NULL || szReq[2] == NULL) {
-		free(szReq[0]);
+		goto error_handler;
-		free(szReq[1]);
-		free(szReq[2]);
-		return UPNP_E_OUTOF_MEMORY;
 	}
 	/* send replies */
 	if (RootDev) {
@@ -545,6 +693,8 @@ int DeviceReply(struct sockaddr *DestAddr, char *DevType, int RootDev,
 	} else {
 		RetVal = NewRequestHandler(DestAddr, 2, &szReq[1]);
 	}
+
+error_handler:
 	/* free */
 	free(szReq[0]);
 	free(szReq[1]);
@@ -554,154 +704,193 @@ int DeviceReply(struct sockaddr *DestAddr, char *DevType, int RootDev,
 }
 
 int ServiceAdvertisement(char *Udn, char *ServType, char *Location,
-			 int Duration, int AddressFamily)
+			 int Duration, int AddressFamily,
+			 int PowerState, int SleepPeriod, int RegistrationState)
 {
 	char Mil_Usn[LINE_SIZE];
 	char *szReq[1];
-	int RetVal = UPNP_E_SUCCESS;
+	int RetVal = UPNP_E_OUTOF_MEMORY;
 	struct sockaddr_storage __ss;
 	struct sockaddr_in *DestAddr4 = (struct sockaddr_in *)&__ss;
 	struct sockaddr_in6 *DestAddr6 = (struct sockaddr_in6 *)&__ss;
+	int rc = 0;
 
 	memset(&__ss, 0, sizeof(__ss));
-	if (AddressFamily == AF_INET) {
+	szReq[0] = NULL;
-		DestAddr4->sin_family = AF_INET;
+	switch (AddressFamily) {
+	case AF_INET:
+		DestAddr4->sin_family = (sa_family_t)AddressFamily;
 		inet_pton(AF_INET, SSDP_IP, &DestAddr4->sin_addr);
 		DestAddr4->sin_port = htons(SSDP_PORT);
-	} else if (AddressFamily == AF_INET6) {
+		break;
-		DestAddr6->sin6_family = AF_INET6;
+	case AF_INET6:
+		DestAddr6->sin6_family = (sa_family_t)AddressFamily;
 		inet_pton(AF_INET6,
 			  (isUrlV6UlaGua(Location)) ? SSDP_IPV6_SITELOCAL :
 			  SSDP_IPV6_LINKLOCAL, &DestAddr6->sin6_addr);
 		DestAddr6->sin6_port = htons(SSDP_PORT);
 		DestAddr6->sin6_scope_id = gIF_INDEX;
-	} else {
+		break;
+	default:
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Invalid device address family.\n");
 	}
-	sprintf(Mil_Usn, "%s::%s", Udn, ServType);
+	rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::%s", Udn, ServType);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+		goto error_handler;
 	/* CreateServiceRequestPacket(1,szReq[0],Mil_Nt,Mil_Usn,
 	 * Server,Location,Duration); */
 	CreateServicePacket(MSGTYPE_ADVERTISEMENT, ServType, Mil_Usn,
-			    Location, Duration, &szReq[0], AddressFamily);
+			    Location, Duration, &szReq[0], AddressFamily,
+			    PowerState, SleepPeriod, RegistrationState);
 	if (szReq[0] == NULL) {
-		return UPNP_E_OUTOF_MEMORY;
+		goto error_handler;
 	}
 	RetVal = NewRequestHandler((struct sockaddr *)&__ss, 1, szReq);
+
+error_handler:
 	free(szReq[0]);
 
 	return RetVal;
 }
 
 int ServiceReply(struct sockaddr *DestAddr, char *ServType, char *Udn,
-		 char *Location, int Duration)
+		 char *Location, int Duration, int PowerState, int SleepPeriod,
+		 int RegistrationState)
 {
 	char Mil_Usn[LINE_SIZE];
 	char *szReq[1];
-	int RetVal;
+	int RetVal = UPNP_E_OUTOF_MEMORY;
+	int rc = 0;
 
 	szReq[0] = NULL;
-	sprintf(Mil_Usn, "%s::%s", Udn, ServType);
+	rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::%s", Udn, ServType);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+		goto error_handler;
 	CreateServicePacket(MSGTYPE_REPLY, ServType, Mil_Usn,
-			    Location, Duration, &szReq[0], DestAddr->sa_family);
+			    Location, Duration, &szReq[0], (int)DestAddr->sa_family,
+			    PowerState, SleepPeriod, RegistrationState);
 	if (szReq[0] == NULL)
-		return UPNP_E_OUTOF_MEMORY;
+		goto error_handler;
 	RetVal = NewRequestHandler(DestAddr, 1, szReq);
+
+error_handler:
 	free(szReq[0]);
 
 	return RetVal;
 }
 
 int ServiceShutdown(char *Udn, char *ServType, char *Location, int Duration,
-		    int AddressFamily)
+		    int AddressFamily, int PowerState,
+		    int SleepPeriod, int RegistrationState)
 {
 	char Mil_Usn[LINE_SIZE];
 	char *szReq[1];
 	struct sockaddr_storage __ss;
 	struct sockaddr_in *DestAddr4 = (struct sockaddr_in *)&__ss;
 	struct sockaddr_in6 *DestAddr6 = (struct sockaddr_in6 *)&__ss;
-	int RetVal = UPNP_E_SUCCESS;
+	int RetVal = UPNP_E_OUTOF_MEMORY;
+	int rc = 0;
 
 	memset(&__ss, 0, sizeof(__ss));
-	if (AddressFamily == AF_INET) {
+	szReq[0] = NULL;
-		DestAddr4->sin_family = AF_INET;
+	switch (AddressFamily) {
+	case AF_INET:
+		DestAddr4->sin_family = (sa_family_t)AddressFamily;
 		inet_pton(AF_INET, SSDP_IP, &DestAddr4->sin_addr);
 		DestAddr4->sin_port = htons(SSDP_PORT);
-	} else if (AddressFamily == AF_INET6) {
+		break;
-		DestAddr6->sin6_family = AF_INET6;
+	case AF_INET6:
+		DestAddr6->sin6_family = (sa_family_t)AddressFamily;
 		inet_pton(AF_INET6,
 			  (isUrlV6UlaGua(Location)) ? SSDP_IPV6_SITELOCAL :
 			  SSDP_IPV6_LINKLOCAL, &DestAddr6->sin6_addr);
 		DestAddr6->sin6_port = htons(SSDP_PORT);
 		DestAddr6->sin6_scope_id = gIF_INDEX;
-	} else {
+		break;
+	default:
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Invalid device address family.\n");
 	}
 	/* sprintf(Mil_Nt,"%s",ServType); */
-	sprintf(Mil_Usn, "%s::%s", Udn, ServType);
+	rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::%s", Udn, ServType);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+		goto error_handler;
 	/* CreateServiceRequestPacket(0,szReq[0],Mil_Nt,Mil_Usn,
 	 * Server,Location,Duration); */
 	CreateServicePacket(MSGTYPE_SHUTDOWN, ServType, Mil_Usn,
-			    Location, Duration, &szReq[0], AddressFamily);
+			    Location, Duration, &szReq[0], AddressFamily,
+			    PowerState, SleepPeriod, RegistrationState);
 	if (szReq[0] == NULL)
-		return UPNP_E_OUTOF_MEMORY;
+		goto error_handler;
 	RetVal = NewRequestHandler((struct sockaddr *)&__ss, 1, szReq);
+
+error_handler:
 	free(szReq[0]);
 
