src/http/ngx_http_request.c:346: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64.

src/http/ngx_http_request.c:313:13: <LHS trace>
311.          */
312. 
313.         if (ngx_http_server_addr(r, NULL) != NGX_OK) {
                 ^
314.             ngx_http_close_connection(c);
315.             return;

src/http/ngx_http_request.c:313:13: Call
311.          */
312. 
313.         if (ngx_http_server_addr(r, NULL) != NGX_OK) {
                 ^
314.             ngx_http_close_connection(c);
315.             return;

src/http/ngx_http_core_module.c:1856:29: Call
  1854.         }
  1855. 
  1856.         c->local_sockaddr = ngx_palloc(r->connection->pool, len);
                                    ^
  1857.         if (c->local_sockaddr == NULL) {
  1858.             return NGX_ERROR;

src/core/ngx_palloc.c:114:1: Parameter `size`
    112. 
    113. 
    114. void *
         ^
    115. ngx_palloc(ngx_pool_t *pool, size_t size)
    116. {

src/http/ngx_http_request.c:346:25: Binary operation: ([0, +oo] - 1):unsigned64
344.             /* the last address is "*" */
345. 
346.             for (i = 0; i < port->naddrs - 1; i++) {
                             ^
347.                 if (addr[i].addr == sin->sin_addr.s_addr) {
348.                     break;

static void
ngx_http_init_request(ngx_event_t *rev)
{
    ngx_time_t                 *tp;
    ngx_uint_t                  i;
    ngx_connection_t           *c;
    ngx_http_request_t         *r;
    struct sockaddr_in         *sin;
    ngx_http_port_t            *port;
    ngx_http_in_addr_t         *addr;
    ngx_http_log_ctx_t         *ctx;
    ngx_http_addr_conf_t       *addr_conf;
    ngx_http_connection_t      *hc;
    ngx_http_core_srv_conf_t   *cscf;
    ngx_http_core_loc_conf_t   *clcf;
    ngx_http_core_main_conf_t  *cmcf;
#if (NGX_HAVE_INET6)
    struct sockaddr_in6        *sin6;
    ngx_http_in6_addr_t        *addr6;
#endif
#if (NGX_STAT_STUB)
    ngx_atomic_fetch_add(ngx_stat_reading, -1);
#endif
    c = rev->data;
    if (rev->timedout) {
        ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");
        ngx_http_close_connection(c);
        return;
    }
    hc = c->data;
    if (hc == NULL) {
        hc = ngx_pcalloc(c->pool, sizeof(ngx_http_connection_t));
        if (hc == NULL) {
            ngx_http_close_connection(c);
            return;
        }
    }
    r = hc->request;
    if (r) {
        ngx_memzero(r, sizeof(ngx_http_request_t));
        r->pipeline = hc->pipeline;
        if (hc->nbusy) {
            r->header_in = hc->busy[0];
        }
    } else {
        r = ngx_pcalloc(c->pool, sizeof(ngx_http_request_t));
        if (r == NULL) {
            ngx_http_close_connection(c);
            return;
        }
        hc->request = r;
    }
    c->data = r;
    r->http_connection = hc;
    c->sent = 0;
    r->signature = NGX_HTTP_MODULE;
    port = c->listening->servers;
    r->connection = c;
    if (port->naddrs > 1) {
        if (ngx_http_server_addr(r, NULL) != NGX_OK) {
            ngx_http_close_connection(c);
            return;
        }
        switch (c->local_sockaddr->sa_family) {
#if (NGX_HAVE_INET6)
        case AF_INET6:
            sin6 = (struct sockaddr_in6 *) c->local_sockaddr;
            addr6 = (ngx_http_in6_addr_t *) port->addrs;
            for (i = 0; i < port->naddrs - 1; i++) {
                if (ngx_memcmp(&addr6[i].addr6, &sin6->sin6_addr, 16) == 0) {
                    break;
                }
            }
            addr_conf = &addr6[i].conf;
            break;
#endif
        default:
            sin = (struct sockaddr_in *) c->local_sockaddr;
            addr = port->addrs;
            for (i = 0; i < port->naddrs - 1; i++) {
                if (addr[i].addr == sin->sin_addr.s_addr) {
                    break;
                }
            }
            addr_conf = &addr[i].conf;
            break;
        }
    } else {
        switch (c->local_sockaddr->sa_family) {
