diff --git a/crypto/openssl/crypto/cms/cms_pwri.c b/crypto/openssl/crypto/cms/cms_pwri.c
index 2373092bed55..6b507c3f0176 100644
--- a/crypto/openssl/crypto/cms/cms_pwri.c
+++ b/crypto/openssl/crypto/cms/cms_pwri.c
@@ -1,409 +1,409 @@
 /*
  * Copyright 2009-2022 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include "internal/cryptlib.h"
 #include <openssl/asn1t.h>
 #include <openssl/pem.h>
 #include <openssl/x509v3.h>
 #include <openssl/err.h>
 #include <openssl/cms.h>
 #include <openssl/rand.h>
 #include <openssl/aes.h>
 #include "internal/sizes.h"
 #include "crypto/asn1.h"
 #include "cms_local.h"
 
 int CMS_RecipientInfo_set0_password(CMS_RecipientInfo *ri,
                                     unsigned char *pass, ossl_ssize_t passlen)
 {
     CMS_PasswordRecipientInfo *pwri;
     if (ri->type != CMS_RECIPINFO_PASS) {
         ERR_raise(ERR_LIB_CMS, CMS_R_NOT_PWRI);
         return 0;
     }
 
     pwri = ri->d.pwri;
     pwri->pass = pass;
     if (pass && passlen < 0)
         passlen = strlen((char *)pass);
     pwri->passlen = passlen;
     return 1;
 }
 
 CMS_RecipientInfo *CMS_add0_recipient_password(CMS_ContentInfo *cms,
                                                int iter, int wrap_nid,
                                                int pbe_nid,
                                                unsigned char *pass,
                                                ossl_ssize_t passlen,
                                                const EVP_CIPHER *kekciph)
 {
     STACK_OF(CMS_RecipientInfo) *ris;
     CMS_RecipientInfo *ri = NULL;
     CMS_EncryptedContentInfo *ec;
     CMS_PasswordRecipientInfo *pwri;
     EVP_CIPHER_CTX *ctx = NULL;
     X509_ALGOR *encalg = NULL;
     unsigned char iv[EVP_MAX_IV_LENGTH];
     int ivlen;
     const CMS_CTX *cms_ctx = ossl_cms_get0_cmsctx(cms);
 
     ec = ossl_cms_get0_env_enc_content(cms);
     if (ec == NULL)
         return NULL;
     ris = CMS_get0_RecipientInfos(cms);
     if (ris == NULL)
         return NULL;
 
     if (wrap_nid <= 0)
         wrap_nid = NID_id_alg_PWRI_KEK;
 
     if (pbe_nid <= 0)
         pbe_nid = NID_id_pbkdf2;
 
     /* Get from enveloped data */
     if (kekciph == NULL)
         kekciph = ec->cipher;
 
     if (kekciph == NULL) {
         ERR_raise(ERR_LIB_CMS, CMS_R_NO_CIPHER);
         return NULL;
     }
     if (wrap_nid != NID_id_alg_PWRI_KEK) {
         ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
         return NULL;
     }
 
     /* Setup algorithm identifier for cipher */
     encalg = X509_ALGOR_new();
     if (encalg == NULL) {
         goto merr;
     }
     ctx = EVP_CIPHER_CTX_new();
     if (ctx == NULL) {
         ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
         goto err;
     }
 
     if (EVP_EncryptInit_ex(ctx, kekciph, NULL, NULL, NULL) <= 0) {
         ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
         goto err;
     }
 
     ivlen = EVP_CIPHER_CTX_get_iv_length(ctx);
     if (ivlen < 0) {
         ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
         goto err;
     }
 
     if (ivlen > 0) {
         if (RAND_bytes_ex(ossl_cms_ctx_get0_libctx(cms_ctx), iv, ivlen, 0) <= 0)
             goto err;
         if (EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, iv) <= 0) {
             ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
             goto err;
         }
         encalg->parameter = ASN1_TYPE_new();
         if (!encalg->parameter) {
             ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
             goto err;
         }
         if (EVP_CIPHER_param_to_asn1(ctx, encalg->parameter) <= 0) {
             ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
             goto err;
         }
     }
 
     encalg->algorithm = OBJ_nid2obj(EVP_CIPHER_CTX_get_type(ctx));
 