 	return RetVal;
 }
 
-int DeviceShutdown(char *DevType, int RootDev, char *Udn, char *_Server,
+int DeviceShutdown(char *DevType, int RootDev, char *Udn,
-		   char *Location, int Duration, int AddressFamily)
+		   char *Location, int Duration, int AddressFamily,
+		   int PowerState, int SleepPeriod, int RegistrationState)
 {
 	struct sockaddr_storage __ss;
 	struct sockaddr_in *DestAddr4 = (struct sockaddr_in *)&__ss;
 	struct sockaddr_in6 *DestAddr6 = (struct sockaddr_in6 *)&__ss;
 	char *msgs[3];
 	char Mil_Usn[LINE_SIZE];
-	int ret_code = UPNP_E_SUCCESS;
+	int ret_code = UPNP_E_OUTOF_MEMORY;
+	int rc = 0;
 
 	msgs[0] = NULL;
 	msgs[1] = NULL;
 	msgs[2] = NULL;
 	memset(&__ss, 0, sizeof(__ss));
-	if (AddressFamily == AF_INET) {
+	switch (AddressFamily) {
-		DestAddr4->sin_family = AF_INET;
+	case AF_INET:
+		DestAddr4->sin_family = (sa_family_t)AddressFamily;
 		inet_pton(AF_INET, SSDP_IP, &DestAddr4->sin_addr);
 		DestAddr4->sin_port = htons(SSDP_PORT);
-	} else if (AddressFamily == AF_INET6) {
+		break;
-		DestAddr6->sin6_family = AF_INET6;
+	case AF_INET6:
+		DestAddr6->sin6_family = (sa_family_t)AddressFamily;
 		inet_pton(AF_INET6,
 			  (isUrlV6UlaGua(Location)) ? SSDP_IPV6_SITELOCAL :
 			  SSDP_IPV6_LINKLOCAL, &DestAddr6->sin6_addr);
 		DestAddr6->sin6_port = htons(SSDP_PORT);
 		DestAddr6->sin6_scope_id = gIF_INDEX;
-	} else {
+		break;
+	default:
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Invalid device address family.\n");
 	}
 	/* root device has one extra msg */
 	if (RootDev) {
-		sprintf(Mil_Usn, "%s::upnp:rootdevice", Udn);
+		rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::upnp:rootdevice",
+			Udn);
+		if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+			goto error_handler;
 		CreateServicePacket(MSGTYPE_SHUTDOWN, "upnp:rootdevice",
 				    Mil_Usn, Location, Duration, &msgs[0],
-				    AddressFamily);
+				    AddressFamily, PowerState, SleepPeriod,
+				    RegistrationState);
 	}
 	UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
 		   "In function DeviceShutdown\n");
 	/* both root and sub-devices need to send these two messages */
 	CreateServicePacket(MSGTYPE_SHUTDOWN, Udn, Udn,
-			    Location, Duration, &msgs[1], AddressFamily);
+			    Location, Duration, &msgs[1], AddressFamily,
-	sprintf(Mil_Usn, "%s::%s", Udn, DevType);
+			    PowerState, SleepPeriod, RegistrationState);
+	rc = snprintf(Mil_Usn, sizeof(Mil_Usn), "%s::%s", Udn, DevType);
+	if (rc < 0 || (unsigned int) rc >= sizeof(Mil_Usn))
+		goto error_handler;
 	CreateServicePacket(MSGTYPE_SHUTDOWN, DevType, Mil_Usn,
-			    Location, Duration, &msgs[2], AddressFamily);
+			    Location, Duration, &msgs[2], AddressFamily,
+			    PowerState, SleepPeriod, RegistrationState);
 	/* check error */
 	if ((RootDev && msgs[0] == NULL) || msgs[1] == NULL || msgs[2] == NULL) {
-		free(msgs[0]);
+		goto error_handler;
-		free(msgs[1]);
-		free(msgs[2]);
-		return UPNP_E_OUTOF_MEMORY;
 	}
 	/* send packets */
 	if (RootDev) {
@@ -714,13 +903,14 @@ int DeviceShutdown(char *DevType, int RootDev, char *Udn, char *_Server,
 		ret_code =
 		    NewRequestHandler((struct sockaddr *)&__ss, 2, &msgs[1]);
 	}
+
+error_handler:
 	/* free msgs */
 	free(msgs[0]);
 	free(msgs[1]);
 	free(msgs[2]);
 
 	return ret_code;
-	_Server = _Server;
 }
 #endif /* EXCLUDE_SSDP */
 #endif /* INCLUDE_DEVICE_APIS */

upnp/src/ssdp/ssdp_server.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (C) 2011-2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -39,6 +40,8 @@
 
 #ifndef WIN32
 	#include <sys/param.h>
+#else
+	#define snprintf _snprintf
 #endif /* WIN32 */
 
 #include "config.h"
@@ -105,10 +108,13 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 	IXML_Node *tmpNode2 = NULL;
 	IXML_Node *textNode = NULL;
 	const DOMString tmpStr;
-	char SERVER[200];
 	const DOMString dbgStr;
 	int NumCopy = 0;
 
+	memset(UDNstr, 0, sizeof(UDNstr));
+	memset(devType, 0, sizeof(devType));
+	memset(servType, 0, sizeof(servType));
+
 	UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
 		   "Inside AdvertiseAndReply with AdFlag = %d\n", AdFlag);
 