#if (NGX_HAVE_INET6)
        case AF_INET6:
            addr6 = (ngx_http_in6_addr_t *) port->addrs;
            addr_conf = &addr6[0].conf;
            break;
#endif
        default:
            addr = port->addrs;
            addr_conf = &addr[0].conf;
            break;
        }
    }
    r->virtual_names = addr_conf->virtual_names;
    cscf = addr_conf->core_srv_conf;
    r->main_conf = cscf->ctx->main_conf;
    r->srv_conf = cscf->ctx->srv_conf;
    r->loc_conf = cscf->ctx->loc_conf;
    rev->handler = ngx_http_process_request_line;
#if (NGX_HTTP_SSL)
    {
    ngx_http_ssl_srv_conf_t  *sscf;
    sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module);
    if (sscf->enable || addr_conf->ssl) {
        if (c->ssl == NULL) {
            c->log->action = "SSL handshaking";
            if (addr_conf->ssl && sscf->ssl.ctx == NULL) {
                ngx_log_error(NGX_LOG_ERR, c->log, 0,
                              "no \"ssl_certificate\" is defined "
                              "in server listening on SSL port");
                ngx_http_close_connection(c);
                return;
            }
            if (ngx_ssl_create_connection(&sscf->ssl, c, NGX_SSL_BUFFER)
                != NGX_OK)
            {
                ngx_http_close_connection(c);
                return;
            }
            rev->handler = ngx_http_ssl_handshake;
        }
        r->main_filter_need_in_memory = 1;
    }
    }
#endif
    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
    c->log->file = clcf->err_log->file;
    if (!(c->log->log_level & NGX_LOG_DEBUG_CONNECTION)) {
        c->log->log_level = clcf->err_log->log_level;
    }
    if (c->buffer == NULL) {
        c->buffer = ngx_create_temp_buf(c->pool,
                                        cscf->client_header_buffer_size);
        if (c->buffer == NULL) {
            ngx_http_close_connection(c);
            return;
        }
    }
    if (r->header_in == NULL) {
        r->header_in = c->buffer;
    }
    r->pool = ngx_create_pool(cscf->request_pool_size, c->log);
    if (r->pool == NULL) {
        ngx_http_close_connection(c);
        return;
    }
    if (ngx_list_init(&r->headers_out.headers, r->pool, 20,
                      sizeof(ngx_table_elt_t))
        != NGX_OK)
    {
        ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return;
    }
    r->ctx = ngx_pcalloc(r->pool, sizeof(void *) * ngx_http_max_module);
    if (r->ctx == NULL) {
        ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return;
    }
    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);
    r->variables = ngx_pcalloc(r->pool, cmcf->variables.nelts
                                        * sizeof(ngx_http_variable_value_t));
    if (r->variables == NULL) {
        ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return;
    }
    c->single_connection = 1;
    c->destroyed = 0;
    r->main = r;
    tp = ngx_timeofday();
    r->start_sec = tp->sec;
    r->start_msec = tp->msec;
    r->method = NGX_HTTP_UNKNOWN;
    r->headers_in.content_length_n = -1;
    r->headers_in.keep_alive_n = -1;
    r->headers_out.content_length_n = -1;
    r->headers_out.last_modified_time = -1;
    r->uri_changes = NGX_HTTP_MAX_URI_CHANGES + 1;
    r->subrequests = NGX_HTTP_MAX_SUBREQUESTS + 1;
    r->http_state = NGX_HTTP_READING_REQUEST_STATE;
    ctx = c->log->data;
    ctx->request = r;
    ctx->current_request = r;
    r->log_handler = ngx_http_log_error_handler;
#if (NGX_STAT_STUB)
    ngx_atomic_fetch_add(ngx_stat_reading, 1);
    r->stat_reading = 1;
    ngx_atomic_fetch_add(ngx_stat_requests, 1);
#endif
    rev->handler(rev);
}
