From 5871d98c368751a6d992ed64f8cd22cb78c44cee Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Mon, 20 Jul 2026 12:33:53 +0100
Subject: [PATCH] webdav: tus: fix potential nil pointer crash
 GHSA-3x6r-wxxg-53vv

---
 backend/webdav/tus.go | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/backend/webdav/tus.go b/backend/webdav/tus.go
index 3f6a843bb..77207bc3c 100644
--- a/backend/webdav/tus.go
+++ b/backend/webdav/tus.go
@@ -44,14 +44,18 @@ func (o *Object) updateViaTus(ctx context.Context, in io.Reader, contentType str
 
 func (f *Fs) getTusLocationOrRetry(ctx context.Context, resp *http.Response, err error) (bool, string, error) {
 
-	switch resp.StatusCode {
-	case 201:
-		location := resp.Header.Get("Location")
-		return false, location, nil
-	case 412:
-		return false, "", ErrVersionMismatch
-	case 413:
-		return false, "", ErrLargeUpload
+	// resp is nil if the HTTP transaction failed before a response
+	// was received, eg on connection refused or reset
+	if resp != nil {
+		switch resp.StatusCode {
+		case 201:
+			location := resp.Header.Get("Location")
+			return false, location, nil
+		case 412:
+			return false, "", ErrVersionMismatch
+		case 413:
+			return false, "", ErrLargeUpload
+		}
 	}
 
 	retry, err := f.shouldRetry(ctx, resp, err)