src/http/ngx_http_upstream.c:4316: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ngx_http_upstream_finalize_request`.

src/http/ngx_http_upstream.c:4316:5: Call
4314.                    "cleanup http upstream request: \"%V\"", &r->uri);
4315. 
4316.     ngx_http_upstream_finalize_request(r, r->upstream, NGX_DONE);
          ^
4317. }
4318. 

src/http/ngx_http_upstream.c:4320:1: Parameter `r->main->count`
  4318. 
  4319. 
  4320. static void
        ^
  4321. ngx_http_upstream_finalize_request(ngx_http_request_t *r,
  4322.     ngx_http_upstream_t *u, ngx_int_t rc)

src/http/ngx_http_upstream.c:4331:9: Call
  4329.     if (u->cleanup == NULL) {
  4330.         /* the request was already finalized */
  4331.         ngx_http_finalize_request(r, NGX_DONE);
                ^
  4332.         return;
  4333.     }

src/http/ngx_http_request.c:2417:1: <LHS trace>
2415. 
2416. 
2417. void
      ^
2418. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
2419. {

src/http/ngx_http_request.c:2417:1: Parameter `r->main->count`
    2415. 
    2416. 
    2417. void
          ^
    2418. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
    2419. {

src/http/ngx_http_request.c:2528:13: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ngx_http_upstream_finalize_request` 
    2526.             }
    2527. 
    2528.             r->main->count--;
                      ^
    2529. 
    2530.             if (pr->postponed && pr->postponed->request == r) {

