src/http/ngx_http_upstream.c:2563: error: Integer Overflow L2
  ([0, `r->uri_changes`] - 1):unsigned32 by call to `ngx_http_upstream_process_upgraded`.

src/http/ngx_http_upstream.c:2497:1: Parameter `r->uri_changes`
2495. 
2496. 
2497. static void
      ^
2498. ngx_http_upstream_upgrade(ngx_http_request_t *r, ngx_http_upstream_t *u)
2499. {

src/http/ngx_http_upstream.c:2563:5: Call
2561.     }
2562. 
2563.     ngx_http_upstream_process_upgraded(r, 0, 1);
          ^
2564. }
2565. 

src/http/ngx_http_upstream.c:2597:1: Parameter `r->uri_changes`
  2595. 
  2596. 
  2597. static void
        ^
  2598. ngx_http_upstream_process_upgraded(ngx_http_request_t *r,
  2599.     ngx_uint_t from_upstream, ngx_uint_t do_write)

src/http/ngx_http_upstream.c:2620:9: Call
  2618.         c->timedout = 1;
  2619.         ngx_connection_error(c, NGX_ETIMEDOUT, "client timed out");
  2620.         ngx_http_upstream_finalize_request(r, u, NGX_HTTP_REQUEST_TIME_OUT);
                ^
  2621.         return;
  2622.     }

src/http/ngx_http_upstream.c:3405:1: Parameter `r->uri_changes`
    3403. 
    3404. 
    3405. static void
          ^
    3406. ngx_http_upstream_finalize_request(ngx_http_request_t *r,
    3407.     ngx_http_upstream_t *u, ngx_int_t rc)

src/http/ngx_http_upstream.c:3544:9: Call
    3542. 
    3543.     if (r->header_only) {
    3544.         ngx_http_finalize_request(r, rc);
                  ^
    3545.         return;
    3546.     }

src/http/ngx_http_request.c:2193:1: Parameter `r->uri_changes`
      2191. 
      2192. 
      2193. void
            ^
      2194. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
      2195. {

src/http/ngx_http_request.c:2231:13: Call
      2229.         || c->error)
      2230.     {
      2231.         if (ngx_http_post_action(r) == NGX_OK) {
                        ^
      2232.             return;
      2233.         }

src/http/ngx_http_request.c:3278:1: Parameter `r->uri_changes`
        3276. 
        3277. 
        3278. static ngx_int_t
              ^
        3279. ngx_http_post_action(ngx_http_request_t *r)
        3280. {

src/http/ngx_http_request.c:3305:9: Call
        3303. 
        3304.     if (clcf->post_action.data[0] == '/') {
        3305.         ngx_http_internal_redirect(r, &clcf->post_action, NULL);
                      ^
        3306. 
        3307.     } else {

src/http/ngx_http_core_module.c:2561:1: <LHS trace>
2559. 
2560. 
2561. ngx_int_t
      ^
2562. ngx_http_internal_redirect(ngx_http_request_t *r,
2563.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2561:1: Parameter `r->uri_changes`
          2559. 
          2560. 
          2561. ngx_int_t
                ^
          2562. ngx_http_internal_redirect(ngx_http_request_t *r,
          2563.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2567:5: Binary operation: ([0, r->uri_changes] - 1):unsigned32 by call to `ngx_http_upstream_process_upgraded` 
          2565.     ngx_http_core_srv_conf_t  *cscf;
          2566. 
          2567.     r->uri_changes--;
                    ^
          2568. 
          2569.     if (r->uri_changes == 0) {

