src/http/modules/ngx_http_limit_conn_module.c:724: error: Null Dereference
  pointer `limit` last assigned on line 723 could be null and is dereferenced at line 724, column 5.

src/http/modules/ngx_http_limit_conn_module.c:674:1: start of procedure ngx_http_limit_conn()
672. 
673. 
674. static char *
     ^
675. ngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
676. {

src/http/modules/ngx_http_limit_conn_module.c:678:5: 
676. {
677.     ngx_shm_zone_t               *shm_zone;
678.     ngx_http_limit_conn_conf_t   *lccf = conf;
         ^
679.     ngx_http_limit_conn_limit_t  *limit, *limits;
680. 

src/http/modules/ngx_http_limit_conn_module.c:685:5: 
683.     ngx_uint_t  i;
684. 
685.     value = cf->args->elts;
         ^
686. 
687.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,

src/http/modules/ngx_http_limit_conn_module.c:687:5: Skipping ngx_shared_memory_add(): empty list of specs
685.     value = cf->args->elts;
686. 
687.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
         ^
688.                                      &ngx_http_limit_conn_module);
689.     if (shm_zone == NULL) {

src/http/modules/ngx_http_limit_conn_module.c:689:9: Taking false branch
687.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
688.                                      &ngx_http_limit_conn_module);
689.     if (shm_zone == NULL) {
             ^
690.         return NGX_CONF_ERROR;
691.     }

src/http/modules/ngx_http_limit_conn_module.c:693:5: 
691.     }
692. 
693.     limits = lccf->limits.elts;
         ^
694. 
695.     if (limits == NULL) {

src/http/modules/ngx_http_limit_conn_module.c:695:9: Taking false branch
693.     limits = lccf->limits.elts;
694. 
695.     if (limits == NULL) {
             ^
696.         if (ngx_array_init(&lccf->limits, cf->pool, 1,
697.                            sizeof(ngx_http_limit_conn_limit_t))

src/http/modules/ngx_http_limit_conn_module.c:704:10: 
702.     }
703. 
704.     for (i = 0; i < lccf->limits.nelts; i++) {
              ^
705.         if (shm_zone == limits[i].shm_zone) {
706.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:704:17: Loop condition is true. Entering loop body
702.     }
703. 
704.     for (i = 0; i < lccf->limits.nelts; i++) {
                     ^
705.         if (shm_zone == limits[i].shm_zone) {
706.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:705:13: Taking false branch
703. 
704.     for (i = 0; i < lccf->limits.nelts; i++) {
705.         if (shm_zone == limits[i].shm_zone) {
                 ^
706.             return "is duplicate";
707.         }

src/http/modules/ngx_http_limit_conn_module.c:704:41: 
702.     }
703. 
704.     for (i = 0; i < lccf->limits.nelts; i++) {
                                             ^
705.         if (shm_zone == limits[i].shm_zone) {
706.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:704:17: Loop condition is false. Leaving loop
702.     }
703. 
704.     for (i = 0; i < lccf->limits.nelts; i++) {
                     ^
705.         if (shm_zone == limits[i].shm_zone) {
706.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:710:5: 
708.     }
709. 
710.     n = ngx_atoi(value[2].data, value[2].len);
         ^
711.     if (n <= 0) {
712.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,

src/core/ngx_string.c:852:1: start of procedure ngx_atoi()
  850. 
  851. 
  852. ngx_int_t
       ^
  853. ngx_atoi(u_char *line, size_t n)
  854. {

src/core/ngx_string.c:857:9: Taking false branch
  855.     ngx_int_t  value;
  856. 
  857.     if (n == 0) {
               ^
  858.         return NGX_ERROR;
  859.     }

src/core/ngx_string.c:861:10: 
  859.     }
  860. 
  861.     for (value = 0; n--; line++) {
                ^
  862.         if (*line < '0' || *line > '9') {
  863.             return NGX_ERROR;

src/core/ngx_string.c:861:21: Loop condition is true. Entering loop body
  859.     }
  860. 
  861.     for (value = 0; n--; line++) {
                           ^
  862.         if (*line < '0' || *line > '9') {
  863.             return NGX_ERROR;

src/core/ngx_string.c:862:13: Taking false branch
  860. 
  861.     for (value = 0; n--; line++) {
  862.         if (*line < '0' || *line > '9') {
                   ^
  863.             return NGX_ERROR;
  864.         }

src/core/ngx_string.c:862:28: Taking false branch
  860. 
  861.     for (value = 0; n--; line++) {
  862.         if (*line < '0' || *line > '9') {
                                  ^
  863.             return NGX_ERROR;
  864.         }

src/core/ngx_string.c:866:9: 
  864.         }
  865. 
  866.         value = value * 10 + (*line - '0');
               ^
  867.     }
  868. 

