modules/slotmem/mod_slotmem_shm.c:431: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 23]):unsigned64 by call to `restore_slotmem`.

modules/slotmem/mod_slotmem_shm.c:339:1: Parameter `item_num`
337. }
338. 
339. static apr_status_t slotmem_create(ap_slotmem_instance_t **new,
     ^
340.                                    const char *name, apr_size_t item_size,
341.                                    unsigned int item_num,

modules/slotmem/mod_slotmem_shm.c:353:5: Assignment
351.     apr_shm_t *shm;
352.     apr_size_t basesize = (item_size * item_num);
353.     apr_size_t size = AP_SLOTMEM_OFFSET + AP_UNSIGNEDINT_OFFSET +
         ^
354.                       (item_num * sizeof(char)) + basesize;
355.     int persist = (type & AP_SLOTMEM_TYPE_PERSIST) != 0;

modules/slotmem/mod_slotmem_shm.c:431:18: Call
429.          */
430.         if (persist) {
431.             rv = restore_slotmem(desc, pname, size, pool);
                      ^
432.             if (rv == APR_SUCCESS) {
433.                 restored = 1;

modules/slotmem/mod_slotmem_shm.c:196:1: <LHS trace>
194. }
195. 
196. static apr_status_t restore_slotmem(sharedslotdesc_t *desc,
     ^
197.                                     const char *storename, apr_size_t size,
198.                                     apr_pool_t *pool)

modules/slotmem/mod_slotmem_shm.c:196:1: Parameter `size`
  194. }
  195. 
  196. static apr_status_t restore_slotmem(sharedslotdesc_t *desc,
       ^
  197.                                     const char *storename, apr_size_t size,
  198.                                     apr_pool_t *pool)

modules/slotmem/mod_slotmem_shm.c:203:5: Binary operation: ([0, +oo] - [0, 23]):unsigned64 by call to `restore_slotmem` 
  201.     apr_status_t rv = APR_ENOTIMPL;
  202.     void *ptr = (char *)desc + AP_SLOTMEM_OFFSET;
  203.     apr_size_t nbytes = size - AP_SLOTMEM_OFFSET;
           ^
  204.     unsigned char digest[APR_MD5_DIGESTSIZE];
  205.     unsigned char digest2[APR_MD5_DIGESTSIZE];

