From: Joe Orton <jorton@apache.org>
Date: Fri, 17 Jul 2026 12:12:12 +0000 (+0000)
Subject: mod_ssl: fix NULL dereference in OCSP responder URI parsing
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=126d8233813e4d176a7283f34a151901e81a721b;p=thirdparty%2Fapache%2Fhttpd.git

mod_ssl: fix NULL dereference in OCSP responder URI parsing

* modules/ssl/ssl_engine_ocsp.c (determine_responder_uri): Check
  u->scheme is non-NULL before calling ap_cstr_casecmp(), since
  apr_uri_parse() can succeed with a NULL scheme for scheme-less URIs.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitHub: PR #685


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936259 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/ssl/ssl_engine_ocsp.c b/modules/ssl/ssl_engine_ocsp.c
index 539ed103ea..6a03fb4174 100644
--- a/modules/ssl/ssl_engine_ocsp.c
+++ b/modules/ssl/ssl_engine_ocsp.c
@@ -80,7 +80,7 @@ static apr_uri_t *determine_responder_uri(SSLSrvConfigRec *sc, X509 *cert,
     }
 
     rv = apr_uri_parse(p, s, u);
-    if (rv || !u->hostname) {
+    if (rv || !u->hostname || !u->scheme) {
         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, rv, c, APLOGNO(01919)
                       "failed to parse OCSP responder URI '%s'", s);
         return NULL;