BACK TO MAIN PAGE

Note: OpenSSL 0.9.8 Security Vulnerability and API Update

Due to the recent publishing of information regarding a TLS/SSL protocol vulnerability (ISC diary entry) OpenSSL has released a new version OpenSSL 0.9.8l. Please use the latest OpenSSL release with gSOAP.

For gSOAP 2.8.11 and earlier versions: Changes in the OpenSSL API can lead to a client-side crash in the gSOAP engine for all gSOAP versions 2.8.11 and earlier. This is fixed in 2.8.12 and later. The fix is to replace tcp_connect() in stdsoap2.c and stdsoap2.cpp with this new tcp_connect.c code that replaces the host name check code that is no longer supported in newer OpenSSL versions (releases 0.9.8 and up).

Bugs, Patches, and Updates

Please report bugs, patches, and feature requests at the SourceForge gSOAP project tracker. This allows you and us to monitor the status of a request.

For support requests, please visit the support page.



Latest official stable release: gSOAP 2.8.15

download from SourceForge

Patch for 2.8.13 and 2.8.14 DIME/MTOM attachment processing and HTTP Digest authentication

Download .zip source code patch.
This patch also replaces mode with omode in these two functions (as shown):
soap_reference(struct soap *soap, const void *p, int t)
{ struct soap_plist *pp;
  if (!p || (!soap->encodingStyle && !(soap->omode & (SOAP_ENC_DIME|SOAP_ENC_MIME|SOAP_ENC_MTOM|SOAP_XML_GRAPH))) || (soap->omode & SOAP_XML_TREE))
      return 1;
and
soap_array_reference(struct soap *soap, const void *p, const struct soap_array
*a, int n, int t)
{ struct soap_plist *pp;
  if (!p || !a->__ptr || (!soap->encodingStyle && !(soap->omode & (SOAP_ENC_DIME|SOAP_ENC_MIME|SOAP_ENC_MTOM|SOAP_XML_GRAPH))) || (soap->omode & SOAP_XML_TREE))
      return 1;

Correction for 2.8.9 samples/wcf/WS/DualHttp

The Makefile wsxrClient.cpp build should reference wsrm5.h:
wsrxClient.cpp wsrxServer.cpp:
                $(GSOAP) $(GSFLAGS) -A -pwsrx ../../../../import/wsrm5.h


Bug in 2.8.2 and 2.8.3

Bug in stdsoap2.c and stdsoap2.cpp function soap_copy_context() line 8264 (2.8.3 release), change to:
    soap_set_namespaces(copy, soap->namespaces); // REMOVE local_


The 2.8.3 release XML-RPC update with JSON support and patch for array and struct construction, for all pre-2.8.3 releases. New README instructions included.

Download xml-rpc-json.zip here.

The following are issues with previous releases (all fixed in the latest release)



A speed improvement trick for MS Windows applications, used in the latest 2.8 releases. In stdsoap2.c/.cpp functions soap_accept(), soap_bind(), tcp_connect() change the code to set the 'len' variable as follows:
#ifndef WITH_WIN32
  int len = SOAP_BUFLEN;
#else
  int len = SOAP_BUFLEN + 1; /* speeds up windows xfer */
#endif
This should speed up transfers of 64KB and up to a fraction of a second.

A problem with soapcpp2 option -b has been reported, where the deserialized fixed-size array is not populated in the soapcpp2-generated code. Rebuild soapcpp2 with the patch for src/symbol2.c:9890:
  if (is_fixedstring(typ))
  { fprintf(fhead,"\nSOAP_FMAC3 char* SOAP_FMAC4 soap_in_%s(struct soap*, const char*, char[], const char*);", c_ident(typ)); fprintf(fout,"\n\nSOAP_FMAC3 char* SOAP_FMAC4 soap_in_%s(struct soap *soap, const char *tag, char a[], const char *type)\n{\tchar *p;\n\tif (soap_instring(soap, tag, &p, type, %s, 1, 0, %d))\n\t\treturn strcpy(a, p);\n\treturn NULL;\n}", c_ident(typ), soap_type(typ), typ->width / ((Tnode*)typ->ref)->width - 1);
    return; 



