src/core/ngx_crypt.c:219: error: Integer Overflow L2
  ([1, +oo] - [64-min(63, `key->strlen`), 63]):unsigned64 by call to `ngx_sha1_update`.

src/core/ngx_crypt.c:212:9: Assignment
210. 
211.     if (rc != NGX_OK || decoded.len < 20) {
212.         decoded.len = 20;
             ^
213.     }
214. 

src/core/ngx_crypt.c:219:5: Call
217.     ngx_sha1_init(&sha1);
218.     ngx_sha1_update(&sha1, key, ngx_strlen(key));
219.     ngx_sha1_update(&sha1, decoded.data + 20, decoded.len - 20);
         ^
220.     ngx_sha1_final(decoded.data, &sha1);
221. 

src/core/ngx_sha1.c:32:1: <LHS trace>
30. 
31. 
32. void
    ^
33. ngx_sha1_update(ngx_sha1_t *ctx, const void *data, size_t size)
34. {

src/core/ngx_sha1.c:32:1: Parameter `size`
  30. 
  31. 
  32. void
      ^
  33. ngx_sha1_update(ngx_sha1_t *ctx, const void *data, size_t size)
  34. {

src/core/ngx_sha1.c:32:1: <RHS trace>
30. 
31. 
32. void
    ^
33. ngx_sha1_update(ngx_sha1_t *ctx, const void *data, size_t size)
34. {

src/core/ngx_sha1.c:32:1: Parameter `size`
  30. 
  31. 
  32. void
      ^
  33. ngx_sha1_update(ngx_sha1_t *ctx, const void *data, size_t size)
  34. {

src/core/ngx_sha1.c:50:9: Binary operation: ([1, +oo] - [64-min(63, key->strlen), 63]):unsigned64 by call to `ngx_sha1_update` 
  48.         ngx_memcpy(&ctx->buffer[used], data, free);
  49.         data = (u_char *) data + free;
  50.         size -= free;
              ^
  51.         (void) ngx_sha1_body(ctx, ctx->buffer, 64);
  52.     }

void
ngx_sha1_update(ngx_sha1_t *ctx, const void *data, size_t size)
{
    size_t  used, free;
    used = (size_t) (ctx->bytes & 0x3f);
    ctx->bytes += size;
    if (used) {
        free = 64 - used;
        if (size < free) {
            ngx_memcpy(&ctx->buffer[used], data, size);
            return;
        }
        ngx_memcpy(&ctx->buffer[used], data, free);
        data = (u_char *) data + free;
        size -= free;
        (void) ngx_sha1_body(ctx, ctx->buffer, 64);
    }
    if (size >= 64) {
        data = ngx_sha1_body(ctx, data, size & ~(size_t) 0x3f);
        size &= 0x3f;
    }
    ngx_memcpy(ctx->buffer, data, size);
}
['static ngx_int_t\nngx_crypt_ssha(ngx_pool_t *pool, u_char *key, u_char *salt, u_char **encrypted)\n{\n    size_t       len;\n    ngx_int_t    rc;\n    ngx_str_t    encoded, decoded;\n    ngx_sha1_t   sha1;\n    encoded.data = salt + sizeof("{SSHA}") - 1;\n    encoded.len = ngx_strlen(encoded.data);\n    len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);\n    decoded.data = ngx_pnalloc(pool, len);\n    if (decoded.data == NULL) {\n        return NGX_ERROR;\n    }\n    rc = ngx_decode_base64(&decoded, &encoded);\n    if (rc != NGX_OK || decoded.len < 20) {\n        decoded.len = 20;\n    }\n    ngx_sha1_init(&sha1);\n    ngx_sha1_update(&sha1, key, ngx_strlen(key));\n    ngx_sha1_update(&sha1, decoded.data + 20, decoded.len - 20);\n    ngx_sha1_final(decoded.data, &sha1);\n    len = sizeof("{SSHA}") - 1 + ngx_base64_encoded_length(decoded.len) + 1;\n    *encrypted = ngx_pnalloc(pool, len);\n    if (*encrypted == NULL) {\n        return NGX_ERROR;\n    }\n    encoded.data = ngx_cpymem(*encrypted, "{SSHA}", sizeof("{SSHA}") - 1);\n    ngx_encode_base64(&encoded, &decoded);\n    encoded.data[encoded.len] = \'\\0\';\n    return NGX_OK;\n}', 'void\nngx_sha1_update(ngx_sha1_t *ctx, const void *data, size_t size)\n{\n    size_t  used, free;\n    used = (size_t) (ctx->bytes & 0x3f);\n    ctx->bytes += size;\n    if (used) {\n        free = 64 - used;\n        if (size < free) {\n            ngx_memcpy(&ctx->buffer[used], data, size);\n            return;\n        }\n        ngx_memcpy(&ctx->buffer[used], data, free);\n        data = (u_char *) data + free;\n        size -= free;\n        (void) ngx_sha1_body(ctx, ctx->buffer, 64);\n    }\n    if (size >= 64) {\n        data = ngx_sha1_body(ctx, data, size & ~(size_t) 0x3f);\n        size &= 0x3f;\n    }\n    ngx_memcpy(ctx->buffer, data, size);\n}']