src/http/modules/ngx_http_index_module.c:216: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64 by call to `ngx_open_cached_file`.

src/http/modules/ngx_http_index_module.c:143:13: Unknown value from: __infer_skip
141. 
142.         } else {
143.             ngx_memzero(&e, sizeof(ngx_http_script_engine_t));
                 ^
144. 
145.             e.ip = index[i].lengths->elts;

src/http/modules/ngx_http_index_module.c:216:13: Call
214. #endif
215. 
216.         if (ngx_open_cached_file(clcf->open_file_cache, &path, &of, r->pool)
                 ^
217.             != NGX_OK)
218.         {

src/core/ngx_open_file_cache.c:139:1: <LHS trace>
137. 
138. 
139. ngx_int_t
     ^
140. ngx_open_cached_file(ngx_open_file_cache_t *cache, ngx_str_t *name,
141.     ngx_open_file_info_t *of, ngx_pool_t *pool)

src/core/ngx_open_file_cache.c:139:1: Parameter `cache->current`
  137. 
  138. 
  139. ngx_int_t
       ^
  140. ngx_open_cached_file(ngx_open_file_cache_t *cache, ngx_str_t *name,
  141.     ngx_open_file_info_t *of, ngx_pool_t *pool)

src/core/ngx_open_file_cache.c:338:9: Binary operation: ([0, +oo] - 1):unsigned64 by call to `ngx_open_cached_file` 
  336.         ngx_rbtree_delete(&cache->rbtree, &file->node);
  337. 
  338.         cache->current--;
               ^
  339. 
  340.         file->close = 1;

ngx_int_t
ngx_open_cached_file(ngx_open_file_cache_t *cache, ngx_str_t *name,
    ngx_open_file_info_t *of, ngx_pool_t *pool)
{
    time_t                          now;
    uint32_t                        hash;
    ngx_int_t                       rc;
    ngx_file_info_t                 fi;
    ngx_pool_cleanup_t             *cln;
    ngx_cached_open_file_t         *file;
    ngx_pool_cleanup_file_t        *clnf;
    ngx_open_file_cache_cleanup_t  *ofcln;
    of->fd = NGX_INVALID_FILE;
    of->err = 0;
    if (cache == NULL) {
        if (of->test_only) {
            if (ngx_file_info_wrapper(name, of, &fi) == NGX_FILE_ERROR) {
                return NGX_ERROR;
            }
            of->uniq = ngx_file_uniq(&fi);
            of->mtime = ngx_file_mtime(&fi);
            of->size = ngx_file_size(&fi);
            of->fs_size = ngx_file_fs_size(&fi);
            of->is_dir = ngx_is_dir(&fi);
            of->is_file = ngx_is_file(&fi);
            of->is_link = ngx_is_link(&fi);
            of->is_exec = ngx_is_exec(&fi);
            return NGX_OK;
        }
        cln = ngx_pool_cleanup_add(pool, sizeof(ngx_pool_cleanup_file_t));
        if (cln == NULL) {
            return NGX_ERROR;
        }
        rc = ngx_open_and_stat_file(name, of, pool->log);
        if (rc == NGX_OK && !of->is_dir) {
            cln->handler = ngx_pool_cleanup_file;
            clnf = cln->data;
            clnf->fd = of->fd;
            clnf->name = name->data;
            clnf->log = pool->log;
        }
        return rc;
    }
    cln = ngx_pool_cleanup_add(pool, sizeof(ngx_open_file_cache_cleanup_t));
    if (cln == NULL) {
        return NGX_ERROR;
    }
    now = ngx_time();
    hash = ngx_crc32_long(name->data, name->len);
    file = ngx_open_file_lookup(cache, name, hash);
    if (file) {
        file->uses++;
        ngx_queue_remove(&file->queue);
        if (file->fd == NGX_INVALID_FILE && file->err == 0 && !file->is_dir) {
            rc = ngx_open_and_stat_file(name, of, pool->log);
            if (rc != NGX_OK && (of->err == 0 || !of->errors)) {
                goto failed;
            }
            goto add_event;
        }
        if (file->use_event
            || (file->event == NULL
                && (of->uniq == 0 || of->uniq == file->uniq)
                && now - file->created < of->valid
#if (NGX_HAVE_OPENAT)