     EVP_CIPHER_CTX_free(ctx);
     ctx = NULL;
 
     /* Initialize recipient info */
     ri = M_ASN1_new_of(CMS_RecipientInfo);
     if (ri == NULL)
         goto merr;
 
     ri->d.pwri = M_ASN1_new_of(CMS_PasswordRecipientInfo);
     if (ri->d.pwri == NULL)
         goto merr;
     ri->type = CMS_RECIPINFO_PASS;
 
     pwri = ri->d.pwri;
     pwri->cms_ctx = cms_ctx;
     /* Since this is overwritten, free up empty structure already there */
     X509_ALGOR_free(pwri->keyEncryptionAlgorithm);
     pwri->keyEncryptionAlgorithm = X509_ALGOR_new();
     if (pwri->keyEncryptionAlgorithm == NULL)
         goto merr;
     pwri->keyEncryptionAlgorithm->algorithm = OBJ_nid2obj(wrap_nid);
     pwri->keyEncryptionAlgorithm->parameter = ASN1_TYPE_new();
     if (pwri->keyEncryptionAlgorithm->parameter == NULL)
         goto merr;
 
     if (!ASN1_item_pack(encalg, ASN1_ITEM_rptr(X509_ALGOR),
                         &pwri->keyEncryptionAlgorithm->parameter->
                         value.sequence))
          goto merr;
     pwri->keyEncryptionAlgorithm->parameter->type = V_ASN1_SEQUENCE;
 
     X509_ALGOR_free(encalg);
     encalg = NULL;
 
     /* Setup PBE algorithm */
 
     pwri->keyDerivationAlgorithm = PKCS5_pbkdf2_set(iter, NULL, 0, -1, -1);
 
     if (pwri->keyDerivationAlgorithm == NULL)
         goto err;
 
     CMS_RecipientInfo_set0_password(ri, pass, passlen);
     pwri->version = 0;
 
     if (!sk_CMS_RecipientInfo_push(ris, ri))
         goto merr;
 
     return ri;
 
  merr:
     ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
  err:
     EVP_CIPHER_CTX_free(ctx);
     if (ri)
         M_ASN1_free_of(ri, CMS_RecipientInfo);
     X509_ALGOR_free(encalg);
     return NULL;
 
 }
 
 /*
  * This is an implementation of the key wrapping mechanism in RFC3211, at
  * some point this should go into EVP.
  */
 
 static int kek_unwrap_key(unsigned char *out, size_t *outlen,
                           const unsigned char *in, size_t inlen,
                           EVP_CIPHER_CTX *ctx)
 {
     size_t blocklen = EVP_CIPHER_CTX_get_block_size(ctx);
     unsigned char *tmp;
     int outl, rv = 0;
     if (inlen < 2 * blocklen) {
         /* too small */
         return 0;
     }
     if (inlen % blocklen) {
         /* Invalid size */
         return 0;
     }
     if ((tmp = OPENSSL_malloc(inlen)) == NULL) {
         ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
         return 0;
     }
     /* setup IV by decrypting last two blocks */
     if (!EVP_DecryptUpdate(ctx, tmp + inlen - 2 * blocklen, &outl,
                            in + inlen - 2 * blocklen, blocklen * 2)
         /*
          * Do a decrypt of last decrypted block to set IV to correct value
          * output it to start of buffer so we don't corrupt decrypted block
          * this works because buffer is at least two block lengths long.
          */
         || !EVP_DecryptUpdate(ctx, tmp, &outl,
                               tmp + inlen - blocklen, blocklen)
         /* Can now decrypt first n - 1 blocks */
         || !EVP_DecryptUpdate(ctx, tmp, &outl, in, inlen - blocklen)
 
         /* Reset IV to original value */
         || !EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, NULL)
         /* Decrypt again */
         || !EVP_DecryptUpdate(ctx, tmp, &outl, tmp, inlen))
         goto err;
     /* Check check bytes */
     if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff) {
         /* Check byte failure */
         goto err;
     }
-    if (inlen < (size_t)(tmp[0] - 4)) {
+    if (inlen < 4 + (size_t)tmp[0]) {
         /* Invalid length value */
         goto err;
     }
     *outlen = (size_t)tmp[0];
     memcpy(out, tmp + 4, *outlen);
     rv = 1;
  err:
     OPENSSL_clear_free(tmp, inlen);
     return rv;
 