['static void\nngx_http_init_request(ngx_event_t *rev)\n{\n    ngx_time_t                 *tp;\n    ngx_uint_t                  i;\n    ngx_connection_t           *c;\n    ngx_http_request_t         *r;\n    struct sockaddr_in         *sin;\n    ngx_http_port_t            *port;\n    ngx_http_in_addr_t         *addr;\n    ngx_http_log_ctx_t         *ctx;\n    ngx_http_addr_conf_t       *addr_conf;\n    ngx_http_connection_t      *hc;\n    ngx_http_core_srv_conf_t   *cscf;\n    ngx_http_core_loc_conf_t   *clcf;\n    ngx_http_core_main_conf_t  *cmcf;\n#if (NGX_HAVE_INET6)\n    struct sockaddr_in6        *sin6;\n    ngx_http_in6_addr_t        *addr6;\n#endif\n#if (NGX_STAT_STUB)\n    ngx_atomic_fetch_add(ngx_stat_reading, -1);\n#endif\n    c = rev->data;\n    if (rev->timedout) {\n        ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");\n        ngx_http_close_connection(c);\n        return;\n    }\n    hc = c->data;\n    if (hc == NULL) {\n        hc = ngx_pcalloc(c->pool, sizeof(ngx_http_connection_t));\n        if (hc == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n    }\n    r = hc->request;\n    if (r) {\n        ngx_memzero(r, sizeof(ngx_http_request_t));\n        r->pipeline = hc->pipeline;\n        if (hc->nbusy) {\n            r->header_in = hc->busy[0];\n        }\n    } else {\n        r = ngx_pcalloc(c->pool, sizeof(ngx_http_request_t));\n        if (r == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        hc->request = r;\n    }\n    c->data = r;\n    r->http_connection = hc;\n    c->sent = 0;\n    r->signature = NGX_HTTP_MODULE;\n    port = c->listening->servers;\n    r->connection = c;\n    if (port->naddrs > 1) {\n        if (ngx_http_server_addr(r, NULL) != NGX_OK) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        switch (c->local_sockaddr->sa_family) {\n#if (NGX_HAVE_INET6)\n        case AF_INET6:\n            sin6 = (struct sockaddr_in6 *) c->local_sockaddr;\n            addr6 = (ngx_http_in6_addr_t *) port->addrs;\n            for (i = 0; i < port->naddrs - 1; i++) {\n                if (ngx_memcmp(&addr6[i].addr6, &sin6->sin6_addr, 16) == 0) {\n                    break;\n                }\n            }\n            addr_conf = &addr6[i].conf;\n            break;\n#endif\n        default:\n            sin = (struct sockaddr_in *) c->local_sockaddr;\n            addr = port->addrs;\n            for (i = 0; i < port->naddrs - 1; i++) {\n                if (addr[i].addr == sin->sin_addr.s_addr) {\n                    break;\n                }\n            }\n            addr_conf = &addr[i].conf;\n            break;\n        }\n    } else {\n        switch (c->local_sockaddr->sa_family) {\n#if (NGX_HAVE_INET6)\n        case AF_INET6:\n            addr6 = (ngx_http_in6_addr_t *) port->addrs;\n            addr_conf = &addr6[0].conf;\n            break;\n#endif\n        default:\n            addr = port->addrs;\n            addr_conf = &addr[0].conf;\n            break;\n        }\n    }\n    r->virtual_names = addr_conf->virtual_names;\n    cscf = addr_conf->core_srv_conf;\n    r->main_conf = cscf->ctx->main_conf;\n    r->srv_conf = cscf->ctx->srv_conf;\n    r->loc_conf = cscf->ctx->loc_conf;\n    rev->handler = ngx_http_process_request_line;\n#if (NGX_HTTP_SSL)\n    {\n    ngx_http_ssl_srv_conf_t  *sscf;\n    sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module);\n    if (sscf->enable || addr_conf->ssl) {\n        if (c->ssl == NULL) {\n            c->log->action = "SSL handshaking";\n            if (addr_conf->ssl && sscf->ssl.ctx == NULL) {\n                ngx_log_error(NGX_LOG_ERR, c->log, 0,\n                              "no \\"ssl_certificate\\" is defined "\n                              "in server listening on SSL port");\n                ngx_http_close_connection(c);\n                return;\n            }\n            if (ngx_ssl_create_connection(&sscf->ssl, c, NGX_SSL_BUFFER)\n                != NGX_OK)\n            {\n                ngx_http_close_connection(c);\n                return;\n            }\n            rev->handler = ngx_http_ssl_handshake;\n        }\n        r->main_filter_need_in_memory = 1;\n    }\n    }\n#endif\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    c->log->file = clcf->err_log->file;\n    if (!