src/http/ngx_http_file_cache.c:296: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64 by call to `ngx_http_file_cache_exists`.

src/http/ngx_http_file_cache.c:287:15: Call
285. 
286.     if (c->node == NULL) {
287.         cln = ngx_pool_cleanup_add(r->pool, 0);
                   ^
288.         if (cln == NULL) {
289.             return NGX_ERROR;

src/core/ngx_palloc.c:318:9: Call
  316.     ngx_pool_cleanup_t  *c;
  317. 
  318.     c = ngx_palloc(p, sizeof(ngx_pool_cleanup_t));
               ^
  319.     if (c == NULL) {
  320.         return NULL;

src/core/ngx_palloc.c:142:16: Call
    140.         } while (p);
    141. 
    142.         return ngx_palloc_block(pool, size);
                        ^
    143.     }
    144. 

src/core/ngx_palloc.c:188:9: Call
      186.     psize = (size_t) (pool->d.end - (u_char *) pool);
      187. 
      188.     m = ngx_memalign(NGX_POOL_ALIGNMENT, psize, pool->log);
                   ^
      189.     if (m == NULL) {
      190.         return NULL;

src/os/unix/ngx_alloc.c:51:1: Parameter `log->next->disk_full_time`
        49. #if (NGX_HAVE_POSIX_MEMALIGN)
        50. 
        51. void *
            ^
        52. ngx_memalign(size_t alignment, size_t size, ngx_log_t *log)
        53. {

src/http/ngx_http_file_cache.c:296:10: Call
294.     }
295. 
296.     rc = ngx_http_file_cache_exists(cache, c);
              ^
297. 
298.     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,

src/http/ngx_http_file_cache.c:814:1: Parameter `cache->sh->count`
  812. 
  813. 
  814. static ngx_int_t
       ^
  815. ngx_http_file_cache_exists(ngx_http_file_cache_t *cache, ngx_http_cache_t *c)
  816. {

src/http/ngx_http_file_cache.c:871:16: Call
  869.         ngx_shmtx_unlock(&cache->shpool->mutex);
  870. 
  871.         (void) ngx_http_file_cache_forced_expire(cache);
                      ^
  872. 
  873.         ngx_shmtx_lock(&cache->shpool->mutex);

src/http/ngx_http_file_cache.c:1691:1: Parameter `cache->sh->count`
    1689. 
    1690. 
    1691. static time_t
          ^
    1692. ngx_http_file_cache_forced_expire(ngx_http_file_cache_t *cache)
    1693. {

src/http/ngx_http_file_cache.c:1732:13: Call
    1730. 
    1731.         if (fcn->count == 0) {
    1732.             ngx_http_file_cache_delete(cache, q, name);
                      ^
    1733.             wait = 0;
    1734. 

src/http/ngx_http_file_cache.c:1848:1: <LHS trace>
1846. 
1847. 
1848. static void
      ^
1849. ngx_http_file_cache_delete(ngx_http_file_cache_t *cache, ngx_queue_t *q,
1850.     u_char *name)

src/http/ngx_http_file_cache.c:1848:1: Parameter `cache->sh->count`
      1846. 
      1847. 
      1848. static void
            ^
      1849. ngx_http_file_cache_delete(ngx_http_file_cache_t *cache, ngx_queue_t *q,
      1850.     u_char *name)

src/http/ngx_http_file_cache.c:1894:9: Binary operation: ([0, +oo] - 1):unsigned64 by call to `ngx_http_file_cache_exists` 
      1892.         ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);
      1893.         ngx_slab_free_locked(cache->shpool, fcn);
      1894.         cache->sh->count--;
                    ^
      1895.     }
      1896. }