 }
 
 static int kek_wrap_key(unsigned char *out, size_t *outlen,
                         const unsigned char *in, size_t inlen,
                         EVP_CIPHER_CTX *ctx, const CMS_CTX *cms_ctx)
 {
     size_t blocklen = EVP_CIPHER_CTX_get_block_size(ctx);
     size_t olen;
     int dummy;
     /*
      * First decide length of output buffer: need header and round up to
      * multiple of block length.
      */
     olen = (inlen + 4 + blocklen - 1) / blocklen;
     olen *= blocklen;
     if (olen < 2 * blocklen) {
         /* Key too small */
         return 0;
     }
     if (inlen > 0xFF) {
         /* Key too large */
         return 0;
     }
     if (out) {
         /* Set header */
         out[0] = (unsigned char)inlen;
         out[1] = in[0] ^ 0xFF;
         out[2] = in[1] ^ 0xFF;
         out[3] = in[2] ^ 0xFF;
         memcpy(out + 4, in, inlen);
         /* Add random padding to end */
         if (olen > inlen + 4
             && RAND_bytes_ex(ossl_cms_ctx_get0_libctx(cms_ctx), out + 4 + inlen,
                              olen - 4 - inlen, 0) <= 0)
             return 0;
         /* Encrypt twice */
         if (!EVP_EncryptUpdate(ctx, out, &dummy, out, olen)
             || !EVP_EncryptUpdate(ctx, out, &dummy, out, olen))
             return 0;
     }
 
     *outlen = olen;
 
     return 1;
 }
 
 /* Encrypt/Decrypt content key in PWRI recipient info */
 
 int ossl_cms_RecipientInfo_pwri_crypt(const CMS_ContentInfo *cms,
                                       CMS_RecipientInfo *ri, int en_de)
 {
     CMS_EncryptedContentInfo *ec;
     CMS_PasswordRecipientInfo *pwri;
     int r = 0;
     X509_ALGOR *algtmp, *kekalg = NULL;
     EVP_CIPHER_CTX *kekctx = NULL;
     char name[OSSL_MAX_NAME_SIZE];
     EVP_CIPHER *kekcipher;
     unsigned char *key = NULL;
     size_t keylen;
     const CMS_CTX *cms_ctx = ossl_cms_get0_cmsctx(cms);
 
     ec = ossl_cms_get0_env_enc_content(cms);
 
     pwri = ri->d.pwri;
 
     if (pwri->pass == NULL) {
         ERR_raise(ERR_LIB_CMS, CMS_R_NO_PASSWORD);
         return 0;
     }
     algtmp = pwri->keyEncryptionAlgorithm;
 
     if (!algtmp || OBJ_obj2nid(algtmp->algorithm) != NID_id_alg_PWRI_KEK) {
         ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM);
         return 0;
     }
 
     kekalg = ASN1_TYPE_unpack_sequence(ASN1_ITEM_rptr(X509_ALGOR),
                                        algtmp->parameter);
 
     if (kekalg == NULL) {
         ERR_raise(ERR_LIB_CMS, CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER);
         return 0;
     }
 
     OBJ_obj2txt(name, sizeof(name), kekalg->algorithm, 0);
     kekcipher = EVP_CIPHER_fetch(ossl_cms_ctx_get0_libctx(cms_ctx), name,
                                  ossl_cms_ctx_get0_propq(cms_ctx));
 
     if (kekcipher == NULL) {
         ERR_raise(ERR_LIB_CMS, CMS_R_UNKNOWN_CIPHER);
         goto err;
     }
 
     kekctx = EVP_CIPHER_CTX_new();
     if (kekctx == NULL) {
         ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
         goto err;
     }
     /* Fixup cipher based on AlgorithmIdentifier to set IV etc */
     if (!EVP_CipherInit_ex(kekctx, kekcipher, NULL, NULL, NULL, en_de))
         goto err;
     EVP_CIPHER_CTX_set_padding(kekctx, 0);
     if (EVP_CIPHER_asn1_to_param(kekctx, kekalg->parameter) <= 0) {
         ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR);
         goto err;
     }
 
     algtmp = pwri->keyDerivationAlgorithm;
 
