src/http/ngx_http_upstream.c:2784: error: Integer Overflow L2
  ([0, `r->main->count` + 3] - 1):unsigned32 by call to `ngx_http_upstream_finalize_request`.

src/http/ngx_http_upstream.c:2703:1: Parameter `r->main->count`
2701. 
2702. 
2703. static void
      ^
2704. ngx_http_upstream_next(ngx_http_request_t *r, ngx_http_upstream_t *u,
2705.     ngx_uint_t ft_type)

src/http/ngx_http_upstream.c:2784:17: Call
2782.                 }
2783. 
2784.                 ngx_http_upstream_finalize_request(r, u, rc);
                      ^
2785.                 return;
2786.             }

src/http/ngx_http_upstream.c:2843:1: Parameter `r->main->count`
  2841. 
  2842. 
  2843. static void
        ^
  2844. ngx_http_upstream_finalize_request(ngx_http_request_t *r,
  2845.     ngx_http_upstream_t *u, ngx_int_t rc)

src/http/ngx_http_upstream.c:2952:5: Call
  2950.     }
  2951. 
  2952.     ngx_http_finalize_request(r, rc);
            ^
  2953. }
  2954. 

src/http/ngx_http_request.c:1847:1: Parameter `r->main->count`
    1845. 
    1846. 
    1847. void
          ^
    1848. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
    1849. {

src/http/ngx_http_request.c:1886:13: Call
    1884.         || c->error)
    1885.     {
    1886.         if (ngx_http_post_action(r) == NGX_OK) {
                      ^
    1887.             return;
    1888.         }

src/http/ngx_http_request.c:2846:1: <LHS trace>
2844. 
2845. 
2846. static ngx_int_t
      ^
2847. ngx_http_post_action(ngx_http_request_t *r)
2848. {

src/http/ngx_http_request.c:2846:1: Parameter `r->main->count`
      2844. 
      2845. 
      2846. static ngx_int_t
            ^
      2847. ngx_http_post_action(ngx_http_request_t *r)
      2848. {

src/http/ngx_http_request.c:2860:5: Binary operation: ([0, r->main->count + 3] - 1):unsigned32 by call to `ngx_http_upstream_finalize_request` 
      2858.                    "post action: \"%V\"", &clcf->post_action);
      2859. 
      2860.     r->main->count--;
                ^
      2861. 
      2862.     r->http_version = NGX_HTTP_VERSION_9;

