In the following code fragment occurring twice in zoo_service_loader.c, GetProcAddress or dlsym will return NULL if a user has mistyped the service name (the WPS Identifier parameter):

#ifdef WIN32
	typedef int (CALLBACK* execute_t)(char***,char***,char***);
	execute_t execute=(execute_t)GetProcAddress(so,fname);
#else
	typedef int (*execute_t)(char***,char***,char***);
	execute_t execute=(execute_t)dlsym(so,fname);
#endif

This will cause a crash when attempting to invoke the function at the address given by execute:

*eres=execute(&m,&request_input_real_format,&request_output_real_format);

There should be a check to avoid this happening (with an error message).

The following code fragment in service_internal.c parses the Range=[min,max] attribute of LiteralData? variables, but does not terminate the MinimumValue? string. It also gives a wrong result if there are trailing white spaces in the MaximumValue? string.

pToken=strtok(orig,",");
int nci0=0;
while(pToken!=NULL) {
   char *tmpStr=(char*) malloc((strlen(pToken))*sizeof(char));
   if(nci0==0) {
      nc7 = xmlNewNode(ns_ows, BAD_CAST "MinimumValue");
      int nci=1;
      for(nci=1;nci<strlen(pToken);nci++) {
         tmpStr[nci-1]=pToken[nci];
      }
   }
   else {
      nc7 = xmlNewNode(ns_ows, BAD_CAST "MaximumValue");
      int nci=0;
      for(nci=0;nci<strlen(pToken)-1;nci++){
         tmpStr[nci]=pToken[nci];
      }
   }
   xmlAddChild(nc7,xmlNewText(BAD_CAST tmpStr));
   xmlAddChild(nc8,nc7);
   nci0++;
   pToken = strtok(NULL,",");
}

The following alternative code has been briefly tested:

pToken=strtok(orig,",");	
int nci0=0;
while(pToken!=NULL) {
   char *tmpStr=(char*) malloc((strlen(pToken))*sizeof(char));
   if(nci0==0) {
      nc7 = xmlNewNode(ns_ows, BAD_CAST "MinimumValue");
      strncpy( tmpStr, pToken+1, strlen(pToken)-1 );
      tmpStr[strlen(pToken)-1] = '\0';
   }
   else {
      nc7 = xmlNewNode(ns_ows, BAD_CAST "MaximumValue");
      const char* bkt;
      if ( ( bkt = strchr(pToken, '[') ) != NULL || ( bkt = strchr(pToken, ']') ) != NULL )
      {	
         strncpy( tmpStr, pToken, bkt - pToken );
         tmpStr[bkt - pToken] = '\0';			
      }		
   }
   xmlAddChild(nc7,xmlNewText(BAD_CAST tmpStr));
   free(tmpStr);
   xmlAddChild(nc8,nc7);
   nci0++;
   pToken = strtok(NULL,",");
}

The following lines in the function printFullDescription (service_internal.c) causes a segmentation fault in some situations, namely if the pointer e->supported is NULL (tested on Windows 7):

if(_tmp0==NULL){
   xmlAddChild(nc6,nc8);
   _tmp0=e->supported;
   if(getMap(_tmp0->content,"range")!=NULL ||
      getMap(_tmp0->content,"rangeMin")!=NULL ||
      getMap(_tmp0->content,"rangeMax")!=NULL ||
      getMap(_tmp0->content,"rangeClosure")!=NULL ) { 
      tmp1=_tmp0->content;
      goto doRange;
   }
}