                && of->disable_symlinks == file->disable_symlinks
#endif
            ))
        {
            if (file->err == 0) {
                of->fd = file->fd;
                of->uniq = file->uniq;
                of->mtime = file->mtime;
                of->size = file->size;
                of->is_dir = file->is_dir;
                of->is_file = file->is_file;
                of->is_link = file->is_link;
                of->is_exec = file->is_exec;
                of->is_directio = file->is_directio;
                if (!file->is_dir) {
                    file->count++;
                    ngx_open_file_add_event(cache, file, of, pool->log);
                }
            } else {
                of->err = file->err;
#if (NGX_HAVE_OPENAT)
                of->failed = file->disable_symlinks ? ngx_openat_file_n
                                                    : ngx_open_file_n;
#else
                of->failed = ngx_open_file_n;
#endif
            }
            goto found;
        }
        ngx_log_debug4(NGX_LOG_DEBUG_CORE, pool->log, 0,
                       "retest open file: %s, fd:%d, c:%d, e:%d",
                       file->name, file->fd, file->count, file->err);
        if (file->is_dir) {
            of->test_dir = 1;
        }
        of->fd = file->fd;
        of->uniq = file->uniq;
        rc = ngx_open_and_stat_file(name, of, pool->log);
        if (rc != NGX_OK && (of->err == 0 || !of->errors)) {
            goto failed;
        }
        if (of->is_dir) {
            if (file->is_dir || file->err) {
                goto update;
            }
        } else if (of->err == 0) {
            if (file->is_dir || file->err) {
                goto add_event;
            }
            if (of->uniq == file->uniq) {
                if (file->event) {
                    file->use_event = 1;
                }
                of->is_directio = file->is_directio;
                goto update;
            }
        } else {
            if (file->err || file->is_dir) {
                goto update;
            }
        }
        if (file->count == 0) {
            ngx_open_file_del_event(file);
            if (ngx_close_file(file->fd) == NGX_FILE_ERROR) {
                ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,
                              ngx_close_file_n " \"%V\" failed", name);
            }
            goto add_event;
        }
        ngx_rbtree_delete(&cache->rbtree, &file->node);
        cache->current--;
        file->close = 1;
        goto create;
    }
    rc = ngx_open_and_stat_file(name, of, pool->log);
    if (rc != NGX_OK && (of->err == 0 || !of->errors)) {
        goto failed;
    }
create:
    if (cache->current >= cache->max) {
        ngx_expire_old_cached_files(cache, 0, pool->log);
    }
    file = ngx_alloc(sizeof(ngx_cached_open_file_t), pool->log);
    if (file == NULL) {
        goto failed;
    }
    file->name = ngx_alloc(name->len + 1, pool->log);
    if (file->name == NULL) {
        ngx_free(file);
        file = NULL;
        goto failed;
    }
    ngx_cpystrn(file->name, name->data, name->len + 1);
    file->node.key = hash;
    ngx_rbtree_insert(&cache->rbtree, &file->node);
    cache->current++;
    file->uses = 1;
    file->count = 0;
    file->use_event = 0;
    file->event = NULL;
add_event:
    ngx_open_file_add_event(cache, file, of, pool->log);
update:
    file->fd = of->fd;
    file->err = of->err;
#if (NGX_HAVE_OPENAT)
    file->disable_symlinks = of->disable_symlinks;
#endif
    if (of->err == 0) {
        file->uniq = of->uniq;
        file->mtime = of->mtime;
        file->size = of->size;
        file->close = 0;
        file->is_dir = of->is_dir;
        file->is_file = of->is_file;