@@ -119,14 +125,12 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 		goto end_function;
 	}
 	defaultExp = SInfo->MaxAge;
-	/* get server info */
-	get_sdk_info(SERVER);
 	/* parse the device list and send advertisements/replies */
 	while (NumCopy == 0 || (AdFlag && NumCopy < NUM_SSDP_COPY)) {
 		if (NumCopy != 0)
 			imillisleep(SSDP_PAUSE);
 		NumCopy++;
-		for (i = 0;; i++) {
+		for (i = 0lu;; i++) {
 			UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
 				   "Entering new device list with i = %lu\n\n",
 				   i);
@@ -147,10 +151,9 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 				continue;
 			UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
 				   "Extracting UDN for %s\n", dbgStr);
-			dbgStr = ixmlNode_getNodeName(tmpNode);
 			UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
 				   "Extracting device type\n");
-			tmpNode2 = ixmlNodeList_item(nodeList, 0);
+			tmpNode2 = ixmlNodeList_item(nodeList, 0lu);
 			if (!tmpNode2)
 				continue;
 			textNode = ixmlNode_getFirstChild(tmpNode2);
@@ -161,7 +164,7 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 			tmpStr = ixmlNode_getNodeValue(textNode);
 			if (!tmpStr)
 				continue;
-			strcpy(devType, tmpStr);
+			strncpy(devType, tmpStr, sizeof(devType) - 1);
 			UpnpPrintf(UPNP_ALL, API, __FILE__, __LINE__,
 				   "Extracting device type = %s\n", devType);
 			if (!tmpNode) {
@@ -178,7 +181,7 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 					   __LINE__, "UDN not found!\n");
 				continue;
 			}
-			tmpNode2 = ixmlNodeList_item(nodeList, 0);
+			tmpNode2 = ixmlNodeList_item(nodeList, 0lu);
 			if (!tmpNode2) {
 				UpnpPrintf(UPNP_CRITICAL, API, __FILE__,
 					   __LINE__, "UDN not found!\n");
@@ -196,39 +199,50 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 					   __LINE__, "UDN not found!\n");
 				continue;
 			}
-			strcpy(UDNstr, tmpStr);
+			strncpy(UDNstr, tmpStr, sizeof(UDNstr) - 1);
 			UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 				   "Sending UDNStr = %s \n", UDNstr);
 			if (AdFlag) {
 				/* send the device advertisement */
 				if (AdFlag == 1) {
-					DeviceAdvertisement(devType, i == 0,
+					DeviceAdvertisement(devType, i == 0lu,
 							    UDNstr,
 							    SInfo->DescURL, Exp,
-							    SInfo->DeviceAf);
+							    SInfo->DeviceAf,
+							    SInfo->PowerState,
+	                                                    SInfo->SleepPeriod,
+	                                                    SInfo->RegistrationState);
 				} else {
 					/* AdFlag == -1 */
-					DeviceShutdown(devType, i == 0, UDNstr,
+					DeviceShutdown(devType, i == 0lu, UDNstr,
-						       SERVER, SInfo->DescURL,
+						       SInfo->DescURL,
-						       Exp, SInfo->DeviceAf);
+						       Exp, SInfo->DeviceAf,
+						       SInfo->PowerState,
+						       SInfo->SleepPeriod,
+						       SInfo->RegistrationState);
 				}
 			} else {
 				switch (SearchType) {
 				case SSDP_ALL:
-					DeviceReply(DestAddr, devType, i == 0,
+					DeviceReply(DestAddr, devType, i == 0lu,
 						    UDNstr, SInfo->DescURL,
-						    defaultExp);
+						    defaultExp, SInfo->PowerState,
+						    SInfo->SleepPeriod,
+						    SInfo->RegistrationState);
 					break;
 				case SSDP_ROOTDEVICE:
-					if (i == 0) {
+					if (i == 0lu) {
 						SendReply(DestAddr, devType, 1,
 							  UDNstr,
 							  SInfo->DescURL,
-							  defaultExp, 0);
+							  defaultExp, 0,
+							  SInfo->PowerState,
+							  SInfo->SleepPeriod,
+							  SInfo->RegistrationState);
 					}
 					break;
 				case SSDP_DEVICEUDN: {
-					if (DeviceUDN && strlen(DeviceUDN) != 0) {
+					if (DeviceUDN && strlen(DeviceUDN) != (size_t)0) {
 						if (strcasecmp(DeviceUDN, UDNstr)) {
 							UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 								"DeviceUDN=%s and search UDN=%s DID NOT match\n",
@@ -238,15 +252,18 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 							UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 								"DeviceUDN=%s and search UDN=%s MATCH\n",
 								UDNstr, DeviceUDN);
-							SendReply(DestAddr, devType, 0, UDNstr, SInfo->DescURL, defaultExp, 0);
+							SendReply(DestAddr, devType, 0, UDNstr, SInfo->DescURL, defaultExp, 0,
+								SInfo->PowerState,
+								SInfo->SleepPeriod,
+								SInfo->RegistrationState);
 							break;
 						}
 					}
 				}
 				case SSDP_DEVICETYPE: {
-					if (!strncasecmp(DeviceType, devType, strlen(DeviceType) - 2)) {
+					if (!strncasecmp(DeviceType, devType, strlen(DeviceType) - (size_t)2)) {
 						if (atoi(strrchr(DeviceType, ':') + 1)
-						    < atoi(&devType[strlen(devType) - 1])) {
+						    < atoi(&devType[strlen(devType) - (size_t)1])) {
 							/* the requested version is lower than the device version
 							 * must reply with the lower version number and the lower
 							 * description URL */
@@ -254,14 +271,20 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 								   "DeviceType=%s and search devType=%s MATCH\n",
 								   devType, DeviceType);
 							SendReply(DestAddr, DeviceType, 0, UDNstr, SInfo->LowerDescURL,
-								  defaultExp, 1);
+								  defaultExp, 1,
+								  SInfo->PowerState,
+								  SInfo->SleepPeriod,
+								  SInfo->RegistrationState);
 						} else if (atoi(strrchr(DeviceType, ':') + 1)
-							   == atoi(&devType[strlen(devType) - 1])) {
+							   == atoi(&devType[strlen(devType) - (size_t)1])) {
 							UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 								   "DeviceType=%s and search devType=%s MATCH\n",
 								   devType, DeviceType);
 							SendReply(DestAddr, DeviceType, 0, UDNstr, SInfo->DescURL,
-								  defaultExp, 1);
+								  defaultExp, 1,
+								  SInfo->PowerState,
+								  SInfo->SleepPeriod,
+								  SInfo->RegistrationState);
 						} else {
 							UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 								   "DeviceType=%s and search devType=%s DID NOT MATCH\n",
@@ -307,7 +330,7 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 					   "Service not found 3\n");
 				continue;
 			}
-			for (j = 0;; j++) {
+			for (j = 0lu;; j++) {
 				tmpNode = ixmlNodeList_item(nodeList, j);
 				if (!tmpNode) {
 					break;
@@ -320,7 +343,7 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 						   "ServiceType not found \n");
 					continue;
 				}
-				tmpNode2 = ixmlNodeList_item(tmpNodeList, 0);
+				tmpNode2 = ixmlNodeList_item(tmpNodeList, 0lu);
 				if (!tmpNode2)
 					continue;
 				textNode = ixmlNode_getFirstChild(tmpNode2);
@@ -330,19 +353,25 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 				tmpStr = ixmlNode_getNodeValue(textNode);
 				if (!tmpStr)
 					continue;
-				strcpy(servType, tmpStr);
+				strncpy(servType, tmpStr, sizeof(servType) - 1);
 				UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 					   "ServiceType = %s\n", servType);
 				if (AdFlag) {
 					if (AdFlag == 1) {
 						ServiceAdvertisement(UDNstr,
 							servType, SInfo->DescURL,
-							Exp, SInfo->DeviceAf);
+							Exp, SInfo->DeviceAf,
+							SInfo->PowerState,
+							SInfo->SleepPeriod,
+							SInfo->RegistrationState);
 					} else {
 						/* AdFlag == -1 */
 						ServiceShutdown(UDNstr,
 							servType, SInfo->DescURL,
-							Exp, SInfo->DeviceAf);
+							Exp, SInfo->DeviceAf,
+							SInfo->PowerState,
+							SInfo->SleepPeriod,
+							SInfo->RegistrationState);
 					}
 				} else {
 					switch (SearchType) {
@@ -350,13 +379,16 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 						ServiceReply(DestAddr, servType,
 							     UDNstr,
 							     SInfo->DescURL,
-							     defaultExp);
+							     defaultExp,
+							     SInfo->PowerState,
+							     SInfo->SleepPeriod,
+							     SInfo->RegistrationState);
 						break;
 					case SSDP_SERVICE:
 						if (ServiceType) {
-							if (!strncasecmp(ServiceType, servType, strlen(ServiceType) - 2)) {
+							if (!strncasecmp(ServiceType, servType, strlen(ServiceType) - (size_t)2)) {
 								if (atoi(strrchr(ServiceType, ':') + 1) <
-								    atoi(&servType[strlen(servType) - 1])) {
+								    atoi(&servType[strlen(servType) - (size_t)1])) {
 									/* the requested version is lower than the service version
 									 * must reply with the lower version number and the lower
 									 * description URL */
@@ -364,14 +396,20 @@ int AdvertiseAndReply(int AdFlag, UpnpDevice_Handle Hnd,
 										   "ServiceType=%s and search servType=%s MATCH\n",
 										   ServiceType, servType);
 									SendReply(DestAddr, ServiceType, 0, UDNstr, SInfo->LowerDescURL,
-										  defaultExp, 1);
+										  defaultExp, 1,
+										  SInfo->PowerState,
+										  SInfo->SleepPeriod,
+										  SInfo->RegistrationState);
 								} else if (atoi(strrchr (ServiceType, ':') + 1) ==
-									   atoi(&servType[strlen(servType) - 1])) {
+									   atoi(&servType[strlen(servType) - (size_t)1])) {
 									UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 										   "ServiceType=%s and search servType=%s MATCH\n",
 										   ServiceType, servType);
 									SendReply(DestAddr, ServiceType, 0, UDNstr, SInfo->DescURL,
-										  defaultExp, 1);
+										  defaultExp, 1,
+										  SInfo->PowerState,
+										  SInfo->SleepPeriod,
+										  SInfo->RegistrationState);
 								} else {
 									UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 									   "ServiceType=%s and search servType=%s DID NOT MATCH\n",
@@ -416,9 +454,9 @@ int unique_service_name(char *cmd, SsdpEvent *Evt)
 	char *ptr2 = NULL;
 	char *ptr3 = NULL;
 	int CommandFound = 0;
-	size_t n = 0;
+	size_t n = (size_t)0;
 