src/core/ngx_string.c:861:26: 
  859.     }
  860. 
  861.     for (value = 0; n--; line++) {
                                ^
  862.         if (*line < '0' || *line > '9') {
  863.             return NGX_ERROR;

src/core/ngx_string.c:861:21: Loop condition is false. Leaving loop
  859.     }
  860. 
  861.     for (value = 0; n--; line++) {
                           ^
  862.         if (*line < '0' || *line > '9') {
  863.             return NGX_ERROR;

src/core/ngx_string.c:869:9: Taking false branch
  867.     }
  868. 
  869.     if (value < 0) {
               ^
  870.         return NGX_ERROR;
  871. 

src/core/ngx_string.c:873:9: 
  871. 
  872.     } else {
  873.         return value;
               ^
  874.     }
  875. }

src/core/ngx_string.c:875:1: return from a call to ngx_atoi
  873.         return value;
  874.     }
  875. }
       ^
  876. 
  877. 

src/http/modules/ngx_http_limit_conn_module.c:711:9: Taking false branch
709. 
710.     n = ngx_atoi(value[2].data, value[2].len);
711.     if (n <= 0) {
             ^
712.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
713.                            "invalid number of connections \"%V\"", &value[2]);

src/http/modules/ngx_http_limit_conn_module.c:717:9: Taking false branch
715.     }
716. 
717.     if (n > 65535) {
             ^
718.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
719.                            "connection limit must be less 65536");

src/http/modules/ngx_http_limit_conn_module.c:723:5: 
721.     }
722. 
723.     limit = ngx_array_push(&lccf->limits);
         ^
724.     limit->conn = n;
725.     limit->shm_zone = shm_zone;

src/core/ngx_array.c:53:1: start of procedure ngx_array_push()
  51. 
  52. 
  53. void *
      ^
  54. ngx_array_push(ngx_array_t *a)
  55. {

src/core/ngx_array.c:60:9: Taking true branch
  58.     ngx_pool_t  *p;
  59. 
  60.     if (a->nelts == a->nalloc) {
              ^
  61. 
  62.         /* the array is full */

src/core/ngx_array.c:64:9: 
  62.         /* the array is full */
  63. 
  64.         size = a->size * a->nalloc;
              ^
  65. 
  66.         p = a->pool;

src/core/ngx_array.c:66:9: 
  64.         size = a->size * a->nalloc;
  65. 
  66.         p = a->pool;
              ^
  67. 
  68.         if ((u_char *) a->elts + size == p->d.last

src/core/ngx_array.c:68:13: Taking false branch
  66.         p = a->pool;
  67. 
  68.         if ((u_char *) a->elts + size == p->d.last
                  ^
  69.             && p->d.last + a->size <= p->d.end)
  70.         {

src/core/ngx_array.c:82:13: Skipping ngx_palloc(): empty list of specs
  80.             /* allocate a new array */
  81. 
  82.             new = ngx_palloc(p, 2 * size);
                  ^
  83.             if (new == NULL) {
  84.                 return NULL;

src/core/ngx_array.c:83:17: Taking true branch
  81. 
  82.             new = ngx_palloc(p, 2 * size);
  83.             if (new == NULL) {
                      ^
  84.                 return NULL;
  85.             }

src/core/ngx_array.c:84:17: 
  82.             new = ngx_palloc(p, 2 * size);
  83.             if (new == NULL) {
  84.                 return NULL;
                      ^
  85.             }
  86. 

src/core/ngx_array.c:97:1: return from a call to ngx_array_push
  95. 
  96.     return elt;
  97. }
      ^
  98. 
  99. 