        file->is_link = of->is_link;
        file->is_exec = of->is_exec;
        file->is_directio = of->is_directio;
        if (!of->is_dir) {
            file->count++;
        }
    }
    file->created = now;
found:
    file->accessed = now;
    ngx_queue_insert_head(&cache->expire_queue, &file->queue);
    ngx_log_debug5(NGX_LOG_DEBUG_CORE, pool->log, 0,
                   "cached open file: %s, fd:%d, c:%d, e:%d, u:%d",
                   file->name, file->fd, file->count, file->err, file->uses);
    if (of->err == 0) {
        if (!of->is_dir) {
            cln->handler = ngx_open_file_cleanup;
            ofcln = cln->data;
            ofcln->cache = cache;
            ofcln->file = file;
            ofcln->min_uses = of->min_uses;
            ofcln->log = pool->log;
        }
        return NGX_OK;
    }
    return NGX_ERROR;
failed:
    if (file) {
        ngx_rbtree_delete(&cache->rbtree, &file->node);
        cache->current--;
        if (file->count == 0) {
            if (file->fd != NGX_INVALID_FILE) {
                if (ngx_close_file(file->fd) == NGX_FILE_ERROR) {
                    ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,
                                  ngx_close_file_n " \"%s\" failed",
                                  file->name);
                }
            }
            ngx_free(file->name);
            ngx_free(file);
        } else {
            file->close = 1;
        }
    }
    if (of->fd != NGX_INVALID_FILE) {
        if (ngx_close_file(of->fd) == NGX_FILE_ERROR) {
            ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,
                          ngx_close_file_n " \"%V\" failed", name);
        }
    }
    return NGX_ERROR;
}
['static ngx_int_t\nngx_http_index_handler(ngx_http_request_t *r)\n{\n    u_char                       *p, *name;\n    size_t                        len, root, reserve, allocated;\n    ngx_int_t                     rc;\n    ngx_str_t                     path, uri;\n    ngx_uint_t                    i, dir_tested;\n    ngx_http_index_t             *index;\n    ngx_open_file_info_t          of;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_engine_t      e;\n    ngx_http_core_loc_conf_t     *clcf;\n    ngx_http_index_loc_conf_t    *ilcf;\n    ngx_http_script_len_code_pt   lcode;\n    if (r->uri.data[r->uri.len - 1] != \'/\') {\n        return NGX_DECLINED;\n    }\n    if (!(r->method & (NGX_HTTP_GET|NGX_HTTP_HEAD|NGX_HTTP_POST))) {\n        return NGX_DECLINED;\n    }\n    ilcf = ngx_http_get_module_loc_conf(r, ngx_http_index_module);\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    allocated = 0;\n    root = 0;\n    dir_tested = 0;\n    name = NULL;\n    path.data = NULL;\n    index = ilcf->indices->elts;\n    for (i = 0; i < ilcf->indices->nelts; i++) {\n        if (index[i].lengths == NULL) {\n            if (index[i].name.data[0] == \'/\') {\n                return ngx_http_internal_redirect(r, &index[i].name, &r->args);\n            }\n            reserve = ilcf->max_index_len;\n            len = index[i].name.len;\n        } else {\n            ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n            e.ip = index[i].lengths->elts;\n            e.request = r;\n            e.flushed = 1;\n            len = 1;\n            while (*(uintptr_t *) e.ip) {\n                lcode = *(ngx_http_script_len_code_pt *) e.ip;\n                len += lcode(&e);\n            }\n            reserve = len + 16;\n        }\n        if (reserve > allocated) {\n            name = ngx_http_map_uri_to_path(r, &path, &root, reserve);\n            if (name == NULL) {\n                return NGX_ERROR;\n            }\n            allocated = path.data + path.len - name;\n        }\n        if (index[i].values == NULL) {\n            ngx_memcpy(name, index[i].name.data, index[i].name.len);\n            path.len = (name + index[i].name.len - 1) - path.data;\n        } else {\n            e.ip = index[i].values->elts;\n            e.pos = name;\n            while (*(uintptr_t *) e.ip) {\n                code = *(ngx_http_script_code_pt *) e.ip;\n                code((ngx_http_script_engine_t *) &e);\n            }\n            if (*name == \'/\') {\n                uri.len = len - 1;\n                uri.data = name;\n                return ngx_http_internal_redirect(r, &uri, &r->args);\n            }\n            path.len = e.pos - path.data;\n            *e.pos = \'\\0\';\n        }\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "open index \\"%V\\"", &path);\n        ngx_memzero(&of, sizeof(ngx_open_file_info_t));\n        of.read_ahead = clcf->read_ahead;\n        of.directio = clcf->directio;\n        of.valid = clcf->open_file_cache_valid;\n        of.min_uses = clcf->open_file_cache_min_uses;\n        of.test_only = 1;\n        of.errors = clcf->open_file_cache_errors;\n        of.events = clcf->open_file_cache_events;\n#if (NGX_HAVE_OPENAT)\n        of.disable_symlinks = clcf->disable_symlinks;\n#endif\n        if (ngx_open_cached_file(clcf->open_file_cache, &path, &of, r->pool)\n            != NGX_OK)\n        {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, of.err,\n                           "%s \\"%s\\" failed", of.failed, path.data);\n            if (of.err == 0) {\n                return NGX_HTTP_INTERNAL_SERVER_ERROR;\n            }\n#if (NGX_HAVE_OPENAT)\n            if (of.err == NGX_EMLINK\n                || of.err == NGX_ELOOP)\n            {\n                return NGX_HTTP_FORBIDDEN;\n            }\n#endif\n            if (of.err == NGX_ENOTDIR\n                || of.err == NGX_ENAMETOOLONG\n                || of.err == NGX_EACCES)\n            {\n                return ngx_http_index_error(r, clcf, path.data, of.err);\n            }\n            if (!dir_tested) {\n                rc = ngx_http_index_test_dir(r, clcf, path.data, name - 1);\n                if (rc != NGX_OK) {\n                    return rc;\n                }\n                dir_tested = 1;\n            }\n            if (of.err == NGX_ENOENT) {\n                continue;\n            }\n            ngx_log_error(NGX_LOG_CRIT, r->connection->log, of.err,\n                          "%s \\"%s\\" failed", of.failed, path.data);\n            return NGX_HTTP_INTERNAL_SERVER_ERROR;\n        }\n        uri.len = r->uri.len + len - 1;\n        if (!clcf->alias) {\n            uri.data = path.data + root;\n        } else {\n            uri.data = ngx_pnalloc(r->pool, uri.len);\n            if (uri.data == NULL) {\n                return NGX_HTTP_INTERNAL_SERVER_ERROR;\n            }\n            p = ngx_copy(uri.data, r->uri.data, r->uri.len);\n            ngx_memcpy(p, name, len - 1);\n        }\n        return ngx_http_internal_redirect(r, &uri, &r->args);\n    }\n    return NGX_DECLINED;\n}', 'ngx_int_t\nngx_open_cached_file(ngx_open_file_cache_t *cache, ngx_str_t *name,\n    ngx_open_file_info_t *of, ngx_pool_t *pool)\n{\n    time_t                          now;\n    uint32_t                        hash;\n    ngx_int_t                       rc;\n    ngx_file_info_t                 fi;\n    ngx_pool_cleanup_t             *cln;\n    ngx_cached_open_file_t         *file;\n    ngx_pool_cleanup_file_t        *clnf;\n    ngx_open_file_cache_cleanup_t  *ofcln;\n    of->fd = NGX_INVALID_FILE;\n    of->err = 0;\n    if (cache == NULL) {\n        if (of->test_only) {\n            if (ngx_file_info_wrapper(name, of, &fi) == NGX_FILE_ERROR) {\n                return NGX_ERROR;\n            }\n            of->uniq = ngx_file_uniq(&fi);\n            of->mtime = ngx_file_mtime(&fi);\n            of->size = ngx_file_size(&fi);\n            of->fs_size = ngx_file_fs_size(&fi);\n            of->is_dir = ngx_is_dir(&fi);\n            of->is_file = ngx_is_file(&fi);\n            of->is_link = ngx_is_link(&fi);\n            of->is_exec = ngx_is_exec(&fi);\n            return NGX_OK;\n        }\n        cln = ngx_pool_cleanup_add(pool, sizeof(ngx_pool_cleanup_file_t));\n        if (cln == NULL) {\n            return NGX_ERROR;\n        }\n        rc = ngx_open_and_stat_file(name, of, pool->log);\n        if (rc == NGX_OK && !of->is_dir) {\n            cln->handler = ngx_pool_cleanup_file;\n            clnf = cln->data;\n            clnf->fd = of->fd;\n            clnf->name = name->data;\n            clnf->log = pool->log;\n        }\n        return rc;\n    }\n    cln = ngx_pool_cleanup_add(pool, sizeof(ngx_open_file_cache_cleanup_t));\n    if (cln == NULL) {\n        return NGX_ERROR;\n    }\n    now = ngx_time();\n    hash = ngx_crc32_long(name->data, name->len);\n    file = ngx_open_file_lookup(cache, name, hash);\n    if (file) {\n        file->uses++;\n        ngx_queue_remove(&file->queue);\n        if (file->fd == NGX_INVALID_FILE && file->err == 0 && !file->is_dir) {\n            rc = ngx_open_and_stat_file(name, of, pool->log);\n            if (rc != NGX_OK && (of->err == 0 || !of->errors)) {\n                goto failed;\n            }\n            goto add_event;\n        }\n        if (file->use_event\n            || (file->event == NULL\n                && (of->uniq == 0 || of->uniq == file->uniq)\n                && now - file->created < of->valid\n#if (NGX_HAVE_OPENAT)\n                && of->disable_symlinks == file->disable_symlinks\n#endif\n            ))\n        {\n            if (file->err == 0) {\n                of->fd = file->fd;\n                of->uniq = file->uniq;\n                of->mtime = file->mtime;\n                of->size = file->size;\n                of->is_dir = file->is_dir;\n                of->is_file = file->is_file;\n                of->is_link = file->is_link;\n                of->is_exec = file->is_exec;\n                of->is_directio = file->is_directio;\n                if (!file->is_dir) {\n                    file->count++;\n                    ngx_open_file_add_event(cache, file, of, pool->log);\n                }\n            } else {\n                of->err = file->err;\n#if (NGX_HAVE_OPENAT)\n                of->failed = file->disable_symlinks ? ngx_openat_file_n\n                                                    : ngx_open_file_n;\n#else\n                of->failed = ngx_open_file_n;\n#endif\n            }\n            goto found;\n        }\n        ngx_log_debug4(NGX_LOG_DEBUG_CORE, pool->log, 0,\n                       "retest open file: %s, fd:%d, c:%d, e:%d",\n                       file->name, file->fd, file->count, file->err);\n        if (file->is_dir) {\n            of->test_dir = 1;\n        }\n        of->fd = file->fd;\n        of->uniq = file->uniq;\n        rc = ngx_open_and_stat_file(name, of, pool->log);\n        if (rc != NGX_OK && (of->err == 0 || !of->errors)) {\n            goto failed;\n        }\n        if (of->is_dir) {\n            if (file->is_dir || file->err) {\n                goto update;\n            }\n        } else if (of->err == 0) {\n            if (file->is_dir || file->err) {\n                goto add_event;\n            }\n            if (of->uniq == file->uniq) {\n                if (file->event) {\n                    file->use_event = 1;\n                }\n                of->is_directio = file->is_directio;\n                goto update;\n            }\n        } else {\n            if (file->err || file->is_dir) {\n                goto update;\n            }\n        }\n        if (file->count == 0) {\n            ngx_open_file_del_event(file);\n            if (ngx_close_file(file->fd) == NGX_FILE_ERROR) {\n                ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,\n                              ngx_close_file_n " \\"%V\\" failed", name);\n            }\n            goto add_event;\n        }\n        ngx_rbtree_delete(&cache->rbtree, &file->node);\n        cache->current--;\n        file->close = 1;\n        goto create;\n    }\n    rc = ngx_open_and_stat_file(name, of, pool->log);\n    if (rc != NGX_OK && (of->err == 0 || !of->errors)) {\n        goto failed;\n    }\ncreate:\n    if (cache->current >= cache->max) {\n        ngx_expire_old_cached_files(cache, 0, pool->log);\n    }\n    file = ngx_alloc(sizeof(ngx_cached_open_file_t), pool->log);\n    if (file == NULL) {\n        goto failed;\n    }\n    file->name = ngx_alloc(name->len + 1, pool->log);\n    if (file->name == NULL) {\n        ngx_free(file);\n        file = NULL;\n        goto failed;\n    }\n    ngx_cpystrn(file->name, name->data, name->len + 1);\n    file->node.key = hash;\n    ngx_rbtree_insert(&cache->rbtree, &file->node);\n    cache->current++;\n    file->uses = 1;\n    file->count = 0;\n    file->use_event = 0;\n    file->event = NULL;\nadd_event:\n    ngx_open_file_add_event(cache, file, of, pool->log);\nupdate:\n    file->fd = of->fd;\n    file->err = of->err;\n#if (NGX_HAVE_OPENAT)\n    file->disable_symlinks = of->disable_symlinks;\n#endif\n    if (of->err == 0) {\n        file->uniq = of->uniq;\n        file->mtime = of->mtime;\n        file->size = of->size;\n        file->close = 0;\n        file->is_dir = of->is_dir;\n        file->is_file = of->is_file;\n        file->is_link = of->is_link;\n        file->is_exec = of->is_exec;\n        file->is_directio = of->is_directio;\n        if (!of->is_dir) {\n            file->count++;\n        }\n    }\n    file->created = now;\nfound:\n    file->accessed = now;\n    ngx_queue_insert_head(&cache->expire_queue, &file->queue);\n    ngx_log_debug5(NGX_LOG_DEBUG_CORE, pool->log, 0,\n                   "cached open file: %s, fd:%d, c:%d, e:%d, u:%d",\n                   file->name, file->fd, file->count, file->err, file->uses);\n    if (of->err == 0) {\n        if (!of->is_dir) {\n            cln->handler = ngx_open_file_cleanup;\n            ofcln = cln->data;\n            ofcln->cache = cache;\n            ofcln->file = file;\n            ofcln->min_uses = of->min_uses;\n            ofcln->log = pool->log;\n        }\n        return NGX_OK;\n    }\n    return NGX_ERROR;\nfailed:\n    if (file) {\n        ngx_rbtree_delete(&cache->rbtree, &file->node);\n        cache->current--;\n        if (file->count == 0) {\n            if (file->fd != NGX_INVALID_FILE) {\n                if (ngx_close_file(file->fd) == NGX_FILE_ERROR) {\n                    ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,\n                                  ngx_close_file_n " \\"%s\\" failed",\n                                  file->name);\n                }\n            }\n            ngx_free(file->name);\n            ngx_free(file);\n        } else {\n            file->close = 1;\n        }\n    }\n    if (of->fd != NGX_INVALID_FILE) {\n        if (ngx_close_file(of->fd) == NGX_FILE_ERROR) {\n            ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,\n                          ngx_close_file_n " \\"%V\\" failed", name);\n        }\n    }\n    return NGX_ERROR;\n}']