     /* Finish password based key derivation to setup key in "ctx" */
 
     if (EVP_PBE_CipherInit(algtmp->algorithm,
                            (char *)pwri->pass, pwri->passlen,
                            algtmp->parameter, kekctx, en_de) < 0) {
         ERR_raise(ERR_LIB_CMS, ERR_R_EVP_LIB);
         goto err;
     }
 
     /* Finally wrap/unwrap the key */
 
     if (en_de) {
 
         if (!kek_wrap_key(NULL, &keylen, ec->key, ec->keylen, kekctx, cms_ctx))
             goto err;
 
         key = OPENSSL_malloc(keylen);
 
         if (key == NULL)
             goto err;
 
         if (!kek_wrap_key(key, &keylen, ec->key, ec->keylen, kekctx, cms_ctx))
             goto err;
         pwri->encryptedKey->data = key;
         pwri->encryptedKey->length = keylen;
     } else {
         key = OPENSSL_malloc(pwri->encryptedKey->length);
 
         if (key == NULL) {
             ERR_raise(ERR_LIB_CMS, ERR_R_MALLOC_FAILURE);
             goto err;
         }
         if (!kek_unwrap_key(key, &keylen,
                             pwri->encryptedKey->data,
                             pwri->encryptedKey->length, kekctx)) {
             ERR_raise(ERR_LIB_CMS, CMS_R_UNWRAP_FAILURE);
             goto err;
         }
 
         OPENSSL_clear_free(ec->key, ec->keylen);
         ec->key = key;
         ec->keylen = keylen;
 
     }
 
     r = 1;
 
  err:
     EVP_CIPHER_free(kekcipher);
     EVP_CIPHER_CTX_free(kekctx);
 
     if (!r)
         OPENSSL_free(key);
     X509_ALGOR_free(kekalg);
 
     return r;
 
 }
diff --git a/crypto/openssl/crypto/http/http_lib.c b/crypto/openssl/crypto/http/http_lib.c
index 9c41f57541d7..614fd200b7c0 100644
--- a/crypto/openssl/crypto/http/http_lib.c
+++ b/crypto/openssl/crypto/http/http_lib.c
@@ -1,307 +1,308 @@
 /*
  * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include <stdio.h>       /* for sscanf() */
 #include <string.h>
 #ifndef OPENSSL_NO_SOCK
 # include "../bio/bio_local.h" /* for NI_MAXHOST */
 #endif
 #include <openssl/http.h>
 #include <openssl/httperr.h>
 #include <openssl/bio.h> /* for BIO_snprintf() */
 #include <openssl/err.h>
 #include "internal/cryptlib.h" /* for ossl_assert() */
 #ifndef NI_MAXHOST
 # define NI_MAXHOST 255
 #endif
 #include "crypto/ctype.h" /* for ossl_isspace() */
 
 static void init_pstring(char **pstr)
 {
     if (pstr != NULL) {
         *pstr = NULL;
     }
 }
 
 static void init_pint(int *pint)
 {
     if (pint != NULL) {
         *pint = 0;
     }
 }
 
 static int copy_substring(char **dest, const char *start, const char *end)
 {
     return dest == NULL
         || (*dest = OPENSSL_strndup(start, end - start)) != NULL;
 }
 
 static void free_pstring(char **pstr)
 {
     if (pstr != NULL) {
         OPENSSL_free(*pstr);
         *pstr = NULL;
     }
 }
 
 int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost,
                    char **pport, int *pport_num,
                    char **ppath, char **pquery, char **pfrag)
 {
     const char *p, *tmp;
     const char *scheme, *scheme_end;
     const char *user, *user_end;
     const char *host, *host_end;
     const char *port, *port_end;
     unsigned int portnum;
     const char *path, *path_end;
     const char *query, *query_end;
     const char *frag, *frag_end;
 
     init_pstring(pscheme);
     init_pstring(puser);
     init_pstring(phost);
     init_pstring(pport);
     init_pint(pport_num);
     init_pstring(ppath);
     init_pstring(pfrag);
     init_pstring(pquery);
 
     if (url == NULL) {
         ERR_raise(ERR_LIB_HTTP, ERR_R_PASSED_NULL_PARAMETER);
         return 0;
     }
 