src/http/modules/ngx_http_limit_conn_module.c:724:5: 
722. 
723.     limit = ngx_array_push(&lccf->limits);
724.     limit->conn = n;
         ^
725.     limit->shm_zone = shm_zone;
726. 

static char *
ngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    ngx_shm_zone_t               *shm_zone;
    ngx_http_limit_conn_conf_t   *lccf = conf;
    ngx_http_limit_conn_limit_t  *limit, *limits;
    ngx_str_t  *value;
    ngx_int_t   n;
    ngx_uint_t  i;
    value = cf->args->elts;
    shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
                                     &ngx_http_limit_conn_module);
    if (shm_zone == NULL) {
        return NGX_CONF_ERROR;
    }
    limits = lccf->limits.elts;
    if (limits == NULL) {
        if (ngx_array_init(&lccf->limits, cf->pool, 1,
                           sizeof(ngx_http_limit_conn_limit_t))
            != NGX_OK)
        {
            return NGX_CONF_ERROR;
        }
    }
    for (i = 0; i < lccf->limits.nelts; i++) {
        if (shm_zone == limits[i].shm_zone) {
            return "is duplicate";
        }
    }
    n = ngx_atoi(value[2].data, value[2].len);
    if (n <= 0) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "invalid number of connections \"%V\"", &value[2]);
        return NGX_CONF_ERROR;
    }
    if (n > 65535) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "connection limit must be less 65536");
        return NGX_CONF_ERROR;
    }
    limit = ngx_array_push(&lccf->limits);
    limit->conn = n;
    limit->shm_zone = shm_zone;
    return NGX_CONF_OK;
}
['static char *\nngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_shm_zone_t               *shm_zone;\n    ngx_http_limit_conn_conf_t   *lccf = conf;\n    ngx_http_limit_conn_limit_t  *limit, *limits;\n    ngx_str_t  *value;\n    ngx_int_t   n;\n    ngx_uint_t  i;\n    value = cf->args->elts;\n    shm_zone = ngx_shared_memory_add(cf, &value[1], 0,\n                                     &ngx_http_limit_conn_module);\n    if (shm_zone == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    limits = lccf->limits.elts;\n    if (limits == NULL) {\n        if (ngx_array_init(&lccf->limits, cf->pool, 1,\n                           sizeof(ngx_http_limit_conn_limit_t))\n            != NGX_OK)\n        {\n            return NGX_CONF_ERROR;\n        }\n    }\n    for (i = 0; i < lccf->limits.nelts; i++) {\n        if (shm_zone == limits[i].shm_zone) {\n            return "is duplicate";\n        }\n    }\n    n = ngx_atoi(value[2].data, value[2].len);\n    if (n <= 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid number of connections \\"%V\\"", &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (n > 65535) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "connection limit must be less 65536");\n        return NGX_CONF_ERROR;\n    }\n    limit = ngx_array_push(&lccf->limits);\n    limit->conn = n;\n    limit->shm_zone = shm_zone;\n    return NGX_CONF_OK;\n}', "ngx_int_t\nngx_atoi(u_char *line, size_t n)\n{\n    ngx_int_t  value;\n    if (n == 0) {\n        return NGX_ERROR;\n    }\n    for (value = 0; n--; line++) {\n        if (*line < '0' || *line > '9') {\n            return NGX_ERROR;\n        }\n        value = value * 10 + (*line - '0');\n    }\n    if (value < 0) {\n        return NGX_ERROR;\n    } else {\n        return value;\n    }\n}", 'void *\nngx_array_push(ngx_array_t *a)\n{\n    void        *elt, *new;\n    size_t       size;\n    ngx_pool_t  *p;\n    if (a->nelts == a->nalloc) {\n        size = a->size * a->nalloc;\n        p = a->pool;\n        if ((u_char *) a->elts + size == p->d.last\n            && p->d.last + a->size <= p->d.end)\n        {\n            p->d.last += a->size;\n            a->nalloc++;\n        } else {\n            new = ngx_palloc(p, 2 * size);\n            if (new == NULL) {\n                return NULL;\n            }\n            ngx_memcpy(new, a->elts, size);\n            a->elts = new;\n            a->nalloc *= 2;\n        }\n    }\n    elt = (u_char *) a->elts + a->size * a->nelts;\n    a->nelts++;\n    return elt;\n}']