-	if ((TempPtr = strstr(cmd, "uuid:schemas")) != NULL) {
+	if (strstr(cmd, "uuid:schemas") != NULL) {
 		ptr1 = strstr(cmd, ":device");
 		if (ptr1 != NULL)
 			ptr2 = strstr(ptr1 + 1, ":");
@@ -428,45 +466,58 @@ int unique_service_name(char *cmd, SsdpEvent *Evt)
 			ptr3 = strstr(ptr2 + 1, ":");
 		else
 			return -1;
-		if (ptr3 != NULL)
+		if (ptr3 != NULL) {
-			sprintf(Evt->UDN, "uuid:%s", ptr3 + 1);
+			if (strlen("uuid:") + strlen(ptr3 + 1) >= sizeof(Evt->UDN))
+				return -1;
+			snprintf(Evt->UDN, sizeof(Evt->UDN), "uuid:%s",
+				ptr3 + 1);
+		}
 		else
 			return -1;
 		ptr1 = strstr(cmd, ":");
 		if (ptr1 != NULL) {
-			n = (size_t) (ptr3 - ptr1);
+			n = (size_t)ptr3 - (size_t)ptr1;
 			strncpy(TempBuf, ptr1, n);
 			TempBuf[n] = '\0';
-			sprintf(Evt->DeviceType, "urn%s", TempBuf);
+			if (strlen("urn") + strlen(TempBuf) >= sizeof(Evt->DeviceType))
+				return -1;
+			snprintf(Evt->DeviceType, sizeof(Evt->DeviceType),
+				"urn%s", TempBuf);
 		} else
 			return -1;
 		return 0;
 	}
 	if ((TempPtr = strstr(cmd, "uuid")) != NULL) {
 		if ((Ptr = strstr(cmd, "::")) != NULL) {
-			n = (size_t) (Ptr - TempPtr);
+			n = (size_t)Ptr - (size_t)TempPtr;
 			strncpy(Evt->UDN, TempPtr, n);
 			Evt->UDN[n] = '\0';
-		} else
+		} else {
-			strcpy(Evt->UDN, TempPtr);
+			memset(Evt->UDN, 0, sizeof(Evt->UDN));
+			strncpy(Evt->UDN, TempPtr, sizeof(Evt->UDN) - 1);
+		}
 		CommandFound = 1;
 	}
 	if (strstr(cmd, "urn:") != NULL && strstr(cmd, ":service:") != NULL) {
 		if ((TempPtr = strstr(cmd, "urn")) != NULL) {
-			strcpy(Evt->ServiceType, TempPtr);
+			memset(Evt->ServiceType, 0, sizeof(Evt->ServiceType));
+			strncpy(Evt->ServiceType, TempPtr,
+				sizeof(Evt->ServiceType) - 1);
 			CommandFound = 1;
 		}
 	}
 	if (strstr(cmd, "urn:") != NULL && strstr(cmd, ":device:") != NULL) {
 		if ((TempPtr = strstr(cmd, "urn")) != NULL) {
-			strcpy(Evt->DeviceType, TempPtr);
+			memset(Evt->DeviceType, 0, sizeof(Evt->DeviceType));
+			strncpy(Evt->DeviceType, TempPtr,
+				sizeof(Evt->DeviceType) - 1);
 			CommandFound = 1;
 		}
 	}
 	if ((TempPtr = strstr(cmd, "::upnp:rootdevice")) != NULL) {
 		/* Everything before "::upnp::rootdevice" is the UDN. */
 		if (TempPtr != cmd) {
-			n = (size_t) (TempPtr - cmd);
+			n = (size_t)TempPtr - (size_t)cmd;
 			strncpy(Evt->UDN, cmd, n);
 			Evt->UDN[n] = 0;
 			CommandFound = 1;
@@ -537,14 +588,14 @@ static UPNP_INLINE int valid_ssdp_msg(
 	memptr hdr_value;
 