     /* check for optional prefix "<scheme>://" */
     scheme = scheme_end = url;
     p = strstr(url, "://");
     if (p == NULL) {
         p = url;
     } else {
         scheme_end = p;
         if (scheme_end == scheme)
             goto parse_err;
         p += strlen("://");
     }
 
     /* parse optional "userinfo@" */
     user = user_end = host = p;
     host = strchr(p, '@');
     if (host != NULL)
         user_end = host++;
     else
         host = p;
 
     /* parse host name/address as far as needed here */
     if (host[0] == '[') {
         /* ipv6 literal, which may include ':' */
         host_end = strchr(host + 1, ']');
         if (host_end == NULL)
             goto parse_err;
         p = ++host_end;
     } else {
         /* look for start of optional port, path, query, or fragment */
         host_end = strchr(host, ':');
         if (host_end == NULL)
             host_end = strchr(host, '/');
         if (host_end == NULL)
             host_end = strchr(host, '?');
         if (host_end == NULL)
             host_end = strchr(host, '#');
         if (host_end == NULL) /* the remaining string is just the hostname */
             host_end = host + strlen(host);
         p = host_end;
     }
 
     /* parse optional port specification starting with ':' */
     port = "0"; /* default */
     if (*p == ':')
         port = ++p;
     /* remaining port spec handling is also done for the default values */
     /* make sure a decimal port number is given */
     if (sscanf(port, "%u", &portnum) <= 0 || portnum > 65535) {
         ERR_raise_data(ERR_LIB_HTTP, HTTP_R_INVALID_PORT_NUMBER, "%s", port);
         goto err;
     }
     for (port_end = port; '0' <= *port_end && *port_end <= '9'; port_end++)
         ;
     if (port == p) /* port was given explicitly */
         p += port_end - port;
 
     /* check for optional path starting with '/' or '?'. Else must start '#' */
     path = p;
     if (*path != '\0' && *path != '/' && *path != '?' && *path != '#') {
         ERR_raise(ERR_LIB_HTTP, HTTP_R_INVALID_URL_PATH);
         goto parse_err;
     }
     path_end = query = query_end = frag = frag_end = path + strlen(path);
 
     /* parse optional "?query" */
     tmp = strchr(p, '?');
     if (tmp != NULL) {
         p = tmp;
         if (pquery != NULL) {
             path_end = p;
             query = p + 1;
         }
     }
 
     /* parse optional "#fragment" */
     tmp = strchr(p, '#');
     if (tmp != NULL) {
         if (query == path_end) /* we did not record a query component */
             path_end = tmp;
         query_end = tmp;
         frag = tmp + 1;
     }
 
     if (!copy_substring(pscheme, scheme, scheme_end)
             || !copy_substring(phost, host, host_end)
             || !copy_substring(pport, port, port_end)
             || !copy_substring(puser, user, user_end)
             || !copy_substring(pquery, query, query_end)
             || !copy_substring(pfrag, frag, frag_end))
         goto err;
     if (pport_num != NULL)
         *pport_num = (int)portnum;
     if (*path == '/') {
         if (!copy_substring(ppath, path, path_end))
             goto err;
     } else if (ppath != NULL) { /* must prepend '/' */
         size_t buflen = 1 + path_end - path + 1;
 
         if ((*ppath = OPENSSL_malloc(buflen)) == NULL)
             goto err;
         BIO_snprintf(*ppath, buflen, "/%s", path);
     }
     return 1;
 
  parse_err:
     ERR_raise(ERR_LIB_HTTP, HTTP_R_ERROR_PARSING_URL);
 
  err:
     free_pstring(pscheme);
     free_pstring(puser);
     free_pstring(phost);
     free_pstring(pport);
     free_pstring(ppath);
     free_pstring(pquery);
     free_pstring(pfrag);
     return 0;
 }
 
 int OSSL_HTTP_parse_url(const char *url, int *pssl, char **puser, char **phost,
                         char **pport, int *pport_num,
                         char **ppath, char **pquery, char **pfrag)
 {
     char *scheme, *port;
     int ssl = 0, portnum;
 
     init_pstring(pport);
     if (pssl != NULL)
         *pssl = 0;
     if (!OSSL_parse_url(url, &scheme, puser, phost, &port, pport_num,
                         ppath, pquery, pfrag))
         return 0;
 
