IIS: Host header fallback is dead code (r->hostname == NULL can never be true)

Author: A13501350Created Aug 27, 2026Updated Sep 15, 2026
LabelsPlatform - IIS2.x

Summary

In iis/mymodule.cpp, the Host header fallback when the request URI contains no host is dead code, because r->hostname == NULL can never be true.

r->hostname is assigned from ConvertUTF16ToUTF8(req->CookedUrl.pHost, ...) (line 840). That helper never returns NULL: on NULL/empty input, zero converted bytes, or conversion error it returns the string literal "" (see mymodule.cpp:180-184, :199-202, :226-229); on success it returns a pool-allocated buffer. So after line 840 r->hostname is always non-NULL (an empty string when the URI has no host).

As a result:

  • mymodule.cpp:843 if(r->hostname == NULL) is always false → the fallback to req->Headers.KnownHeaders[HttpHeaderHost] never runs.
  • mymodule.cpp:853 if(r->hostname != NULL) is always true.

Impact

For ordinary HTTP/1.1 requests (GET /path with a Host: header, where the request line carries no host), CookedUrl.pHost is empty, so r->hostname becomes "" instead of the value from the Host header. The intended fallback is silently skipped, leaving r->hostname / r->parsed_uri.hostname empty. Hostname-dependent rules and logging may see an empty host.

Suggested fix

Check for an empty string as well as NULL (keeps the helper's contract intact for the other callers path_info/args):

c
    r->hostname = ConvertUTF16ToUTF8(req->CookedUrl.pHost, req->CookedUrl.HostLength / sizeof(WCHAR), r->pool);

    if(r->hostname == NULL || r->hostname[0] == '\0')
    {
        if(req->Headers.KnownHeaders[HttpHeaderHost].pRawValue != NULL)
            r->hostname = ZeroTerminate(req->Headers.KnownHeaders[HttpHeaderHost].pRawValue,
                                        req->Headers.KnownHeaders[HttpHeaderHost].RawValueLength, r->pool);
    }

Source: owasp-modsecurity/ModSecurity