src/http/ngx_http_upstream.c:590: error: Integer Overflow L2
  ([0, 3+max(64532, `r->main->count`)] - 1):unsigned32 by call to `ngx_http_finalize_request`.

src/http/ngx_http_upstream.c:535:1: Parameter `r->main->count`
533. 
534. 
535. static void
     ^
536. ngx_http_upstream_init_request(ngx_http_request_t *r)
537. {

src/http/ngx_http_upstream.c:590:13: Call
588. 
589.         if (rc != NGX_DECLINED) {
590.             ngx_http_finalize_request(r, rc);
                 ^
591.             return;
592.         }

src/http/ngx_http_request.c:2268:1: Parameter `r->main->count`
  2266. 
  2267. 
  2268. void
        ^
  2269. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
  2270. {

src/http/ngx_http_request.c:2306:13: Call
  2304.         || c->error)
  2305.     {
  2306.         if (ngx_http_post_action(r) == NGX_OK) {
                    ^
  2307.             return;
  2308.         }

src/http/ngx_http_request.c:3365:1: <LHS trace>
3363. 
3364. 
3365. static ngx_int_t
      ^
3366. ngx_http_post_action(ngx_http_request_t *r)
3367. {

src/http/ngx_http_request.c:3365:1: Parameter `r->main->count`
    3363. 
    3364. 
    3365. static ngx_int_t
          ^
    3366. ngx_http_post_action(ngx_http_request_t *r)
    3367. {

src/http/ngx_http_request.c:3383:5: Binary operation: ([0, 3+max(64532, r->main->count)] - 1):unsigned32 by call to `ngx_http_finalize_request` 
    3381.                    "post action: \"%V\"", &clcf->post_action);
    3382. 
    3383.     r->main->count--;
              ^
    3384. 
    3385.     r->http_version = NGX_HTTP_VERSION_9;