WSRM plugin leak fix wsrmapi.c:3231 insert two lines:
  for (q = p->list; q; q = r)
  { r = q->next;
    if (q->buf)
      free((void*)q->buf);
    free((void*)q);
  }



Problem with #import "custom/ducation.h" using the incorrect file name fix: change typemap.dat line 94:
xsd__duration = #import "custom/ducation.h" | xsd__duration
to:
xsd__duration = #import "custom/duration.h" | xsd__duration


A problem with floating point data has been reported when using QT with gSOAP:
QApplication app(argc, argv);
or
QCoreApplication app(argc, argv);
before the gSOAP call, produced a truncated float that keeps only the integer part. It seems that this could be a locale problem (using decimal . versus ,). For correct locale usage in gSOAP, compile the sources with -DWITH_C_LOCALE.


gSOAP 2.7.14: win32 bug with select() when send/recv timeouts are used may lead to premature connection termination. Patch in stdsoap2.c[pp] line 4349:
static int
tcp_select(struct soap *soap, SOAP_SOCKET s, int flags, int timeout)
{ register int r;
  struct timeval tv;
  fd_set fd[3], *rfd, *sfd, *efd;
  soap->errnum = 0;
#ifndef WIN32 // <-- ADD
  /* if fd max set size exceeded, use poll() when available */
#if defined(__QNX__) || defined(QNX) /* select() is not MT safe on some QNX */
  if (1)
...
#else                                                         
  { soap->error = SOAP_FD_EXCEEDED;                           
    return -1;                                                
  }                                                           
#endif                                                        
#endif // <-- ADD
  rfd = sfd = efd = NULL;                                     
The following is a fix to improve SSL shutdown speed (stdsoap2.c[pp] line 4630) by replacing SOAP_TCP_SELECT_SND by SOAP_TCP_SELECT_RCV:
        { /*
          wait up to 10 seconds for close_notify to be sent by peer (if peer not
          present, this avoids calling SSL_shutdown() which has a lengthy return
          timeout)
          */
          r = tcp_select(soap, soap->socket, SOAP_TCP_SELECT_RCV | SOAP_TCP_SELECT_ERR, 10);



gSOAP 2.7.12: dateTime numeric timezone normalization issue when converting to XSD dateTime with numeric timezone (+hh:mm) to time_t (e.g. 2000-03-04T02:00:00+03:00). Patch in stdsoap2.cpp line 10886:
        /* put hour and min in range */
        T.tm_hour += T.tm_min / 60;
        T.tm_min %= 60;
        if (T.tm_min < 0)
        { T.tm_min += 60;
          T.tm_hour--;
        }
        T.tm_mday += T.tm_hour / 24;
        T.tm_hour %= 24;
        if (T.tm_hour < 0)
        { T.tm_hour += 24;
          T.tm_mday--;
        }
        /* note: day of the month may be out of range, timegm() handles it */



gSOAP 2.7.11: wsseapi.c line 2721 initialization of 'count = 0' is missing:
static size_t
soap_wsse_verify_nested(struct soap *soap, struct soap_dom_element *dom, const char *URI, const char *tag)
{ size_t count = 0;
Fix for known problems with strtof() on some platforms (e.g. SUSE 11).
Replace stdsoap2.c/.cpp line 9724:
#if defined(HAVE_STRTOF_L)
      char *r;
      *p = strtof_l((char*)s, &r, soap->c_locale);
      if (*r)
#elif defined(HAVE_STRTOD_L)
      char *r;
      *p = (float)strtod_l(s, &r, soap->c_locale);
      if (*r)
#elif defined(HAVE_STRTOF)
      char *r;
      *p = strtof((char*)s, &r);
      if (*r)
#elif defined(HAVE_STRTOD)
      char *r;
      *p = (float)strtod(s, &r);
      if (*r)
#endif
with:
#if defined(HAVE_STRTOD_L)
      char *r;
      *p = (float)strtod_l(s, &r, soap->c_locale);
      if (*r)
#elif defined(HAVE_STRTOD)
      char *r;
      *p = (float)strtod(s, &r);
      if (*r)
#endif
Fix for router:
Replace stdsoap2.c/.cpp line 6268:
  soap_free_temp(soap);
with:
  soap_free_ns(soap);
and download the router.c patch.