     /* check for optional HTTP scheme "http[s]" */
     if (strcmp(scheme, OSSL_HTTPS_NAME) == 0) {
         ssl = 1;
         if (pssl != NULL)
             *pssl = ssl;
     } else if (*scheme != '\0' && strcmp(scheme, OSSL_HTTP_NAME) != 0) {
         ERR_raise(ERR_LIB_HTTP, HTTP_R_INVALID_URL_SCHEME);
         OPENSSL_free(scheme);
         OPENSSL_free(port);
         goto err;
     }
     OPENSSL_free(scheme);
 
     if (strcmp(port, "0") == 0) {
         /* set default port */
         OPENSSL_free(port);
         port = ssl ? OSSL_HTTPS_PORT : OSSL_HTTP_PORT;
         if (!ossl_assert(sscanf(port, "%d", &portnum) == 1))
             goto err;
         if (pport_num != NULL)
             *pport_num = portnum;
         if (pport != NULL) {
             *pport = OPENSSL_strdup(port);
             if (*pport == NULL)
                 goto err;
         }
     } else {
         if (pport != NULL)
             *pport = port;
         else
             OPENSSL_free(port);
     }
     return 1;
 
  err:
     free_pstring(puser);
     free_pstring(phost);
     free_pstring(ppath);
     free_pstring(pquery);
     free_pstring(pfrag);
     return 0;
 }
 
 /* Respect no_proxy, taking default value from environment variable(s) */
 static int use_proxy(const char *no_proxy, const char *server)
 {
     size_t sl;
     const char *found = NULL;
     char host[NI_MAXHOST];
 
     if (!ossl_assert(server != NULL))
         return 0;
     sl = strlen(server);
     if (sl >= 2 && sl < sizeof(host) + 2 && server[0] == '[' && server[sl - 1] == ']') {
         /* strip leading '[' and trailing ']' from escaped IPv6 address */
         sl -= 2;
         strncpy(host, server + 1, sl);
+        host[sl] = '\0';
         server = host;
     }
 
     /*
      * using environment variable names, both lowercase and uppercase variants,
      * compatible with other HTTP client implementations like wget, curl and git
      */
     if (no_proxy == NULL)
         no_proxy = ossl_safe_getenv("no_proxy");
     if (no_proxy == NULL)
         no_proxy = ossl_safe_getenv(OPENSSL_NO_PROXY);
 
     if (no_proxy != NULL)
         found = strstr(no_proxy, server);
     while (found != NULL
            && ((found != no_proxy && !ossl_isspace(found[-1]) && found[-1] != ',')
                || (found[sl] != '\0' && !ossl_isspace(found[sl]) && found[sl] != ',')))
         found = strstr(found + 1, server);
     return found == NULL;
 }
 
 /* Take default value from environment variable(s), respect no_proxy */
 const char *OSSL_HTTP_adapt_proxy(const char *proxy, const char *no_proxy,
                                   const char *server, int use_ssl)
 {
     /*
      * using environment variable names, both lowercase and uppercase variants,
      * compatible with other HTTP client implementations like wget, curl and git
      */
     if (proxy == NULL)
         proxy = ossl_safe_getenv(use_ssl ? "https_proxy" : "http_proxy");
     if (proxy == NULL)
         proxy = ossl_safe_getenv(use_ssl ? OPENSSL_HTTPS_PROXY : OPENSSL_HTTP_PROXY);
 
     if (proxy == NULL || *proxy == '\0' || !use_proxy(no_proxy, server))
         return NULL;
     return proxy;
 }