 	/* check for valid methods - NOTIFY or M-SEARCH */
-	if (hmsg->method != HTTPMETHOD_NOTIFY &&
+	if (hmsg->method != (http_method_t)HTTPMETHOD_NOTIFY &&
-	    hmsg->method != HTTPMETHOD_MSEARCH &&
+	    hmsg->method != (http_method_t)HTTPMETHOD_MSEARCH &&
-	    hmsg->request_method != HTTPMETHOD_MSEARCH) {
+	    hmsg->request_method != (http_method_t)HTTPMETHOD_MSEARCH) {
 		return FALSE;
 	}
-	if (hmsg->request_method != HTTPMETHOD_MSEARCH) {
+	if (hmsg->request_method != (http_method_t)HTTPMETHOD_MSEARCH) {
 		/* check PATH == "*" */
-		if (hmsg->uri.type != RELATIVE ||
+		if (hmsg->uri.type != (enum uriType)RELATIVE ||
 		    strncmp("*", hmsg->uri.pathquery.buff,
 			    hmsg->uri.pathquery.size) != 0) {
 			return FALSE;
@@ -584,8 +635,8 @@ static UPNP_INLINE int start_event_handler(
 
 	parser = &data->parser;
 	status = parser_parse(parser);
-	if (status == PARSE_FAILURE) {
+	if (status == (parse_status_t)PARSE_FAILURE) {
-		if (parser->msg.method != HTTPMETHOD_NOTIFY ||
+		if (parser->msg.method != (http_method_t)HTTPMETHOD_NOTIFY ||
 		    !parser->valid_ssdp_notify_hack) {
 			UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
 				   "SSDP recvd bad msg code = %d\n", status);
@@ -593,7 +644,7 @@ static UPNP_INLINE int start_event_handler(
 			goto error_handler;
 		}
 		/* valid notify msg */
-	} else if (status != PARSE_SUCCESS) {
+	} else if (status != (parse_status_t)PARSE_SUCCESS) {
 		UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
 			   "SSDP recvd bad msg code = %d\n", status);
 
@@ -625,8 +676,8 @@ static void ssdp_event_handler_thread(
 	if (start_event_handler(the_data) != 0)
 		return;
 	/* send msg to device or ctrlpt */
-	if (hmsg->method == HTTPMETHOD_NOTIFY ||
+	if (hmsg->method == (http_method_t)HTTPMETHOD_NOTIFY ||
-	    hmsg->request_method == HTTPMETHOD_MSEARCH) {
+	    hmsg->request_method == (http_method_t)HTTPMETHOD_MSEARCH) {
 #ifdef INCLUDE_CLIENT_APIS
 		ssdp_handle_ctrlpt_msg(hmsg,
 				       &data->dest_addr,
@@ -650,7 +701,9 @@ void readFromSSDPSocket(SOCKET socket)
 	ssdp_thread_data *data = NULL;
 	socklen_t socklen = sizeof(__ss);
 	ssize_t byteReceived = 0;
-	char ntop_buf[64];
+	char ntop_buf[INET6_ADDRSTRLEN];
+
+	memset(&job, 0, sizeof(job));
 
 	requestBuf = staticBuf;
 	/* in case memory can't be allocated, still drain the socket using a
@@ -679,23 +732,28 @@ void readFromSSDPSocket(SOCKET socket)
 			data = NULL;
 		}
 	}
-	byteReceived = recvfrom(socket, requestBuf, BUFSIZE - 1, 0,
+	byteReceived = recvfrom(socket, requestBuf, BUFSIZE - (size_t)1, 0,
 				(struct sockaddr *)&__ss, &socklen);
 	if (byteReceived > 0) {
 		requestBuf[byteReceived] = '\0';
-		if (__ss.ss_family == AF_INET)
+		switch (__ss.ss_family) {
+		case AF_INET:
 			inet_ntop(AF_INET,
 				  &((struct sockaddr_in *)&__ss)->sin_addr,
 				  ntop_buf, sizeof(ntop_buf));
+			break;
 #ifdef UPNP_ENABLE_IPV6
-		else if (__ss.ss_family == AF_INET6)
+		case AF_INET6:
 			inet_ntop(AF_INET6,
 				  &((struct sockaddr_in6 *)&__ss)->sin6_addr,
 				  ntop_buf, sizeof(ntop_buf));
+			break;
 #endif /* UPNP_ENABLE_IPV6 */
-		else
+		default:
+			memset(ntop_buf, 0, sizeof(ntop_buf));
 			strncpy(ntop_buf, "<Invalid address family>",
-				sizeof(ntop_buf));
+				sizeof(ntop_buf) - 1);
+		}
 		UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
 			   "Start of received response ----------------------------------------------------\n"
 			   "%s\n"
@@ -728,7 +786,7 @@ static int create_ssdp_sock_v4(
 {
 	char errorBuffer[ERROR_BUFFER_LEN];
 	int onOff;
-	u_char ttl = 4;
+	u_char ttl = (u_char)4;
 	struct ip_mreq ssdpMcastAddr;
 	struct sockaddr_storage __ss;
 	struct sockaddr_in *ssdpAddr4 = (struct sockaddr_in *)&__ss;
@@ -736,7 +794,7 @@ static int create_ssdp_sock_v4(
 	struct in_addr addr;
 