static apr_status_t restore_slotmem(sharedslotdesc_t *desc,
                                    const char *storename, apr_size_t size,
                                    apr_pool_t *pool)
{
    apr_file_t *fp;
    apr_status_t rv = APR_ENOTIMPL;
    void *ptr = (char *)desc + AP_SLOTMEM_OFFSET;
    apr_size_t nbytes = size - AP_SLOTMEM_OFFSET;
    unsigned char digest[APR_MD5_DIGESTSIZE];
    unsigned char digest2[APR_MD5_DIGESTSIZE];
    char desc_buf[AP_SLOTMEM_OFFSET];
    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, APLOGNO(02335)
                 "restoring %s", storename);
    if (storename) {
        rv = apr_file_open(&fp, storename, APR_READ | APR_WRITE, APR_OS_DEFAULT,
                           pool);
        if (rv == APR_SUCCESS) {
            rv = apr_file_read_full(fp, ptr, nbytes, NULL);
            if (rv == APR_SUCCESS || rv == APR_EOF) {
                rv = APR_SUCCESS;
                if (apr_file_eof(fp) != APR_EOF) {
                    rv = apr_file_read_full(fp, digest, APR_MD5_DIGESTSIZE, NULL);
                    if (rv == APR_SUCCESS || rv == APR_EOF) {
                        apr_md5(digest2, ptr, nbytes);
                        if (memcmp(digest, digest2, APR_MD5_DIGESTSIZE)) {
                            rv = APR_EMISMATCH;
                        }
                        else if (apr_file_eof(fp) != APR_EOF) {
                            rv = apr_file_read_full(fp, desc_buf, sizeof(desc_buf), NULL);
                            if (rv == APR_SUCCESS || rv == APR_EOF) {
                                if (memcmp(desc, desc_buf, sizeof(desc_buf))) {
                                    rv = APR_EMISMATCH;
                                }
                                else {
                                    rv = APR_SUCCESS;
                                }
                            }
                            else if (rv == APR_SUCCESS || rv == APR_EOF) {
                                rv = APR_INCOMPLETE;
                            }
                        }
                        else {
                            rv = APR_EOF;
                        }
                    }
                    else if (rv == APR_SUCCESS || rv == APR_EOF) {
                        rv = APR_INCOMPLETE;
                    }
                }
                else {
                    rv = APR_EOF;
                }
                if (rv == APR_EMISMATCH) {
                    ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, APLOGNO(02551)
                                 "persisted slotmem md5/desc mismatch");
                }
                else if (rv == APR_EOF) {
                    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf, APLOGNO(02552)
                                 "persisted slotmem at EOF... bypassing md5/desc match check "
                                 "(old persist file?)");
                    rv = APR_SUCCESS;
                }
            }
            else if (rv == APR_SUCCESS || rv == APR_EOF) {
                rv = APR_INCOMPLETE;
            }
            if (rv == APR_INCOMPLETE) {
                ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, APLOGNO(02553)
                             "persisted slotmem read had unexpected size");
            }
            apr_file_close(fp);
        }
    }
    return rv;
}
['static apr_status_t slotmem_create(ap_slotmem_instance_t **new,\n                                   const char *name, apr_size_t item_size,\n                                   unsigned int item_num,\n                                   ap_slotmem_type_t type, apr_pool_t *pool)\n{\n    int fbased = 1;\n    int restored = 0;\n    char *ptr;\n    sharedslotdesc_t *desc;\n    ap_slotmem_instance_t *res;\n    ap_slotmem_instance_t *next = globallistmem;\n    const char *fname, *pname = NULL;\n    apr_shm_t *shm;\n    apr_size_t basesize = (item_size * item_num);\n    apr_size_t size = AP_SLOTMEM_OFFSET + AP_UNSIGNEDINT_OFFSET +\n                      (item_num * sizeof(char)) + basesize;\n    int persist = (type & AP_SLOTMEM_TYPE_PERSIST) != 0;\n    apr_status_t rv;\n    *new = NULL;\n    if (gpool == NULL) {\n        return APR_ENOSHMAVAIL;\n    }\n    if (slotmem_filenames(pool, name, &fname, persist ? &pname : NULL)) {\n        if (next) {\n            for (;;) {\n                if (strcmp(next->name, fname) == 0) {\n                    *new = next;\n                    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, APLOGNO(02603)\n                                 "create found %s in global list", fname);\n                    return APR_SUCCESS;\n                }\n                if (!next->next) {\n                     break;\n                }\n                next = next->next;\n            }\n        }\n        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, APLOGNO(02602)\n                     "create didn\'t find %s in global list", fname);\n    }\n    else {\n        fbased = 0;\n        fname = "none";\n    }\n    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, APLOGNO(02300)\n                 "create %s: %"APR_SIZE_T_FMT"/%u", fname, item_size,\n                 item_num);\n    {\n        if (fbased) {\n            if (is_child_process()) {\n                rv = apr_shm_attach(&shm, fname, gpool);\n            }\n            else {\n                apr_shm_remove(fname, pool);\n                rv = apr_shm_create(&shm, size, fname, gpool);\n            }\n        }\n        else {\n            rv = apr_shm_create(&shm, size, NULL, gpool);\n        }\n        ap_log_error(APLOG_MARK, rv == APR_SUCCESS ? APLOG_DEBUG : APLOG_ERR,\n                     rv, ap_server_conf, APLOGNO(02611)\n                     "create: apr_shm_%s(%s) %s",\n                     fbased && is_child_process() ? "attach" : "create",\n                     fname, rv == APR_SUCCESS ? "succeeded" : "failed");\n        if (rv != APR_SUCCESS) {\n            return rv;\n        }\n        desc = (sharedslotdesc_t *)apr_shm_baseaddr_get(shm);\n        memset(desc, 0, size);\n        desc->size = item_size;\n        desc->num = item_num;\n        desc->type = type;\n        if (persist) {\n            rv = restore_slotmem(desc, pname, size, pool);\n            if (rv == APR_SUCCESS) {\n                restored = 1;\n            }\n            else {\n                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf,\n                             APLOGNO(02554) "could not restore %s", fname);\n                memset((char *)desc + AP_SLOTMEM_OFFSET, 0,\n                       size - AP_SLOTMEM_OFFSET);\n            }\n        }\n    }\n    ptr = (char *)desc + AP_SLOTMEM_OFFSET;\n    res = apr_pcalloc(gpool, sizeof(ap_slotmem_instance_t));\n    res->name = apr_pstrdup(gpool, fname);\n    res->pname = apr_pstrdup(gpool, pname);\n    res->fbased = fbased;\n    res->shm = shm;\n    res->persist = (void *)ptr;\n    res->num_free = (unsigned int *)ptr;\n    ptr += AP_UNSIGNEDINT_OFFSET;\n    if (!restored) {\n        *res->num_free = item_num;\n    }\n    res->base = (void *)ptr;\n    res->desc = desc;\n    res->gpool = gpool;\n    res->next = NULL;\n    res->inuse = ptr + basesize;\n    if (fbased) {\n        if (globallistmem == NULL) {\n            globallistmem = res;\n        }\n        else {\n            next->next = res;\n        }\n    }\n    *new = res;\n    return APR_SUCCESS;\n}', 'static apr_status_t restore_slotmem(sharedslotdesc_t *desc,\n                                    const char *storename, apr_size_t size,\n                                    apr_pool_t *pool)\n{\n    apr_file_t *fp;\n    apr_status_t rv = APR_ENOTIMPL;\n    void *ptr = (char *)desc + AP_SLOTMEM_OFFSET;\n    apr_size_t nbytes = size - AP_SLOTMEM_OFFSET;\n    unsigned char digest[APR_MD5_DIGESTSIZE];\n    unsigned char digest2[APR_MD5_DIGESTSIZE];\n    char desc_buf[AP_SLOTMEM_OFFSET];\n    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf, APLOGNO(02335)\n                 "restoring %s", storename);\n    if (storename) {\n        rv = apr_file_open(&fp, storename, APR_READ | APR_WRITE, APR_OS_DEFAULT,\n                           pool);\n        if (rv == APR_SUCCESS) {\n            rv = apr_file_read_full(fp, ptr, nbytes, NULL);\n            if (rv == APR_SUCCESS || rv == APR_EOF) {\n                rv = APR_SUCCESS;\n                if (apr_file_eof(fp) != APR_EOF) {\n                    rv = apr_file_read_full(fp, digest, APR_MD5_DIGESTSIZE, NULL);\n                    if (rv == APR_SUCCESS || rv == APR_EOF) {\n                        apr_md5(digest2, ptr, nbytes);\n                        if (memcmp(digest, digest2, APR_MD5_DIGESTSIZE)) {\n                            rv = APR_EMISMATCH;\n                        }\n                        else if (apr_file_eof(fp) != APR_EOF) {\n                            rv = apr_file_read_full(fp, desc_buf, sizeof(desc_buf), NULL);\n                            if (rv == APR_SUCCESS || rv == APR_EOF) {\n                                if (memcmp(desc, desc_buf, sizeof(desc_buf))) {\n                                    rv = APR_EMISMATCH;\n                                }\n                                else {\n                                    rv = APR_SUCCESS;\n                                }\n                            }\n                            else if (rv == APR_SUCCESS || rv == APR_EOF) {\n                                rv = APR_INCOMPLETE;\n                            }\n                        }\n                        else {\n                            rv = APR_EOF;\n                        }\n                    }\n                    else if (rv == APR_SUCCESS || rv == APR_EOF) {\n                        rv = APR_INCOMPLETE;\n                    }\n                }\n                else {\n                    rv = APR_EOF;\n                }\n                if (rv == APR_EMISMATCH) {\n                    ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, APLOGNO(02551)\n                                 "persisted slotmem md5/desc mismatch");\n                }\n                else if (rv == APR_EOF) {\n                    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf, APLOGNO(02552)\n                                 "persisted slotmem at EOF... bypassing md5/desc match check "\n                                 "(old persist file?)");\n                    rv = APR_SUCCESS;\n                }\n            }\n            else if (rv == APR_SUCCESS || rv == APR_EOF) {\n                rv = APR_INCOMPLETE;\n            }\n            if (rv == APR_INCOMPLETE) {\n                ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, APLOGNO(02553)\n                             "persisted slotmem read had unexpected size");\n            }\n            apr_file_close(fp);\n        }\n    }\n    return rv;\n}']