gSOAP 2.7.10: stdsoap2 fixes floating point conversion with GLIBC using C locale, fixed xsd:dateTime timezone offset handling (+/-HH.MM), and fixed SOAPAction output.
gSOAP 2.7.9l and k: updated dom.h.zip with missing xsd__anyAttribute definitions
gSOAP 2.7.9l: last updated 12/17/07 stdsoap2.h/.c/.cpp [zip] with improved HTTP chunking and improved socket timeout support.
gSOAP 2.7.9l: last updated 11/02/07 soapcpp2-src [zip] soapcpp2 compiler with fix for option -i one-way send/recv operations.
gSOAP 2.7.9j and earier: WSA API wsaapi.c (last updated September 10, 07) plugin.
The XMethods services frequently experience load problems which may cause failed GetQuote queries (the samples/quote example) and failures to obtain XMethods Query service WSDL and listings. We provide example client code to connect to these services, but we do not provide these services. Therefore, if these examples don't work the intermittent failures cannot be fixed by us.
gSOAP 2.7.9h: to run the soapcpp2.exe and wsdl2h.exe binaries, you need to install the DLLs that ship with MS VS 2005 (or install MS VS 2005). For future releases I plan to generate binaries that do not require these DLLs.
gSOAP 2.7.9g minor correction needed for samples/components/cpp/main.cpp: rename calc::Service to calc::ServiceService.
gSOAP 2.7.9a: to prevent HTTP chunked transfer responses from server to show 202 ACCEPTED, change stdsoap2.cpp:13381 into (mode should be omode):
    if (count || ((soap->omode & SOAP_IO) == SOAP_IO_CHUNK))

gSOAP 2.7.9 has an elementFormDefault="unqualified" bug for C++ class members that represent complexTypes. The wsdl2h importer may ignore option -o. Download gSOAP 2.7.9a with a fix.
Updated gSOAP 2.7.8c OpenSSL extension support:
download stdsoap2.h 2.7.8c updated source code
download stdsoap2.c 2.7.8c updated source code
download stdsoap2.cpp 2.7.8c updated source code

Fix for wsse plugin API HMAC SHA1 signature verification:
download plugin/wsseapi.h source code
download plugin/wsseapi.c source code


gSOAP with OpenSSL portability note: stdsoap2.c/.cpp OpenSSL meth->d2i() compilation error occurs on certain platforms. Suggested fix for GCC 4.x and MSVC:
3758c3758
<             val = meth->i2v(meth, meth->d2i(NULL, &ext->value->data, ext->value->length), NULL);
---
>             val = meth->i2v(meth, meth->d2i(NULL, (unsigned const char**)&ext->value->data, ext->value->length), NULL); 

Fix for HTTPS proxy CONNECT (gSOAP 2.7.8b and earlier). The stdsoap2.cpp tcp_connect() function contains the following code:
  {
#ifdef WITH_OPENSSL
  ...
      userid = soap->userid; /* preserve */
      passwd = soap->passwd; /* preserve */
      if (soap_begin_recv(soap))
      { soap->fclosesocket(soap, (SOAP_SOCKET)fd);
        return SOAP_INVALID_SOCKET;
      }
      soap->userid = userid; /* restore */
      soap->passwd = passwd; /* restore */
 ...
To resolve the problem, change this into:
 
      userid = soap->userid; /* preserve */
      passwd = soap->passwd; /* preserve */
      if ((soap->error = soap->fparse(soap)))
      { soap->fclosesocket(soap, (SOAP_SOCKET)fd);
        return SOAP_INVALID_SOCKET;
      }
      soap->userid = userid; /* restore */
      soap->passwd = passwd; /* restore */