static ngx_int_t
ngx_http_post_action(ngx_http_request_t *r)
{
    ngx_http_core_loc_conf_t  *clcf;
    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
    if (clcf->post_action.data == NULL) {
        return NGX_DECLINED;
    }
    if (r->post_action && r->uri_changes == 0) {
        return NGX_DECLINED;
    }
    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                   "post action: \"%V\"", &clcf->post_action);
    r->main->count--;
    r->http_version = NGX_HTTP_VERSION_9;
    r->header_only = 1;
    r->post_action = 1;
    r->read_event_handler = ngx_http_block_reading;
    if (clcf->post_action.data[0] == '/') {
        ngx_http_internal_redirect(r, &clcf->post_action, NULL);
    } else {
        ngx_http_named_location(r, &clcf->post_action);
    }
    return NGX_OK;
}
['static void\nngx_http_upstream_init_request(ngx_http_request_t *r)\n{\n    ngx_str_t                      *host;\n    ngx_uint_t                      i;\n    ngx_resolver_ctx_t             *ctx, temp;\n    ngx_http_cleanup_t             *cln;\n    ngx_http_upstream_t            *u;\n    ngx_http_core_loc_conf_t       *clcf;\n    ngx_http_upstream_srv_conf_t   *uscf, **uscfp;\n    ngx_http_upstream_main_conf_t  *umcf;\n    if (r->aio) {\n        return;\n    }\n    u = r->upstream;\n#if (NGX_HTTP_CACHE)\n    if (u->conf->cache) {\n        ngx_int_t  rc;\n        rc = ngx_http_upstream_cache(r, u);\n        if (rc == NGX_BUSY) {\n            r->write_event_handler = ngx_http_upstream_init_request;\n            return;\n        }\n        r->write_event_handler = ngx_http_request_empty_handler;\n        if (rc == NGX_ERROR) {\n            ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return;\n        }\n        if (rc == NGX_OK) {\n            rc = ngx_http_upstream_cache_send(r, u);\n            if (rc == NGX_DONE) {\n                return;\n            }\n            if (rc == NGX_HTTP_UPSTREAM_INVALID_HEADER) {\n                rc = NGX_DECLINED;\n                r->cached = 0;\n            }\n            if (ngx_http_upstream_cache_background_update(r, u) != NGX_OK) {\n                rc = NGX_ERROR;\n            }\n        }\n        if (rc != NGX_DECLINED) {\n            ngx_http_finalize_request(r, rc);\n            return;\n        }\n    }\n#endif\n    u->store = u->conf->store;\n    if (!u->store && !r->post_action && !u->conf->ignore_client_abort) {\n        r->read_event_handler = ngx_http_upstream_rd_check_broken_connection;\n        r->write_event_handler = ngx_http_upstream_wr_check_broken_connection;\n    }\n    if (r->request_body) {\n        u->request_bufs = r->request_body->bufs;\n    }\n    if (u->create_request(r) != NGX_OK) {\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    if (ngx_http_upstream_set_local(r, u, u->conf->local) != NGX_OK) {\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    u->output.alignment = clcf->directio_alignment;\n    u->output.pool = r->pool;\n    u->output.bufs.num = 1;\n    u->output.bufs.size = clcf->client_body_buffer_size;\n    if (u->output.output_filter == NULL) {\n        u->output.output_filter = ngx_chain_writer;\n        u->output.filter_ctx = &u->writer;\n    }\n    u->writer.pool = r->pool;\n    if (r->upstream_states == NULL) {\n        r->upstream_states = ngx_array_create(r->pool, 1,\n                                            sizeof(ngx_http_upstream_state_t));\n        if (r->upstream_states == NULL) {\n            ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return;\n        }\n    } else {\n        u->state = ngx_array_push(r->upstream_states);\n        if (u->state == NULL) {\n            ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return;\n        }\n        ngx_memzero(u->state, sizeof(ngx_http_upstream_state_t));\n    }\n    cln = ngx_http_cleanup_add(r, 0);\n    if (cln == NULL) {\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    cln->handler = ngx_http_upstream_cleanup;\n    cln->data = r;\n    u->cleanup = &cln->handler;\n    if (u->resolved == NULL) {\n        uscf = u->conf->upstream;\n    } else {\n#if (NGX_HTTP_SSL)\n        u->ssl_name = u->resolved->host;\n#endif\n        host = &u->resolved->host;\n        umcf = ngx_http_get_module_main_conf(r, ngx_http_upstream_module);\n        uscfp = umcf->upstreams.elts;\n        for (i = 0; i < umcf->upstreams.nelts; i++) {\n            uscf = uscfp[i];\n            if (uscf->host.len == host->len\n                && ((uscf->port == 0 && u->resolved->no_port)\n                     || uscf->port == u->resolved->port)\n                && ngx_strncasecmp(uscf->host.data, host->data, host->len) == 0)\n            {\n                goto found;\n            }\n        }\n        if (u->resolved->sockaddr) {\n            if (u->resolved->port == 0\n                && u->resolved->sockaddr->sa_family != AF_UNIX)\n            {\n                ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                              "no port in upstream \\"%V\\"", host);\n                ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n                return;\n            }\n            if (ngx_http_upstream_create_round_robin_peer(r, u->resolved)\n                != NGX_OK)\n            {\n                ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n                return;\n            }\n            ngx_http_upstream_connect(r, u);\n            return;\n        }\n        if (u->resolved->port == 0) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "no port in upstream \\"%V\\"", host);\n            ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return;\n        }\n        temp.name = *host;\n        ctx = ngx_resolve_start(clcf->resolver, &temp);\n        if (ctx == NULL) {\n            ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return;\n        }\n        if (ctx == NGX_NO_RESOLVER) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "no resolver defined to resolve %V", host);\n            ngx_http_upstream_finalize_request(r, u, NGX_HTTP_BAD_GATEWAY);\n            return;\n        }\n        ctx->name = *host;\n        ctx->handler = ngx_http_upstream_resolve_handler;\n        ctx->data = r;\n        ctx->timeout = clcf->resolver_timeout;\n        u->resolved->ctx = ctx;\n        if (ngx_resolve_name(ctx) != NGX_OK) {\n            u->resolved->ctx = NULL;\n            ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return;\n        }\n        return;\n    }\nfound:\n    if (uscf == NULL) {\n        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,\n                      "no upstream configuration");\n        ngx_http_upstream_finalize_request(r, u,\n                                           NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    u->upstream = uscf;\n#if (NGX_HTTP_SSL)\n    u->ssl_name = uscf->host;\n#endif\n    if (uscf->peer.init(r, uscf) != NGX_OK) {\n        ngx_http_upstream_finalize_request(r, u,\n                                           NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    u->peer.start_time = ngx_current_msec;\n    if (u->conf->next_upstream_tries\n        && u->peer.tries > u->conf->next_upstream_tries)\n    {\n        u->peer.tries = u->conf->next_upstream_tries;\n    }\n    ngx_http_upstream_connect(r, u);\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %i, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        if (r->main->blocked) {\n            r->write_event_handler = ngx_http_request_finalizer;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed || r->blocked) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    r->write_event_handler = ngx_http_request_empty_handler;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'static ngx_int_t\nngx_http_post_action(ngx_http_request_t *r)\n{\n    ngx_http_core_loc_conf_t  *clcf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->post_action.data == NULL) {\n        return NGX_DECLINED;\n    }\n    if (r->post_action && r->uri_changes == 0) {\n        return NGX_DECLINED;\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "post action: \\"%V\\"", &clcf->post_action);\n    r->main->count--;\n    r->http_version = NGX_HTTP_VERSION_9;\n    r->header_only = 1;\n    r->post_action = 1;\n    r->read_event_handler = ngx_http_block_reading;\n    if (clcf->post_action.data[0] == \'/\') {\n        ngx_http_internal_redirect(r, &clcf->post_action, NULL);\n    } else {\n        ngx_http_named_location(r, &clcf->post_action);\n    }\n    return NGX_OK;\n}']