 	*ssdpSock = socket(AF_INET, SOCK_DGRAM, 0);
-	if (*ssdpSock == -1) {
+	if (*ssdpSock == INVALID_SOCKET) {
 		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in socket(): %s\n", errorBuffer);
@@ -751,10 +809,8 @@ static int create_ssdp_sock_v4(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_REUSEADDR: %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 #if defined(BSD) || defined(__OSX__) || defined(__APPLE__)
 	onOff = 1;
@@ -765,14 +821,12 @@ static int create_ssdp_sock_v4(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_REUSEPORT: %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 #endif /* BSD, __OSX__, __APPLE__ */
 	memset(&__ss, 0, sizeof(__ss));
-	ssdpAddr4->sin_family = AF_INET;
+	ssdpAddr4->sin_family = (sa_family_t)AF_INET;
 	ssdpAddr4->sin_addr.s_addr = htonl(INADDR_ANY);
 	ssdpAddr4->sin_port = htons(SSDP_PORT);
 	ret = bind(*ssdpSock, (struct sockaddr *)ssdpAddr4, sizeof(*ssdpAddr4));
@@ -781,10 +835,8 @@ static int create_ssdp_sock_v4(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in bind(), addr=0x%08X, port=%d: %s\n",
 			   INADDR_ANY, SSDP_PORT, errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_BIND;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_BIND;
 	}
 	memset((void *)&ssdpMcastAddr, 0, sizeof(struct ip_mreq));
 	ssdpMcastAddr.imr_interface.s_addr = inet_addr(gIF_IPV4);
@@ -796,10 +848,8 @@ static int create_ssdp_sock_v4(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() IP_ADD_MEMBERSHIP (join multicast group): %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 	/* Set multicast interface. */
 	memset((void *)&addr, 0, sizeof(struct in_addr));
@@ -824,13 +874,22 @@ static int create_ssdp_sock_v4(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_BROADCAST (set broadcast): %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_NETWORK_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
+	}
+	ret = UPNP_E_SUCCESS;
 
-		return UPNP_E_NETWORK_ERROR;
+error_handler:
+	if (ret != UPNP_E_SUCCESS) {
+		if (shutdown(*ssdpSock, SD_BOTH) == -1) {
+			strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
+			UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
+				   "Error in shutdown: %s\n", errorBuffer);
+                }
+                UpnpCloseSocket(*ssdpSock);
 	}
 
-	return UPNP_E_SUCCESS;
+	return ret;
 }
 
 #ifdef INCLUDE_CLIENT_APIS
@@ -847,7 +906,7 @@ static int create_ssdp_sock_reqv4(
 	u_char ttl = 4;
 
 	*ssdpReqSock = socket(AF_INET, SOCK_DGRAM, 0);
-	if (*ssdpReqSock == -1) {
+	if (*ssdpReqSock == INVALID_SOCKET) {
 		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in socket(): %s\n", errorBuffer);
@@ -877,7 +936,7 @@ static int create_ssdp_sock_v6(
 	int ret = 0;
 
 	*ssdpSock = socket(AF_INET6, SOCK_DGRAM, 0);
-	if (*ssdpSock == -1) {
+	if (*ssdpSock == INVALID_SOCKET) {
 		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in socket(): %s\n", errorBuffer);
@@ -892,10 +951,8 @@ static int create_ssdp_sock_v6(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_REUSEADDR: %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 #if defined(BSD) || defined(__OSX__) || defined(__APPLE__)
 	onOff = 1;
@@ -906,14 +963,23 @@ static int create_ssdp_sock_v6(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_REUSEPORT: %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 #endif /* BSD, __OSX__, __APPLE__ */
+	onOff = 1;
+	ret = setsockopt(*ssdpSock, IPPROTO_IPV6, IPV6_V6ONLY,
+			 (char *)&onOff, sizeof(onOff));
+	if (ret == -1) {
+		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
+		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
+			   "Error in setsockopt() IPV6_V6ONLY: %s\n",
+			   errorBuffer);
+		ret = UPNP_E_SOCKET_ERROR;
+		goto error_handler;
+	}
 	memset(&__ss, 0, sizeof(__ss));
-	ssdpAddr6->sin6_family = AF_INET6;
+	ssdpAddr6->sin6_family = (sa_family_t)AF_INET6;
 	ssdpAddr6->sin6_addr = in6addr_any;
 	ssdpAddr6->sin6_scope_id = gIF_INDEX;
 	ssdpAddr6->sin6_port = htons(SSDP_PORT);
@@ -923,10 +989,8 @@ static int create_ssdp_sock_v6(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in bind(), addr=0x%032lX, port=%d: %s\n",
 			   0lu, SSDP_PORT, errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_BIND;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_BIND;
 	}
 	memset((void *)&ssdpMcastAddr, 0, sizeof(ssdpMcastAddr));
 	ssdpMcastAddr.ipv6mr_interface = gIF_INDEX;
@@ -939,10 +1003,8 @@ static int create_ssdp_sock_v6(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() IPV6_JOIN_GROUP (join multicast group): %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 	onOff = 1;
 	ret = setsockopt(*ssdpSock, SOL_SOCKET, SO_BROADCAST,
@@ -952,13 +1014,22 @@ static int create_ssdp_sock_v6(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_BROADCAST (set broadcast): %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_NETWORK_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
+	}
+	ret = UPNP_E_SUCCESS;
 
-		return UPNP_E_NETWORK_ERROR;
+error_handler:
+	if (ret != UPNP_E_SUCCESS) {
+		if (shutdown(*ssdpSock, SD_BOTH) == -1) {
+			strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
+			UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
+				   "Error in shutdown: %s\n", errorBuffer);
+		}
+		UpnpCloseSocket(*ssdpSock);
 	}
 
-	return UPNP_E_SUCCESS;
+	return ret;
 }
 #endif /* IPv6 */
 
@@ -978,7 +1049,7 @@ static int create_ssdp_sock_v6_ula_gua(
 	int ret = 0;
 
 	*ssdpSock = socket(AF_INET6, SOCK_DGRAM, 0);
-	if (*ssdpSock == -1) {
+	if (*ssdpSock == INVALID_SOCKET) {
 		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in socket(): %s\n", errorBuffer);
@@ -993,10 +1064,8 @@ static int create_ssdp_sock_v6_ula_gua(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_REUSEADDR: %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 #if defined(BSD) || defined(__OSX__) || defined(__APPLE__)
 	onOff = 1;
@@ -1007,14 +1076,23 @@ static int create_ssdp_sock_v6_ula_gua(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_REUSEPORT: %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 #endif /* BSD, __OSX__, __APPLE__ */
+	onOff = 1;
+	ret = setsockopt(*ssdpSock, IPPROTO_IPV6, IPV6_V6ONLY,
+			(char *)&onOff, sizeof(onOff));
+	if (ret == -1) {
+		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
+		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
+			   "Error in setsockopt() IPV6_V6ONLY: %s\n",
+			   errorBuffer);
+		ret = UPNP_E_SOCKET_ERROR;
+		goto error_handler;
+	}
 	memset(&__ss, 0, sizeof(__ss));
-	ssdpAddr6->sin6_family = AF_INET6;
+	ssdpAddr6->sin6_family = (sa_family_t)AF_INET6;
 	ssdpAddr6->sin6_addr = in6addr_any;
 	ssdpAddr6->sin6_scope_id = gIF_INDEX;
 	ssdpAddr6->sin6_port = htons(SSDP_PORT);
@@ -1024,10 +1102,8 @@ static int create_ssdp_sock_v6_ula_gua(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in bind(), addr=0x%032lX, port=%d: %s\n",
 			   0lu, SSDP_PORT, errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_BIND;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_BIND;
 	}
 	memset((void *)&ssdpMcastAddr, 0, sizeof(ssdpMcastAddr));
 	ssdpMcastAddr.ipv6mr_interface = gIF_INDEX;
@@ -1041,10 +1117,8 @@ static int create_ssdp_sock_v6_ula_gua(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() IPV6_JOIN_GROUP (join multicast group): %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_SOCKET_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
-
-		return UPNP_E_SOCKET_ERROR;
 	}
 	onOff = 1;
 	ret = setsockopt(*ssdpSock, SOL_SOCKET, SO_BROADCAST,
@@ -1054,13 +1128,22 @@ static int create_ssdp_sock_v6_ula_gua(
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in setsockopt() SO_BROADCAST (set broadcast): %s\n",
 			   errorBuffer);
-		shutdown(*ssdpSock, SD_BOTH);
+		ret = UPNP_E_NETWORK_ERROR;
-		UpnpCloseSocket(*ssdpSock);
+		goto error_handler;
+	}
+	ret = UPNP_E_SUCCESS;
 