ngx_int_t
ngx_http_internal_redirect(ngx_http_request_t *r,
    ngx_str_t *uri, ngx_str_t *args)
{
    ngx_http_core_srv_conf_t  *cscf;
    r->uri_changes--;
    if (r->uri_changes == 0) {
        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                      "rewrite or internal redirection cycle "
                      "while internally redirecting to \"%V\"", uri);
        r->main->count++;
        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return NGX_DONE;
    }
    r->uri = *uri;
    if (args) {
        r->args = *args;
    } else {
        ngx_str_null(&r->args);
    }
    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                   "internal redirect: \"%V?%V\"", uri, &r->args);
    ngx_http_set_exten(r);
    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);
    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
    r->loc_conf = cscf->ctx->loc_conf;
    ngx_http_update_location_config(r);
#if (NGX_HTTP_CACHE)
    r->cache = NULL;
#endif
    r->internal = 1;
    r->valid_unparsed_uri = 0;
    r->add_uri_to_alias = 0;
    r->main->count++;
    ngx_http_handler(r);
    return NGX_DONE;
}
['static void\nngx_http_upstream_upgrade(ngx_http_request_t *r, ngx_http_upstream_t *u)\n{\n    int                        tcp_nodelay;\n    ngx_connection_t          *c;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    r->keepalive = 0;\n    c->log->action = "proxying upgraded connection";\n    u->read_event_handler = ngx_http_upstream_upgraded_read_upstream;\n    u->write_event_handler = ngx_http_upstream_upgraded_write_upstream;\n    r->read_event_handler = ngx_http_upstream_upgraded_read_downstream;\n    r->write_event_handler = ngx_http_upstream_upgraded_write_downstream;\n    if (clcf->tcp_nodelay) {\n        tcp_nodelay = 1;\n        if (c->tcp_nodelay == NGX_TCP_NODELAY_UNSET) {\n            ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "tcp_nodelay");\n            if (setsockopt(c->fd, IPPROTO_TCP, TCP_NODELAY,\n                           (const void *) &tcp_nodelay, sizeof(int)) == -1)\n            {\n                ngx_connection_error(c, ngx_socket_errno,\n                                     "setsockopt(TCP_NODELAY) failed");\n                ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n                return;\n            }\n            c->tcp_nodelay = NGX_TCP_NODELAY_SET;\n        }\n        if (u->peer.connection->tcp_nodelay == NGX_TCP_NODELAY_UNSET) {\n            ngx_log_debug0(NGX_LOG_DEBUG_HTTP, u->peer.connection->log, 0,\n                           "tcp_nodelay");\n            if (setsockopt(u->peer.connection->fd, IPPROTO_TCP, TCP_NODELAY,\n                           (const void *) &tcp_nodelay, sizeof(int)) == -1)\n            {\n                ngx_connection_error(u->peer.connection, ngx_socket_errno,\n                                     "setsockopt(TCP_NODELAY) failed");\n                ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n                return;\n            }\n            u->peer.connection->tcp_nodelay = NGX_TCP_NODELAY_SET;\n        }\n    }\n    if (ngx_http_send_special(r, NGX_HTTP_FLUSH) == NGX_ERROR) {\n        ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n        return;\n    }\n    if (u->peer.connection->read->ready\n        || u->buffer.pos != u->buffer.last)\n    {\n        ngx_http_upstream_process_upgraded(r, 1, 1);\n    }\n    ngx_http_upstream_process_upgraded(r, 0, 1);\n}', 'static void\nngx_http_upstream_process_upgraded(ngx_http_request_t *r,\n    ngx_uint_t from_upstream, ngx_uint_t do_write)\n{\n    size_t                     size;\n    ssize_t                    n;\n    ngx_buf_t                 *b;\n    ngx_connection_t          *c, *downstream, *upstream, *dst, *src;\n    ngx_http_upstream_t       *u;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    u = r->upstream;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http upstream process upgraded, fu:%ui", from_upstream);\n    downstream = c;\n    upstream = u->peer.connection;\n    if (downstream->write->timedout) {\n        c->timedout = 1;\n        ngx_connection_error(c, NGX_ETIMEDOUT, "client timed out");\n        ngx_http_upstream_finalize_request(r, u, NGX_HTTP_REQUEST_TIME_OUT);\n        return;\n    }\n    if (upstream->read->timedout || upstream->write->timedout) {\n        ngx_connection_error(c, NGX_ETIMEDOUT, "upstream timed out");\n        ngx_http_upstream_finalize_request(r, u, NGX_HTTP_GATEWAY_TIME_OUT);\n        return;\n    }\n    if (from_upstream) {\n        src = upstream;\n        dst = downstream;\n        b = &u->buffer;\n    } else {\n        src = downstream;\n        dst = upstream;\n        b = &u->from_client;\n        if (r->header_in->last > r->header_in->pos) {\n            b = r->header_in;\n            b->end = b->last;\n            do_write = 1;\n        }\n        if (b->start == NULL) {\n            b->start = ngx_palloc(r->pool, u->conf->buffer_size);\n            if (b->start == NULL) {\n                ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n                return;\n            }\n            b->pos = b->start;\n            b->last = b->start;\n            b->end = b->start + u->conf->buffer_size;\n            b->temporary = 1;\n            b->tag = u->output.tag;\n        }\n    }\n    for ( ;; ) {\n        if (do_write) {\n            size = b->last - b->pos;\n            if (size && dst->write->ready) {\n                n = dst->send(dst, b->pos, size);\n                if (n == NGX_ERROR) {\n                    ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n                    return;\n                }\n                if (n > 0) {\n                    b->pos += n;\n                    if (b->pos == b->last) {\n                        b->pos = b->start;\n                        b->last = b->start;\n                    }\n                }\n            }\n        }\n        size = b->end - b->last;\n        if (size && src->read->ready) {\n            n = src->recv(src, b->last, size);\n            if (n == NGX_AGAIN || n == 0) {\n                break;\n            }\n            if (n > 0) {\n                do_write = 1;\n                b->last += n;\n                continue;\n            }\n            if (n == NGX_ERROR) {\n                src->read->eof = 1;\n            }\n        }\n        break;\n    }\n    if ((upstream->read->eof && u->buffer.pos == u->buffer.last)\n        || (downstream->read->eof && u->from_client.pos == u->from_client.last)\n        || (downstream->read->eof && upstream->read->eof))\n    {\n        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http upstream upgraded done");\n        ngx_http_upstream_finalize_request(r, u, 0);\n        return;\n    }\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (ngx_handle_write_event(upstream->write, u->conf->send_lowat)\n        != NGX_OK)\n    {\n        ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n        return;\n    }\n    if (upstream->write->active && !upstream->write->ready) {\n        ngx_add_timer(upstream->write, u->conf->send_timeout);\n    } else if (upstream->write->timer_set) {\n        ngx_del_timer(upstream->write);\n    }\n    if (ngx_handle_read_event(upstream->read, 0) != NGX_OK) {\n        ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n        return;\n    }\n    if (upstream->read->active && !upstream->read->ready) {\n        ngx_add_timer(upstream->read, u->conf->read_timeout);\n    } else if (upstream->read->timer_set) {\n        ngx_del_timer(upstream->read);\n    }\n    if (ngx_handle_write_event(downstream->write, clcf->send_lowat)\n        != NGX_OK)\n    {\n        ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n        return;\n    }\n    if (ngx_handle_read_event(downstream->read, 0) != NGX_OK) {\n        ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n        return;\n    }\n    if (downstream->write->active && !downstream->write->ready) {\n        ngx_add_timer(downstream->write, clcf->send_timeout);\n    } else if (downstream->write->timer_set) {\n        ngx_del_timer(downstream->write);\n    }\n}', 'static void\nngx_http_upstream_finalize_request(ngx_http_request_t *r,\n    ngx_http_upstream_t *u, ngx_int_t rc)\n{\n    ngx_uint_t   flush;\n    ngx_time_t  *tp;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "finalize http upstream request: %i", rc);\n    if (u->cleanup) {\n        *u->cleanup = NULL;\n        u->cleanup = NULL;\n    }\n    if (u->resolved && u->resolved->ctx) {\n        ngx_resolve_name_done(u->resolved->ctx);\n        u->resolved->ctx = NULL;\n    }\n    if (u->state && u->state->response_sec) {\n        tp = ngx_timeofday();\n        u->state->response_sec = tp->sec - u->state->response_sec;\n        u->state->response_msec = tp->msec - u->state->response_msec;\n        if (u->pipe && u->pipe->read_length) {\n            u->state->response_length = u->pipe->read_length;\n        }\n    }\n    u->finalize_request(r, rc);\n    if (u->peer.free && u->peer.sockaddr) {\n        u->peer.free(&u->peer, u->peer.data, 0);\n        u->peer.sockaddr = NULL;\n    }\n    if (u->peer.connection) {\n#if (NGX_HTTP_SSL)\n        if (u->peer.connection->ssl) {\n            u->peer.connection->ssl->no_wait_shutdown = 1;\n            (void) ngx_ssl_shutdown(u->peer.connection);\n        }\n#endif\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "close http upstream connection: %d",\n                       u->peer.connection->fd);\n        if (u->peer.connection->pool) {\n            ngx_destroy_pool(u->peer.connection->pool);\n        }\n        ngx_close_connection(u->peer.connection);\n    }\n    u->peer.connection = NULL;\n    if (u->pipe && u->pipe->temp_file) {\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream temp fd: %d",\n                       u->pipe->temp_file->file.fd);\n    }\n    if (u->store && u->pipe && u->pipe->temp_file\n        && u->pipe->temp_file->file.fd != NGX_INVALID_FILE)\n    {\n        if (ngx_delete_file(u->pipe->temp_file->file.name.data)\n            == NGX_FILE_ERROR)\n        {\n            ngx_log_error(NGX_LOG_CRIT, r->connection->log, ngx_errno,\n                          ngx_delete_file_n " \\"%s\\" failed",\n                          u->pipe->temp_file->file.name.data);\n        }\n    }\n#if (NGX_HTTP_CACHE)\n    if (r->cache) {\n        if (u->cacheable) {\n            if (rc == NGX_HTTP_BAD_GATEWAY || rc == NGX_HTTP_GATEWAY_TIME_OUT) {\n                time_t  valid;\n                valid = ngx_http_file_cache_valid(u->conf->cache_valid, rc);\n                if (valid) {\n                    r->cache->valid_sec = ngx_time() + valid;\n                    r->cache->error = rc;\n                }\n            }\n        }\n        ngx_http_file_cache_free(r->cache, u->pipe->temp_file);\n    }\n#endif\n    if (r->subrequest_in_memory\n        && u->headers_in.status_n >= NGX_HTTP_SPECIAL_RESPONSE)\n    {\n        u->buffer.last = u->buffer.pos;\n    }\n    if (rc == NGX_DECLINED) {\n        return;\n    }\n    r->connection->log->action = "sending to client";\n    if (!u->header_sent\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST)\n    {\n        ngx_http_finalize_request(r, rc);\n        return;\n    }\n    flush = 0;\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {\n        rc = NGX_ERROR;\n        flush = 1;\n    }\n    if (r->header_only) {\n        ngx_http_finalize_request(r, rc);\n        return;\n    }\n    if (rc == 0) {\n        rc = ngx_http_send_special(r, NGX_HTTP_LAST);\n    } else if (flush) {\n        r->keepalive = 0;\n        rc = ngx_http_send_special(r, NGX_HTTP_FLUSH);\n    }\n    ngx_http_finalize_request(r, rc);\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %d, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        if (r->main->blocked) {\n            r->write_event_handler = ngx_http_request_finalizer;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            r->main->subrequests++;\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed || r->blocked) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    r->write_event_handler = ngx_http_request_empty_handler;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'static ngx_int_t\nngx_http_post_action(ngx_http_request_t *r)\n{\n    ngx_http_core_loc_conf_t  *clcf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->post_action.data == NULL) {\n        return NGX_DECLINED;\n    }\n    if (r->post_action && r->uri_changes == 0) {\n        return NGX_DECLINED;\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "post action: \\"%V\\"", &clcf->post_action);\n    r->main->count--;\n    r->http_version = NGX_HTTP_VERSION_9;\n    r->header_only = 1;\n    r->post_action = 1;\n    r->read_event_handler = ngx_http_block_reading;\n    if (clcf->post_action.data[0] == \'/\') {\n        ngx_http_internal_redirect(r, &clcf->post_action, NULL);\n    } else {\n        ngx_http_named_location(r, &clcf->post_action);\n    }\n    return NGX_OK;\n}', 'ngx_int_t\nngx_http_internal_redirect(ngx_http_request_t *r,\n    ngx_str_t *uri, ngx_str_t *args)\n{\n    ngx_http_core_srv_conf_t  *cscf;\n    r->uri_changes--;\n    if (r->uri_changes == 0) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "rewrite or internal redirection cycle "\n                      "while internally redirecting to \\"%V\\"", uri);\n        r->main->count++;\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return NGX_DONE;\n    }\n    r->uri = *uri;\n    if (args) {\n        r->args = *args;\n    } else {\n        ngx_str_null(&r->args);\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "internal redirect: \\"%V?%V\\"", uri, &r->args);\n    ngx_http_set_exten(r);\n    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    r->loc_conf = cscf->ctx->loc_conf;\n    ngx_http_update_location_config(r);\n#if (NGX_HTTP_CACHE)\n    r->cache = NULL;\n#endif\n    r->internal = 1;\n    r->valid_unparsed_uri = 0;\n    r->add_uri_to_alias = 0;\n    r->main->count++;\n    ngx_http_handler(r);\n    return NGX_DONE;\n}']