static ngx_int_t
ngx_http_post_action(ngx_http_request_t *r)
{
    ngx_http_core_loc_conf_t  *clcf;
    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
    if (clcf->post_action.data == NULL) {
        return NGX_DECLINED;
    }
    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                   "post action: \"%V\"", &clcf->post_action);
    r->main->count--;
    r->http_version = NGX_HTTP_VERSION_9;
    r->header_only = 1;
    r->post_action = 1;
    r->read_event_handler = ngx_http_block_reading;
    if (clcf->post_action.data[0] == '/') {
        ngx_http_internal_redirect(r, &clcf->post_action, NULL);
    } else {
        ngx_http_named_location(r, &clcf->post_action);
    }
    return NGX_OK;
}
['static void\nngx_http_upstream_next(ngx_http_request_t *r, ngx_http_upstream_t *u,\n    ngx_uint_t ft_type)\n{\n    ngx_uint_t  status, state;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http next upstream, %xi", ft_type);\n#if 0\n    ngx_http_busy_unlock(u->conf->busy_lock, &u->busy_lock);\n#endif\n    if (ft_type == NGX_HTTP_UPSTREAM_FT_HTTP_404) {\n        state = NGX_PEER_NEXT;\n    } else {\n        state = NGX_PEER_FAILED;\n    }\n    if (ft_type != NGX_HTTP_UPSTREAM_FT_NOLIVE) {\n        u->peer.free(&u->peer, u->peer.data, state);\n    }\n    if (ft_type == NGX_HTTP_UPSTREAM_FT_TIMEOUT) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, NGX_ETIMEDOUT,\n                      "upstream timed out");\n    }\n    if (u->peer.cached && ft_type == NGX_HTTP_UPSTREAM_FT_ERROR) {\n        status = 0;\n    } else {\n        switch(ft_type) {\n        case NGX_HTTP_UPSTREAM_FT_TIMEOUT:\n            status = NGX_HTTP_GATEWAY_TIME_OUT;\n            break;\n        case NGX_HTTP_UPSTREAM_FT_HTTP_500:\n            status = NGX_HTTP_INTERNAL_SERVER_ERROR;\n            break;\n        case NGX_HTTP_UPSTREAM_FT_HTTP_404:\n            status = NGX_HTTP_NOT_FOUND;\n            break;\n        default:\n            status = NGX_HTTP_BAD_GATEWAY;\n        }\n    }\n    if (r->connection->error) {\n        ngx_http_upstream_finalize_request(r, u,\n                                           NGX_HTTP_CLIENT_CLOSED_REQUEST);\n        return;\n    }\n    if (status) {\n        u->state->status = status;\n        if (u->peer.tries == 0 || !(u->conf->next_upstream & ft_type)) {\n#if (NGX_HTTP_CACHE)\n            if (u->cache_status == NGX_HTTP_CACHE_EXPIRED\n                && (u->conf->cache_use_stale & ft_type))\n            {\n                ngx_int_t  rc;\n                rc = u->reinit_request(r);\n                if (rc == NGX_OK) {\n                    u->cache_status = NGX_HTTP_CACHE_STALE;\n                    rc = ngx_http_upstream_cache_send(r, u);\n                }\n                ngx_http_upstream_finalize_request(r, u, rc);\n                return;\n            }\n#endif\n            ngx_http_upstream_finalize_request(r, u, status);\n            return;\n        }\n    }\n    if (u->peer.connection) {\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "close http upstream connection: %d",\n                       u->peer.connection->fd);\n#if (NGX_HTTP_SSL)\n        if (u->peer.connection->ssl) {\n            u->peer.connection->ssl->no_wait_shutdown = 1;\n            u->peer.connection->ssl->no_send_shutdown = 1;\n            (void) ngx_ssl_shutdown(u->peer.connection);\n        }\n#endif\n        ngx_close_connection(u->peer.connection);\n    }\n#if 0\n    if (u->conf->busy_lock && !u->busy_locked) {\n        ngx_http_upstream_busy_lock(p);\n        return;\n    }\n#endif\n    ngx_http_upstream_connect(r, u);\n}', 'static void\nngx_http_upstream_finalize_request(ngx_http_request_t *r,\n    ngx_http_upstream_t *u, ngx_int_t rc)\n{\n    ngx_time_t  *tp;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "finalize http upstream request: %i", rc);\n    if (u->cleanup) {\n        *u->cleanup = NULL;\n    }\n    if (u->resolved && u->resolved->ctx) {\n        ngx_resolve_name_done(u->resolved->ctx);\n        u->resolved->ctx = NULL;\n    }\n    if (u->state && u->state->response_sec) {\n        tp = ngx_timeofday();\n        u->state->response_sec = tp->sec - u->state->response_sec;\n        u->state->response_msec = tp->msec - u->state->response_msec;\n        if (u->pipe) {\n            u->state->response_length = u->pipe->read_length;\n        }\n    }\n    u->finalize_request(r, rc);\n    if (u->peer.free) {\n        u->peer.free(&u->peer, u->peer.data, 0);\n    }\n    if (u->peer.connection) {\n#if (NGX_HTTP_SSL)\n        if (u->peer.connection->ssl) {\n            u->peer.connection->ssl->no_wait_shutdown = 1;\n            (void) ngx_ssl_shutdown(u->peer.connection);\n        }\n#endif\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "close http upstream connection: %d",\n                       u->peer.connection->fd);\n        ngx_close_connection(u->peer.connection);\n    }\n    u->peer.connection = NULL;\n    if (u->pipe && u->pipe->temp_file) {\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream temp fd: %d",\n                       u->pipe->temp_file->file.fd);\n    }\n#if (NGX_HTTP_CACHE)\n    if (u->cacheable && r->cache) {\n        time_t  valid;\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream cache fd: %d",\n                       r->cache->file.fd);\n        if (rc == NGX_HTTP_BAD_GATEWAY || rc == NGX_HTTP_GATEWAY_TIME_OUT) {\n            valid = ngx_http_file_cache_valid(u->conf->cache_valid, rc);\n            if (valid) {\n                r->cache->valid_sec = ngx_time() + valid;\n                r->cache->error = rc;\n            }\n        }\n        ngx_http_file_cache_free(r, u->pipe->temp_file);\n    }\n#endif\n    if (u->header_sent\n        && (rc == NGX_ERROR || rc >= NGX_HTTP_SPECIAL_RESPONSE))\n    {\n        rc = 0;\n    }\n    if (rc == NGX_DECLINED) {\n        return;\n    }\n    r->connection->log->action = "sending to client";\n    if (rc == 0) {\n        rc = ngx_http_send_special(r, NGX_HTTP_LAST);\n    }\n    ngx_http_finalize_request(r, rc);\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %d, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n        return;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        if (r->main->blocked) {\n            r->write_event_handler = ngx_http_request_finalizer;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n#if (NGX_DEBUG)\n        if (r != c->data) {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n        }\n#endif\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed || r->blocked) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'static ngx_int_t\nngx_http_post_action(ngx_http_request_t *r)\n{\n    ngx_http_core_loc_conf_t  *clcf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->post_action.data == NULL) {\n        return NGX_DECLINED;\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "post action: \\"%V\\"", &clcf->post_action);\n    r->main->count--;\n    r->http_version = NGX_HTTP_VERSION_9;\n    r->header_only = 1;\n    r->post_action = 1;\n    r->read_event_handler = ngx_http_block_reading;\n    if (clcf->post_action.data[0] == \'/\') {\n        ngx_http_internal_redirect(r, &clcf->post_action, NULL);\n    } else {\n        ngx_http_named_location(r, &clcf->post_action);\n    }\n    return NGX_OK;\n}']