(c->log->log_level & NGX_LOG_DEBUG_CONNECTION)) {\n        c->log->log_level = clcf->err_log->log_level;\n    }\n    if (c->buffer == NULL) {\n        c->buffer = ngx_create_temp_buf(c->pool,\n                                        cscf->client_header_buffer_size);\n        if (c->buffer == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n    }\n    if (r->header_in == NULL) {\n        r->header_in = c->buffer;\n    }\n    r->pool = ngx_create_pool(cscf->request_pool_size, c->log);\n    if (r->pool == NULL) {\n        ngx_http_close_connection(c);\n        return;\n    }\n    if (ngx_list_init(&r->headers_out.headers, r->pool, 20,\n                      sizeof(ngx_table_elt_t))\n        != NGX_OK)\n    {\n        ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    r->ctx = ngx_pcalloc(r->pool, sizeof(void *) * ngx_http_max_module);\n    if (r->ctx == NULL) {\n        ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    r->variables = ngx_pcalloc(r->pool, cmcf->variables.nelts\n                                        * sizeof(ngx_http_variable_value_t));\n    if (r->variables == NULL) {\n        ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    c->single_connection = 1;\n    c->destroyed = 0;\n    r->main = r;\n    tp = ngx_timeofday();\n    r->start_sec = tp->sec;\n    r->start_msec = tp->msec;\n    r->method = NGX_HTTP_UNKNOWN;\n    r->headers_in.content_length_n = -1;\n    r->headers_in.keep_alive_n = -1;\n    r->headers_out.content_length_n = -1;\n    r->headers_out.last_modified_time = -1;\n    r->uri_changes = NGX_HTTP_MAX_URI_CHANGES + 1;\n    r->subrequests = NGX_HTTP_MAX_SUBREQUESTS + 1;\n    r->http_state = NGX_HTTP_READING_REQUEST_STATE;\n    ctx = c->log->data;\n    ctx->request = r;\n    ctx->current_request = r;\n    r->log_handler = ngx_http_log_error_handler;\n#if (NGX_STAT_STUB)\n    ngx_atomic_fetch_add(ngx_stat_reading, 1);\n    r->stat_reading = 1;\n    ngx_atomic_fetch_add(ngx_stat_requests, 1);\n#endif\n    rev->handler(rev);\n}', 'ngx_int_t\nngx_http_server_addr(ngx_http_request_t *r, ngx_str_t *s)\n{\n    socklen_t             len;\n    ngx_uint_t            addr;\n    ngx_connection_t     *c;\n    u_char                sa[NGX_SOCKADDRLEN];\n    struct sockaddr_in   *sin;\n#if (NGX_HAVE_INET6)\n    ngx_uint_t            i;\n    struct sockaddr_in6  *sin6;\n#endif\n    c = r->connection;\n    switch (c->local_sockaddr->sa_family) {\n#if (NGX_HAVE_INET6)\n    case AF_INET6:\n        sin6 = (struct sockaddr_in6 *) c->local_sockaddr;\n        for (addr = 0, i = 0; addr == 0 && i < 16; i++) {\n            addr |= sin6->sin6_addr.s6_addr[i];\n        }\n        break;\n#endif\n    default:\n        sin = (struct sockaddr_in *) c->local_sockaddr;\n        addr = sin->sin_addr.s_addr;\n        break;\n    }\n    if (addr == 0) {\n        len = NGX_SOCKADDRLEN;\n        if (getsockname(c->fd, (struct sockaddr *) &sa, &len) == -1) {\n            ngx_connection_error(c, ngx_socket_errno, "getsockname() failed");\n            return NGX_ERROR;\n        }\n        c->local_sockaddr = ngx_palloc(r->connection->pool, len);\n        if (c->local_sockaddr == NULL) {\n            return NGX_ERROR;\n        }\n        c->local_socklen = len;\n        ngx_memcpy(c->local_sockaddr, &sa, len);\n    }\n    if (s == NULL) {\n        return NGX_OK;\n    }\n    s->len = ngx_sock_ntop(c->local_sockaddr, s->data, s->len, 0);\n    return NGX_OK;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    if (size <= pool->max) {\n        p = pool->current;\n        do {\n            m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);\n            if ((size_t) (p->d.end - m) >= size) {\n                p->d.last = m + size;\n                return m;\n            }\n            p = p->d.next;\n        } while (p);\n        return ngx_palloc_block(pool, size);\n    }\n    return ngx_palloc_large(pool, size);\n}']