Fix for gSOAP 2.7.8(a/b) GCC 4.1 with -DWITH_OPENSSL, stdsoap2.cpp:3737:
           const char *ext_str = OBJ_nid2sn(OBJ_obj2nid(X509_EXTENSION_get_object(ext)));
           if (!strcmp(ext_str, "subjectAltName"))
           { int j;
-            unsigned char *data;
+            unsigned const char *data;
             STACK_OF(CONF_VALUE) *val;


Fix for gSOAP 2.7.8a: on some systems the use of soap_isnan() may fail with a FP exception. The culprit is in stdsoap2.h:847:
#define soap_isnan(n) ((double)(n) == DBL_NAN)
Either enable isnan checking with -DHAVE_ISNAN or change stdsoap2.h:847 by:
#define soap_isnan(n) (0)

Fix for XML-RPC array handling in 2.7.6c and earlier: xml-rpc.zip (install in samples directory to replace xml-rpc).
Known issue with 2.7.4/.5: soapcpp2 WSDL output may include additional </message> tags that must be removed. For some RPC encoded Response messages in the WSDL the name attribute is missing in the <message> element.
Patches for the gSOAP 2.7.3 release:
Patches for the gSOAP 2.7.0f release:
Patches for previous gSOAP 2.7.0d release:


Patch for gSOAP 2.6.2 fixes code generation bug for char*[] serializer.
Download src/symbol2.c
Download soapcpp2.exe
A bug in stdsoap2.c/pp 2.6.2 prevents the deserialization of xsd:short:
soap_s2short(struct soap *soap, const char *s, short *p)
{ if (s)
  { long n;
    char *r;
    n = soap_strtol(s, &r, 10);
    if (*r || n < -32768 || n > 32767)
      return soap->error = SOAP_TYPE;
    *p = (char)n;
   ^^^^^^^^^^^
     Should be *p = (short)n



Patches for gSOAP 2.6 (the patches below are integrated in gSOAP 2.6.1 and higher). The Patch for gSOAP 2.6 fixes a problem with dropped STL vector elements under multi-ref (id-ref) encoding, which can occur under certain circumstances with pointer-based STL vector items. A robust id-ref resolution algorithm for STL container elements was added. In addition, an improvement was made to the WSDL output for document/literal services.


Patches for gSOAP 2.5.1 (the patches below are integrated in gSOAP 2.5.2 and higher). The patch reduces the number of soapcpp2 warnings for SOAP RPC/lit encoded messages:


Patches for gSOAP 2.5 (the patches below are integrated in gSOAP 2.5.1):

The patch implements a small change to the server-side SOAP Fault output to improve interoperability and a correction to the VxWorks ioctl() calls.


Patch for dimeclient.cpp and dimeserver.cpp correcting a streaming DIME attachment reordering problem:
Download dimeclient.cpp
Download dimeserver.cpp


Patches for gSOAP 2.4.1 (the patches below are integrated in gSOAP 2.5):
These are patches for gSOAP 2.3.8:
Download stdsoap2.h 2.3.8h
Download stdsoap2.c 2.3.8h
Download stdsoap2.cpp 2.3.8h
Download webserver.c memory leak fix with gSOAP 2.3.8 for the combination of Zlib compression with the httpget plugin (the fix is to remove all soap_begin_send calls before the soap_response calls).
The old Java-based WSDL importer may output the wrong XML namespace binding for 'tns' in the generated header file. Please check the XML namespaces definitions in the WSDL and the header file. Otherwise, your client may not be able to connect. A new WSDL importer (written in C++ and produced by gSOAP itself!) will be available soon.
Patches:



The patches listed below are integrated into gSOAP 2.3.8.

Below is a list of fixes and patches for some issues with gSOAP 2.2.3 (these patches are integrated in the gSOAP 2.3 beta release):



Older gSOAP 2.1.11 release (gSOAP 2.2 is based on 2.1.11, but just in case you need 2.1.11):