static void
ngx_http_file_cache_delete(ngx_http_file_cache_t *cache, ngx_queue_t *q,
    u_char *name)
{
    u_char                      *p;
    size_t                       len;
    ngx_path_t                  *path;
    ngx_http_file_cache_node_t  *fcn;
    fcn = ngx_queue_data(q, ngx_http_file_cache_node_t, queue);
    if (fcn->exists) {
        cache->sh->size -= fcn->fs_size;
        path = cache->path;
        p = name + path->name.len + 1 + path->len;
        p = ngx_hex_dump(p, (u_char *) &fcn->node.key,
                         sizeof(ngx_rbtree_key_t));
        len = NGX_HTTP_CACHE_KEY_LEN - sizeof(ngx_rbtree_key_t);
        p = ngx_hex_dump(p, fcn->key, len);
        *p = '\0';
        fcn->count++;
        fcn->deleting = 1;
        ngx_shmtx_unlock(&cache->shpool->mutex);
        len = path->name.len + 1 + path->len + 2 * NGX_HTTP_CACHE_KEY_LEN;
        ngx_create_hashed_filename(path, name, len);
        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,
                       "http file cache expire: \"%s\"", name);
        if (ngx_delete_file(name) == NGX_FILE_ERROR) {
            ngx_log_error(NGX_LOG_CRIT, ngx_cycle->log, ngx_errno,
                          ngx_delete_file_n " \"%s\" failed", name);
        }
        ngx_shmtx_lock(&cache->shpool->mutex);
        fcn->count--;
        fcn->deleting = 0;
    }
    if (fcn->count == 0) {
        ngx_queue_remove(q);
        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);
        ngx_slab_free_locked(cache->shpool, fcn);
        cache->sh->count--;
    }
}
['ngx_int_t\nngx_http_file_cache_open(ngx_http_request_t *r)\n{\n    ngx_int_t                  rc, rv;\n    ngx_uint_t                 test;\n    ngx_http_cache_t          *c;\n    ngx_pool_cleanup_t        *cln;\n    ngx_open_file_info_t       of;\n    ngx_http_file_cache_t     *cache;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->cache;\n    if (c->waiting) {\n        return NGX_AGAIN;\n    }\n    if (c->reading) {\n        return ngx_http_file_cache_read(r, c);\n    }\n    cache = c->file_cache;\n    if (c->node == NULL) {\n        cln = ngx_pool_cleanup_add(r->pool, 0);\n        if (cln == NULL) {\n            return NGX_ERROR;\n        }\n        cln->handler = ngx_http_file_cache_cleanup;\n        cln->data = c;\n    }\n    rc = ngx_http_file_cache_exists(cache, c);\n    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http file cache exists: %i e:%d", rc, c->exists);\n    if (rc == NGX_ERROR) {\n        return rc;\n    }\n    if (rc == NGX_AGAIN) {\n        return NGX_HTTP_CACHE_SCARCE;\n    }\n    if (rc == NGX_OK) {\n        if (c->error) {\n            return c->error;\n        }\n        c->temp_file = 1;\n        test = c->exists ? 1 : 0;\n        rv = NGX_DECLINED;\n    } else {\n        test = cache->sh->cold ? 1 : 0;\n        if (c->min_uses > 1) {\n            if (!test) {\n                return NGX_HTTP_CACHE_SCARCE;\n            }\n            rv = NGX_HTTP_CACHE_SCARCE;\n        } else {\n            c->temp_file = 1;\n            rv = NGX_DECLINED;\n        }\n    }\n    if (ngx_http_file_cache_name(r, cache->path) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (!test) {\n        goto done;\n    }\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    ngx_memzero(&of, sizeof(ngx_open_file_info_t));\n    of.uniq = c->uniq;\n    of.valid = clcf->open_file_cache_valid;\n    of.min_uses = clcf->open_file_cache_min_uses;\n    of.events = clcf->open_file_cache_events;\n    of.directio = NGX_OPEN_FILE_DIRECTIO_OFF;\n    of.read_ahead = clcf->read_ahead;\n    if (ngx_open_cached_file(clcf->open_file_cache, &c->file.name, &of, r->pool)\n        != NGX_OK)\n    {\n        switch (of.err) {\n        case 0:\n            return NGX_ERROR;\n        case NGX_ENOENT:\n        case NGX_ENOTDIR:\n            goto done;\n        default:\n            ngx_log_error(NGX_LOG_CRIT, r->connection->log, of.err,\n                          ngx_open_file_n " \\"%s\\" failed", c->file.name.data);\n            return NGX_ERROR;\n        }\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http file cache fd: %d", of.fd);\n    c->file.fd = of.fd;\n    