-		return UPNP_E_NETWORK_ERROR;
+error_handler:
+	if (ret != UPNP_E_SUCCESS) {
+		if (shutdown(*ssdpSock, SD_BOTH) == -1) {
+			strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
+			UpnpPrintf(UPNP_INFO, SSDP, __FILE__, __LINE__,
+				   "Error in shutdown: %s\n", errorBuffer);
+		}
+		UpnpCloseSocket(*ssdpSock);
 	}
 
-	return UPNP_E_SUCCESS;
+	return ret;
 }
 #endif /* IPv6 */
 
@@ -1076,7 +1159,7 @@ static int create_ssdp_sock_reqv6(
 	char hops = 1;
 
 	*ssdpReqSock = socket(AF_INET6, SOCK_DGRAM, 0);
-	if (*ssdpReqSock == -1) {
+	if (*ssdpReqSock == INVALID_SOCKET) {
 		strerror_r(errno, errorBuffer, ERROR_BUFFER_LEN);
 		UpnpPrintf(UPNP_CRITICAL, SSDP, __FILE__, __LINE__,
 			   "Error in socket(): %s\n", errorBuffer);
@@ -1103,7 +1186,7 @@ int get_ssdp_sockets(MiniServerSockArray * out)
 	out->ssdpReqSock4 = INVALID_SOCKET;
 	out->ssdpReqSock6 = INVALID_SOCKET;
 	/* Create the IPv4 socket for SSDP REQUESTS */
-	if (strlen(gIF_IPV4) > 0) {
+	if (strlen(gIF_IPV4) > (size_t)0) {
 		retVal = create_ssdp_sock_reqv4(&out->ssdpReqSock4);
 		if (retVal != UPNP_E_SUCCESS)
 			return retVal;
@@ -1113,7 +1196,7 @@ int get_ssdp_sockets(MiniServerSockArray * out)
 		out->ssdpReqSock4 = INVALID_SOCKET;
 	/* Create the IPv6 socket for SSDP REQUESTS */
 #ifdef UPNP_ENABLE_IPV6
-	if (strlen(gIF_IPV6) > 0) {
+	if (strlen(gIF_IPV6) > (size_t)0) {
 		retVal = create_ssdp_sock_reqv6(&out->ssdpReqSock6);
 		if (retVal != UPNP_E_SUCCESS) {
 			shutdown(out->ssdpReqSock4, SD_BOTH);
@@ -1127,7 +1210,7 @@ int get_ssdp_sockets(MiniServerSockArray * out)
 #endif /* IPv6 */
 #endif /* INCLUDE_CLIENT_APIS */
 	/* Create the IPv4 socket for SSDP */
-	if (strlen(gIF_IPV4) > 0) {
+	if (strlen(gIF_IPV4) > (size_t)0) {
 		retVal = create_ssdp_sock_v4(&out->ssdpSock4);
 		if (retVal != UPNP_E_SUCCESS) {
 #ifdef INCLUDE_CLIENT_APIS
@@ -1142,7 +1225,7 @@ int get_ssdp_sockets(MiniServerSockArray * out)
 		out->ssdpSock4 = INVALID_SOCKET;
 	/* Create the IPv6 socket for SSDP */
 #ifdef UPNP_ENABLE_IPV6
-	if (strlen(gIF_IPV6) > 0) {
+	if (strlen(gIF_IPV6) > (size_t)0) {
 		retVal = create_ssdp_sock_v6(&out->ssdpSock6);
 		if (retVal != UPNP_E_SUCCESS) {
 			shutdown(out->ssdpSock4, SD_BOTH);
@@ -1157,7 +1240,7 @@ int get_ssdp_sockets(MiniServerSockArray * out)
 		}
 	} else
 		out->ssdpSock6 = INVALID_SOCKET;
-	if (strlen(gIF_IPV6_ULA_GUA) > 0) {
+	if (strlen(gIF_IPV6_ULA_GUA) > (size_t)0) {
 		retVal = create_ssdp_sock_v6_ula_gua(&out->ssdpSock6UlaGua);
 		if (retVal != UPNP_E_SUCCESS) {
 			shutdown(out->ssdpSock4, SD_BOTH);

upnp/src/urlconfig/urlconfig.c

@@ -2,6 +2,7 @@
  *
  * Copyright (c) 2000-2003 Intel Corporation 
  * All rights reserved. 
+ * Copyright (c) 2012 France Telecom All rights reserved. 
  *
  * Redistribution and use in source and binary forms, with or without 
  * modification, are permitted provided that the following conditions are met: 
@@ -49,41 +50,55 @@
 #include <stdio.h>
 
 #ifdef WIN32
+	#define snprintf _snprintf
 #else
 	#include <sys/types.h>
 #endif
 