void
ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
{
    ngx_connection_t          *c;
    ngx_http_request_t        *pr;
    ngx_http_core_loc_conf_t  *clcf;
    c = r->connection;
    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,
                   "http finalize request: %i, \"%V?%V\" a:%d, c:%d",
                   rc, &r->uri, &r->args, r == c->data, r->main->count);
    if (rc == NGX_DONE) {
        ngx_http_finalize_connection(r);
        return;
    }
    if (rc == NGX_OK && r->filter_finalize) {
        c->error = 1;
    }
    if (rc == NGX_DECLINED) {
        r->content_handler = NULL;
        r->write_event_handler = ngx_http_core_run_phases;
        ngx_http_core_run_phases(r);
        return;
    }
    if (r != r->main && r->post_subrequest) {
        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);
    }
    if (rc == NGX_ERROR
        || rc == NGX_HTTP_REQUEST_TIME_OUT
        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST
        || c->error)
    {
        if (ngx_http_post_action(r) == NGX_OK) {
            return;
        }
        ngx_http_terminate_request(r, rc);
        return;
    }
    if (rc >= NGX_HTTP_SPECIAL_RESPONSE
        || rc == NGX_HTTP_CREATED
        || rc == NGX_HTTP_NO_CONTENT)
    {
        if (rc == NGX_HTTP_CLOSE) {
            c->timedout = 1;
            ngx_http_terminate_request(r, rc);
            return;
        }
        if (r == r->main) {
            if (c->read->timer_set) {
                ngx_del_timer(c->read);
            }
            if (c->write->timer_set) {
                ngx_del_timer(c->write);
            }
        }
        c->read->handler = ngx_http_request_handler;
        c->write->handler = ngx_http_request_handler;
        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));
        return;
    }
    if (r != r->main) {
        if (r->buffered || r->postponed) {
            if (ngx_http_set_write_handler(r) != NGX_OK) {
                ngx_http_terminate_request(r, 0);
            }
            return;
        }
        pr = r->parent;
        if (r == c->data || r->background) {
            if (!r->logged) {
                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
                if (clcf->log_subrequest) {
                    ngx_http_log_request(r);
                }
                r->logged = 1;
            } else {
                ngx_log_error(NGX_LOG_ALERT, c->log, 0,
                              "subrequest: \"%V?%V\" logged again",
                              &r->uri, &r->args);
            }
            r->done = 1;
            if (r->background) {
                ngx_http_finalize_connection(r);
                return;
            }
            r->main->count--;
            if (pr->postponed && pr->postponed->request == r) {
                pr->postponed = pr->postponed->next;
            }
            c->data = pr;
        } else {
            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
                           "http finalize non-active request: \"%V?%V\"",
                           &r->uri, &r->args);
            r->write_event_handler = ngx_http_request_finalizer;
            if (r->waited) {
                r->done = 1;
            }
        }
        if (ngx_http_post_request(pr, NULL) != NGX_OK) {
            r->main->count++;
            ngx_http_terminate_request(r, 0);
            return;
        }
        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
                       "http wake parent request: \"%V?%V\"",
                       &pr->uri, &pr->args);
        return;
    }
    if (r->buffered || c->buffered || r->postponed) {
        if (ngx_http_set_write_handler(r) != NGX_OK) {
            ngx_http_terminate_request(r, 0);
        }
        return;
    }
    if (r != c->data) {
        ngx_log_error(NGX_LOG_ALERT, c->log, 0,
                      "http finalize non-active request: \"%V?%V\"",
                      &r->uri, &r->args);
        return;
    }
    r->done = 1;
    r->read_event_handler = ngx_http_block_reading;
    r->write_event_handler = ngx_http_request_empty_handler;
    if (!r->post_action) {
        r->request_complete = 1;
    }
    if (ngx_http_post_action(r) == NGX_OK) {
        return;
    }
    if (c->read->timer_set) {
        ngx_del_timer(c->read);
    }
    if (c->write->timer_set) {
        c->write->delayed = 0;
        ngx_del_timer(c->write);
    }
    if (c->read->eof) {
        ngx_http_close_request(r, 0);
        return;
    }
    ngx_http_finalize_connection(r);
}
['static void\nngx_http_upstream_cleanup(void *data)\n{\n    ngx_http_request_t *r = data;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "cleanup http upstream request: \\"%V\\"", &r->uri);\n    ngx_http_upstream_finalize_request(r, r->upstream, NGX_DONE);\n}', 'static void\nngx_http_upstream_finalize_request(ngx_http_request_t *r,\n    ngx_http_upstream_t *u, ngx_int_t rc)\n{\n    ngx_uint_t  flush;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "finalize http upstream request: %i", rc);\n    if (u->cleanup == NULL) {\n        ngx_http_finalize_request(r, NGX_DONE);\n        return;\n    }\n    *u->cleanup = NULL;\n    u->cleanup = NULL;\n    if (u->resolved && u->resolved->ctx) {\n        ngx_resolve_name_done(u->resolved->ctx);\n        u->resolved->ctx = NULL;\n    }\n    if (u->state && u->state->response_time == (ngx_msec_t) -1) {\n        u->state->response_time = ngx_current_msec - u->start_time;\n        if (u->pipe && u->pipe->read_length) {\n            u->state->bytes_received += u->pipe->read_length\n                                        - u->pipe->preread_size;\n            u->state->response_length = u->pipe->read_length;\n        }\n        if (u->peer.connection) {\n            u->state->bytes_sent = u->peer.connection->sent;\n        }\n    }\n    u->finalize_request(r, rc);\n    if (u->peer.free && u->peer.sockaddr) {\n        u->peer.free(&u->peer, u->peer.data, 0);\n        u->peer.sockaddr = NULL;\n    }\n    if (u->peer.connection) {\n#if (NGX_HTTP_SSL)\n        if (u->peer.connection->ssl) {\n            u->peer.connection->ssl->no_wait_shutdown = 1;\n            (void) ngx_ssl_shutdown(u->peer.connection);\n        }\n#endif\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "close http upstream connection: %d",\n                       u->peer.connection->fd);\n        if (u->peer.connection->pool) {\n            ngx_destroy_pool(u->peer.connection->pool);\n        }\n        ngx_close_connection(u->peer.connection);\n    }\n    u->peer.connection = NULL;\n    if (u->pipe && u->pipe->temp_file) {\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream temp fd: %d",\n                       u->pipe->temp_file->file.fd);\n    }\n    if (u->store && u->pipe && u->pipe->temp_file\n        && u->pipe->temp_file->file.fd != NGX_INVALID_FILE)\n    {\n        if (ngx_delete_file(u->pipe->temp_file->file.name.data)\n            == NGX_FILE_ERROR)\n        {\n            ngx_log_error(NGX_LOG_CRIT, r->connection->log, ngx_errno,\n                          ngx_delete_file_n " \\"%s\\" failed",\n                          u->pipe->temp_file->file.name.data);\n        }\n    }\n#if (NGX_HTTP_CACHE)\n    if (r->cache) {\n        if (u->cacheable) {\n            if (rc == NGX_HTTP_BAD_GATEWAY || rc == NGX_HTTP_GATEWAY_TIME_OUT) {\n                time_t  valid;\n                valid = ngx_http_file_cache_valid(u->conf->cache_valid, rc);\n                if (valid) {\n                    r->cache->valid_sec = ngx_time() + valid;\n                    r->cache->error = rc;\n                }\n            }\n        }\n        ngx_http_file_cache_free(r->cache, u->pipe->temp_file);\n    }\n#endif\n    r->read_event_handler = ngx_http_block_reading;\n    if (rc == NGX_DECLINED) {\n        return;\n    }\n    r->connection->log->action = "sending to client";\n    if (!u->header_sent\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST)\n    {\n        ngx_http_finalize_request(r, rc);\n        return;\n    }\n    flush = 0;\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {\n        rc = NGX_ERROR;\n        flush = 1;\n    }\n    if (r->header_only\n        || (u->pipe && u->pipe->downstream_error))\n    {\n        ngx_http_finalize_request(r, rc);\n        return;\n    }\n    if (rc == 0) {\n        if (ngx_http_upstream_process_trailers(r, u) != NGX_OK) {\n            ngx_http_finalize_request(r, NGX_ERROR);\n            return;\n        }\n        rc = ngx_http_send_special(r, NGX_HTTP_LAST);\n    } else if (flush) {\n        r->keepalive = 0;\n        rc = ngx_http_send_special(r, NGX_HTTP_FLUSH);\n    }\n    ngx_http_finalize_request(r, rc);\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %i, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            c->timedout = 1;\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n        pr = r->parent;\n        if (r == c->data || r->background) {\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (r->background) {\n                ngx_http_finalize_connection(r);\n                return;\n            }\n            r->main->count--;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    r->read_event_handler = ngx_http_block_reading;\n    r->write_event_handler = ngx_http_request_empty_handler;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}']