c->file.log = r->connection->log;\n    c->uniq = of.uniq;\n    c->length = of.size;\n    c->fs_size = (of.fs_size + cache->bsize - 1) / cache->bsize;\n    c->buf = ngx_create_temp_buf(r->pool, c->body_start);\n    if (c->buf == NULL) {\n        return NGX_ERROR;\n    }\n    return ngx_http_file_cache_read(r, c);\ndone:\n    if (rv == NGX_DECLINED) {\n        return ngx_http_file_cache_lock(r, c);\n    }\n    return rv;\n}', 'ngx_pool_cleanup_t *\nngx_pool_cleanup_add(ngx_pool_t *p, size_t size)\n{\n    ngx_pool_cleanup_t  *c;\n    c = ngx_palloc(p, sizeof(ngx_pool_cleanup_t));\n    if (c == NULL) {\n        return NULL;\n    }\n    if (size) {\n        c->data = ngx_palloc(p, size);\n        if (c->data == NULL) {\n            return NULL;\n        }\n    } else {\n        c->data = NULL;\n    }\n    c->handler = NULL;\n    c->next = p->cleanup;\n    p->cleanup = c;\n    ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, p->log, 0, "add cleanup: %p", c);\n    return c;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    if (size <= pool->max) {\n        p = pool->current;\n        do {\n            m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);\n            if ((size_t) (p->d.end - m) >= size) {\n                p->d.last = m + size;\n                return m;\n            }\n            p = p->d.next;\n        } while (p);\n        return ngx_palloc_block(pool, size);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'static void *\nngx_palloc_block(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    size_t       psize;\n    ngx_pool_t  *p, *new;\n    psize = (size_t) (pool->d.end - (u_char *) pool);\n    m = ngx_memalign(NGX_POOL_ALIGNMENT, psize, pool->log);\n    if (m == NULL) {\n        return NULL;\n    }\n    new = (ngx_pool_t *) m;\n    new->d.end = m + psize;\n    new->d.next = NULL;\n    new->d.failed = 0;\n    m += sizeof(ngx_pool_data_t);\n    m = ngx_align_ptr(m, NGX_ALIGNMENT);\n    new->d.last = m + size;\n    for (p = pool->current; p->d.next; p = p->d.next) {\n        if (p->d.failed++ > 4) {\n            pool->current = p->d.next;\n        }\n    }\n    p->d.next = new;\n    return m;\n}', 'void *\nngx_memalign(size_t alignment, size_t size, ngx_log_t *log)\n{\n    void  *p;\n    int    err;\n    err = posix_memalign(&p, alignment, size);\n    if (err) {\n        ngx_log_error(NGX_LOG_EMERG, log, err,\n                      "posix_memalign(%uz, %uz) failed", alignment, size);\n        p = NULL;\n    }\n    ngx_log_debug3(NGX_LOG_DEBUG_ALLOC, log, 0,\n                   "posix_memalign: %p:%uz @%uz", p, size, alignment);\n    return p;\n}', 'static ngx_int_t\nngx_http_file_cache_exists(ngx_http_file_cache_t *cache, ngx_http_cache_t *c)\n{\n    ngx_int_t                    rc;\n    ngx_http_file_cache_node_t  *fcn;\n    ngx_shmtx_lock(&cache->shpool->mutex);\n    fcn = c->node;\n    if (fcn == NULL) {\n        fcn = ngx_http_file_cache_lookup(cache, c->key);\n    }\n    if (fcn) {\n        ngx_queue_remove(&fcn->queue);\n        if (c->node == NULL) {\n            fcn->uses++;\n            fcn->count++;\n        }\n        if (fcn->error) {\n            if (fcn->valid_sec < ngx_time()) {\n                goto renew;\n            }\n            rc = NGX_OK;\n            goto done;\n        }\n        if (fcn->exists || fcn->uses >= c->min_uses) {\n            c->exists = fcn->exists;\n            if (fcn->body_start) {\n                c->body_start = fcn->body_start;\n            }\n            rc = NGX_OK;\n            goto done;\n        }\n        rc = NGX_AGAIN;\n        goto done;\n    }\n    fcn = ngx_slab_calloc_locked(cache->shpool,\n                                 sizeof(ngx_http_file_cache_node_t));\n    if (fcn == NULL) {\n        ngx_http_file_cache_set_watermark(cache);\n        ngx_shmtx_unlock(&cache->shpool->mutex);\n        (void) ngx_http_file_cache_forced_expire(cache);\n        ngx_shmtx_lock(&cache->shpool->mutex);\n        fcn = ngx_slab_calloc_locked(cache->shpool,\n                                     sizeof(ngx_http_file_cache_node_t));\n        if (fcn == NULL) {\n            ngx_log_error(NGX_LOG_ALERT, ngx_cycle->log, 