+#ifdef INCLUDE_DEVICE_APIS
+#ifdef INTERNAL_WEB_SERVER
+
 /************************************************************************
 *	Function :	addrToString
 *
 *	Parameters :
 *		IN const struct sockaddr* addr ;	socket address object with 
 *					the IP Address and port information
-*		OUT char ipaddr_port[] ;	character array which will hold the 
+*		OUT char ipaddr_port ;	character array which will hold the 
 *					IP Address  in a string format.
+*		IN size_t ipaddr_port_size ;	ipaddr_port buffer size
 *
 *	Description : Converts an Internet address to a string and stores it 
 *		a buffer.
 *
-*	Return : void ;
+*	Return : int ;
+*		UPNP_E_SUCCESS - On Success.
+*		UPNP_E_BUFFER_TOO_SMALL - Given buffer doesn't have enough size.
 *
 *	Note :
 ************************************************************************/
-static UPNP_INLINE void
+static UPNP_INLINE int
 addrToString( IN const struct sockaddr *addr,
-              OUT char ipaddr_port[] )
+              OUT char *ipaddr_port,
+              IN size_t ipaddr_port_size )
 {
-    char buf_ntop[64];
+    char buf_ntop[INET6_ADDRSTRLEN];
+    int rc = 0;
 
     if( addr->sa_family == AF_INET ) {
         struct sockaddr_in* sa4 = (struct sockaddr_in*)addr;
         inet_ntop(AF_INET, &sa4->sin_addr, buf_ntop, sizeof(buf_ntop) );
-        sprintf( ipaddr_port, "%s:%d", buf_ntop, ntohs( sa4->sin_port ) );
+        rc = snprintf( ipaddr_port, ipaddr_port_size, "%s:%d", buf_ntop,
+            (int)ntohs( sa4->sin_port ) );
     } else if( addr->sa_family == AF_INET6 ) {
         struct sockaddr_in6* sa6 = (struct sockaddr_in6*)addr;
         inet_ntop(AF_INET6, &sa6->sin6_addr, buf_ntop, sizeof(buf_ntop) );
-        sprintf( ipaddr_port, "[%s]:%d", buf_ntop, ntohs( sa6->sin6_port ) );
+        rc = snprintf( ipaddr_port, ipaddr_port_size, "[%s]:%d", buf_ntop,
+            (int)ntohs( sa6->sin6_port ) );
     }
+	if (rc < 0 || (unsigned int) rc >= ipaddr_port_size)
+		return UPNP_E_BUFFER_TOO_SMALL;
+	return UPNP_E_SUCCESS;
 }
 
 /************************************************************************
@@ -129,12 +144,14 @@ static UPNP_INLINE int calc_alias(
 	else 
 		aliasPtr = alias;
 	new_alias_len = root_len + strlen(temp_str) + strlen(aliasPtr);
-	alias_temp = malloc(new_alias_len + 1);
+	alias_temp = malloc(new_alias_len + (size_t)1);
 	if (alias_temp == NULL)
 		return UPNP_E_OUTOF_MEMORY;
-	strcpy(alias_temp, rootPath);
+	memset(alias_temp, 0, new_alias_len + (size_t)1);
-	strcat(alias_temp, temp_str);
+	strncpy(alias_temp, rootPath, root_len);
-	strcat(alias_temp, aliasPtr);
+	alias_temp[root_len] = '\0';
+	strncat(alias_temp, temp_str, strlen(temp_str));
+	strncat(alias_temp, aliasPtr, strlen(aliasPtr));
 
 	*newAlias = alias_temp;
 	return UPNP_E_SUCCESS;
@@ -170,11 +187,13 @@ static UPNP_INLINE int calc_descURL(
 	assert(alias != NULL && strlen(alias) > 0);
 
 	len = strlen(http_scheme) + strlen(ipPortStr) + strlen(alias);
-	if (len > (LINE_SIZE - 1))
+	if (len > ((size_t)LINE_SIZE - (size_t)1))
 		return UPNP_E_URL_TOO_BIG;
-	strcpy(descURL, http_scheme);
+	strncpy(descURL, http_scheme, strlen(http_scheme));
-	strcat(descURL, ipPortStr);
+	descURL[strlen(http_scheme)] = '\0';
-	strcat(descURL, alias);
+	strncat(descURL, ipPortStr, strlen(ipPortStr));
+	strncat(descURL, alias, strlen(alias));
+	descURL[len] = '\0';
 	UpnpPrintf(UPNP_INFO, API, __FILE__, __LINE__,
 		   "desc url: %s\n", descURL);
 
@@ -211,10 +230,8 @@ static int config_description_doc(
 	IN const char *ip_str,
 	OUT char **root_path_str )
 {
-	int addNew = FALSE;
 	IXML_NodeList *baseList;
 	IXML_Element *element = NULL;
-	IXML_Element *newElement = NULL;
 	IXML_Node *textNode = NULL;
 	IXML_Node *rootNode = NULL;
 	IXML_Node *urlbase_node = NULL;
@@ -232,7 +249,6 @@ static int config_description_doc(
 	baseList = ixmlDocument_getElementsByTagName(doc, urlBaseStr);
 	if (baseList == NULL) {
 		/* urlbase not found -- create new one */
-		addNew = TRUE;
 		element = ixmlDocument_createElement(doc, urlBaseStr);
 		if (element == NULL) {
 			goto error_handler;
@@ -265,7 +281,7 @@ static int config_description_doc(
 		}
 	} else {
 		/* urlbase found */
-		urlbase_node = ixmlNodeList_item(baseList, 0);
+		urlbase_node = ixmlNodeList_item(baseList, 0lu);
 		assert(urlbase_node != NULL);
 		textNode = ixmlNode_getFirstChild(urlbase_node);
 		if (textNode == NULL) {
@@ -305,7 +321,7 @@ static int config_description_doc(
 		}
 		/* add trailing '/' if missing */
 		if (url_str.buf[url_str.length - 1] != '/') {
-			if (membuffer_append(&url_str, "/", 1) != 0) {
+			if (membuffer_append(&url_str, "/", (size_t)1) != 0) {
 				goto error_handler;
 			}
 		}
@@ -319,7 +335,7 @@ static int config_description_doc(
 
  error_handler:
 	if (err_code != UPNP_E_SUCCESS) {
-		ixmlElement_free(newElement);
+		ixmlElement_free(element);
 	}
 	ixmlNodeList_free(baseList);
 	membuffer_destroy(&root_path);
@@ -371,10 +387,11 @@ configure_urlbase( INOUT IXML_Document * doc,
     int err_code;
     char ipaddr_port[LINE_SIZE];
 
-    err_code = UPNP_E_OUTOF_MEMORY; /* default error */
-
     /* get IP address and port */
-    addrToString( serverAddr, ipaddr_port );
+    err_code = addrToString( serverAddr, ipaddr_port, sizeof(ipaddr_port) );
+    if ( err_code != UPNP_E_SUCCESS ) {
+        goto error_handler;
+    }
 
     /* config url-base in 'doc' */
     err_code = config_description_doc( doc, ipaddr_port, &root_path );
@@ -415,3 +432,5 @@ error_handler:
     }
     return err_code;
 }
+#endif /* INCLUDE_DEVICE_APIS */
+#endif /* INTERNAL_WEB_SERVER */ 

upnp/src/uuid/sysdep.c

@@ -106,7 +106,7 @@ void get_random_info(unsigned char seed[16])
 	GetComputerName( r.hostname, &r.l );
 	/* MD5 it */
 	MD5Init(&c);
-	MD5Update(&c, &r, sizeof r);
+	MD5Update(&c, (unsigned char *)(&r), sizeof r);
 	MD5Final(seed, &c);
 };