From b825417043faa016a52ee400ce3a1c94f719a6e4 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 2 Jun 2026 08:10:47 +0200
Subject: [PATCH] tool_operhlp: avoid NULL to %s

If the filename allocation fails.

Reported-by: Gao Liyou
Ref: #21825
Closes #21836
---
 src/tool_operhlp.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/tool_operhlp.c b/src/tool_operhlp.c
index 0e360cbcbd..316393abb8 100644
--- a/src/tool_operhlp.c
+++ b/src/tool_operhlp.c
@@ -175,6 +175,8 @@ out:
   return result;
 }
 
+#define DEFAULT_FILENAME "curl_response"
+
 /* Extracts the name portion of the URL.
  * Returns a pointer to a heap-allocated string or NULL if
  * no name part, at location indicated by first argument.
@@ -218,8 +220,9 @@ CURLcode get_url_file_name(char **filename, const char *url, SANITIZEcode *sc)
       }
       else {
         /* no slash => empty string, use default */
-        *filename = curlx_strdup("curl_response");
-        warnf("No remote filename, uses \"%s\"", *filename);
+        *filename = curlx_strdup(DEFAULT_FILENAME);
+        if(*filename)
+          warnf("No remote filename, uses \"" DEFAULT_FILENAME "\"");
       }
 
       curl_free(path);