0,\n                          "could not allocate node%s", cache->shpool->log_ctx);\n            rc = NGX_ERROR;\n            goto failed;\n        }\n    }\n    cache->sh->count++;\n    ngx_memcpy((u_char *) &fcn->node.key, c->key, sizeof(ngx_rbtree_key_t));\n    ngx_memcpy(fcn->key, &c->key[sizeof(ngx_rbtree_key_t)],\n               NGX_HTTP_CACHE_KEY_LEN - sizeof(ngx_rbtree_key_t));\n    ngx_rbtree_insert(&cache->sh->rbtree, &fcn->node);\n    fcn->uses = 1;\n    fcn->count = 1;\nrenew:\n    rc = NGX_DECLINED;\n    fcn->valid_msec = 0;\n    fcn->error = 0;\n    fcn->exists = 0;\n    fcn->valid_sec = 0;\n    fcn->uniq = 0;\n    fcn->body_start = 0;\n    fcn->fs_size = 0;\ndone:\n    fcn->expire = ngx_time() + cache->inactive;\n    ngx_queue_insert_head(&cache->sh->queue, &fcn->queue);\n    c->uniq = fcn->uniq;\n    c->error = fcn->error;\n    c->node = fcn;\nfailed:\n    ngx_shmtx_unlock(&cache->shpool->mutex);\n    return rc;\n}', 'static time_t\nngx_http_file_cache_forced_expire(ngx_http_file_cache_t *cache)\n{\n    u_char                      *name;\n    size_t                       len;\n    time_t                       wait;\n    ngx_uint_t                   tries;\n    ngx_path_t                  *path;\n    ngx_queue_t                 *q;\n    ngx_http_file_cache_node_t  *fcn;\n    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,\n                   "http file cache forced expire");\n    path = cache->path;\n    len = path->name.len + 1 + path->len + 2 * NGX_HTTP_CACHE_KEY_LEN;\n    name = ngx_alloc(len + 1, ngx_cycle->log);\n    if (name == NULL) {\n        return 10;\n    }\n    ngx_memcpy(name, path->name.data, path->name.len);\n    wait = 10;\n    tries = 20;\n    ngx_shmtx_lock(&cache->shpool->mutex);\n    for (q = ngx_queue_last(&cache->sh->queue);\n         q != ngx_queue_sentinel(&cache->sh->queue);\n         q = ngx_queue_prev(q))\n    {\n        fcn = ngx_queue_data(q, ngx_http_file_cache_node_t, queue);\n        ngx_log_debug6(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,\n                  "http file cache forced expire: #%d %d %02xd%02xd%02xd%02xd",\n                  fcn->count, fcn->exists,\n                  fcn->key[0], fcn->key[1], fcn->key[2], fcn->key[3]);\n        if (fcn->count == 0) {\n            ngx_http_file_cache_delete(cache, q, name);\n            wait = 0;\n        } else {\n            if (--tries) {\n                continue;\n            }\n            wait = 1;\n        }\n        break;\n    }\n    ngx_shmtx_unlock(&cache->shpool->mutex);\n    ngx_free(name);\n    return wait;\n}', 'static void\nngx_http_file_cache_delete(ngx_http_file_cache_t *cache, ngx_queue_t *q,\n    u_char *name)\n{\n    u_char                      *p;\n    size_t                       len;\n    ngx_path_t                  *path;\n    ngx_http_file_cache_node_t  *fcn;\n    fcn = ngx_queue_data(q, ngx_http_file_cache_node_t, queue);\n    if (fcn->exists) {\n        cache->sh->size -= fcn->fs_size;\n        path = cache->path;\n        p = name + path->name.len + 1 + path->len;\n        p = ngx_hex_dump(p, (u_char *) &fcn->node.key,\n                         sizeof(ngx_rbtree_key_t));\n        len = NGX_HTTP_CACHE_KEY_LEN - sizeof(ngx_rbtree_key_t);\n        p = ngx_hex_dump(p, fcn->key, len);\n        *p = \'\\0\';\n        fcn->count++;\n        fcn->deleting = 1;\n        ngx_shmtx_unlock(&cache->shpool->mutex);\n        len = path->name.len + 1 + path->len + 2 * NGX_HTTP_CACHE_KEY_LEN;\n        ngx_create_hashed_filename(path, name, len);\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,\n                       "http file cache expire: \\"%s\\"", name);\n        if (ngx_delete_file(name) == NGX_FILE_ERROR) {\n            ngx_log_error(NGX_LOG_CRIT, ngx_cycle->log, ngx_errno,\n                          ngx_delete_file_n " \\"%s\\" failed", name);\n        }\n        ngx_shmtx_lock(&cache->shpool->mutex);\n        fcn->count--;\n        fcn->deleting = 0;\n    }\n    if (fcn->count == 0) {\n        ngx_queue_remove(q);\n        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);\n        ngx_slab_free_locked(cache->shpool, fcn);\n        cache->sh->count--;\n    }\n}']