src/http/ngx_http_upstream.c:3002: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ngx_http_file_cache_free`.

src/http/ngx_http_upstream.c:3002:9: Call
3000.         }
3001. 
3002.         ngx_http_file_cache_free(r->cache, u->pipe->temp_file);
              ^
3003.     }
3004. 

src/http/ngx_http_file_cache.c:907:1: <LHS trace>
905. 
906. 
907. void
     ^
908. ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
909. {

src/http/ngx_http_file_cache.c:907:1: Parameter `c->node->count`
  905. 
  906. 
  907. void
       ^
  908. ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
  909. {

src/http/ngx_http_file_cache.c:925:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ngx_http_file_cache_free` 
  923. 
  924.     fcn = c->node;
  925.     fcn->count--;
           ^
  926. 
  927.     if (c->updating) {

void
ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
{
    ngx_http_file_cache_t       *cache;
    ngx_http_file_cache_node_t  *fcn;
    if (c->updated) {
        return;
    }
    cache = c->file_cache;
    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,
                   "http file cache free, fd: %d", c->file.fd);
    ngx_shmtx_lock(&cache->shpool->mutex);
    fcn = c->node;
    fcn->count--;
    if (c->updating) {
        fcn->updating = 0;
    }
    if (c->error) {
        fcn->error = c->error;
        if (c->valid_sec) {
            fcn->valid_sec = c->valid_sec;
            fcn->valid_msec = c->valid_msec;
        }
    } else if (!fcn->exists && fcn->count == 0 && c->min_uses == 1) {
        ngx_queue_remove(&fcn->queue);
        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);
        ngx_slab_free_locked(cache->shpool, fcn);
        c->node = NULL;
    }
    ngx_shmtx_unlock(&cache->shpool->mutex);
    c->updated = 1;
    c->updating = 0;
    if (c->temp_file) {
        if (tf && tf->file.fd != NGX_INVALID_FILE) {
            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,
                           "http file cache incomplete: \"%s\"",
                           tf->file.name.data);
            if (ngx_delete_file(tf->file.name.data) == NGX_FILE_ERROR) {
                ngx_log_error(NGX_LOG_CRIT, c->file.log, ngx_errno,
                              ngx_delete_file_n " \"%s\" failed",
                              tf->file.name.data);
            }
        }
    }
}
['static void\nngx_http_upstream_finalize_request(ngx_http_request_t *r,\n    ngx_http_upstream_t *u, ngx_int_t rc)\n{\n    ngx_time_t  *tp;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "finalize http upstream request: %i", rc);\n    if (u->cleanup) {\n        *u->cleanup = NULL;\n        u->cleanup = NULL;\n    }\n    if (u->resolved && u->resolved->ctx) {\n        ngx_resolve_name_done(u->resolved->ctx);\n        u->resolved->ctx = NULL;\n    }\n    if (u->state && u->state->response_sec) {\n        tp = ngx_timeofday();\n        u->state->response_sec = tp->sec - u->state->response_sec;\n        u->state->response_msec = tp->msec - u->state->response_msec;\n        if (u->pipe) {\n            u->state->response_length = u->pipe->read_length;\n        }\n    }\n    u->finalize_request(r, rc);\n    if (u->peer.free) {\n        u->peer.free(&u->peer, u->peer.data, 0);\n    }\n    if (u->peer.connection) {\n#if (NGX_HTTP_SSL)\n        if (u->peer.connection->ssl) {\n            u->peer.connection->ssl->no_wait_shutdown = 1;\n            (void) ngx_ssl_shutdown(u->peer.connection);\n        }\n#endif\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "close http upstream connection: %d",\n                       u->peer.connection->fd);\n        ngx_close_connection(u->peer.connection);\n    }\n    u->peer.connection = NULL;\n    if (u->pipe && u->pipe->temp_file) {\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream temp fd: %d",\n                       u->pipe->temp_file->file.fd);\n    }\n#if (NGX_HTTP_CACHE)\n    if (u->cacheable && r->cache) {\n        time_t  valid;\n        if (rc == NGX_HTTP_BAD_GATEWAY || rc == NGX_HTTP_GATEWAY_TIME_OUT) {\n            valid = ngx_http_file_cache_valid(u->conf->cache_valid, rc);\n            if (valid) {\n                r->cache->valid_sec = ngx_time() + valid;\n                r->cache->error = rc;\n            }\n        }\n        ngx_http_file_cache_free(r->cache, u->pipe->temp_file);\n    }\n#endif\n    if (u->header_sent\n        && (rc == NGX_ERROR || rc >= NGX_HTTP_SPECIAL_RESPONSE))\n    {\n        rc = 0;\n    }\n    if (rc == NGX_DECLINED) {\n        return;\n    }\n    r->connection->log->action = "sending to client";\n    if (rc == 0) {\n        rc = ngx_http_send_special(r, NGX_HTTP_LAST);\n    }\n    ngx_http_finalize_request(r, rc);\n}', 'void\nngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)\n{\n    ngx_http_file_cache_t       *cache;\n    ngx_http_file_cache_node_t  *fcn;\n    if (c->updated) {\n        return;\n    }\n    cache = c->file_cache;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,\n                   "http file cache free, fd: %d", c->file.fd);\n    ngx_shmtx_lock(&cache->shpool->mutex);\n    fcn = c->node;\n    fcn->count--;\n    if (c->updating) {\n        fcn->updating = 0;\n    }\n    if (c->error) {\n        fcn->error = c->error;\n        if (c->valid_sec) {\n            fcn->valid_sec = c->valid_sec;\n            fcn->valid_msec = c->valid_msec;\n        }\n    } else if (!fcn->exists && fcn->count == 0 && c->min_uses == 1) {\n        ngx_queue_remove(&fcn->queue);\n        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);\n        ngx_slab_free_locked(cache->shpool, fcn);\n        c->node = NULL;\n    }\n    ngx_shmtx_unlock(&cache->shpool->mutex);\n    c->updated = 1;\n    c->updating = 0;\n    if (c->temp_file) {\n        if (tf && tf->file.fd != NGX_INVALID_FILE) {\n            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,\n                           "http file cache incomplete: \\"%s\\"",\n                           tf->file.name.data);\n            if (ngx_delete_file(tf->file.name.data) == NGX_FILE_ERROR) {\n                ngx_log_error(NGX_LOG_CRIT, c->file.log, ngx_errno,\n                              ngx_delete_file_n " \\"%s\\" failed",\n                              tf->file.name.data);\n            }\n        }\n    }\n}']