modules/filters/mod_request.c:439: error: INTEGER_OVERFLOW_L2
  ([0, `size`] - 1):unsigned64.

modules/filters/mod_request.c:313:1: <LHS trace>
311.  * to the function call.
312.  */
313. static int ap_parse_request_form(request_rec * r, ap_filter_t * f, 
     ^
314.                                  apr_array_header_t ** ptr,
315.                                  apr_size_t num, apr_size_t size)

modules/filters/mod_request.c:313:1: Parameter `size`
311.  * to the function call.
312.  */
313. static int ap_parse_request_form(request_rec * r, ap_filter_t * f, 
     ^
314.                                  apr_array_header_t ** ptr,
315.                                  apr_size_t num, apr_size_t size)

modules/filters/mod_request.c:439:29: Binary operation: ([0, size] - 1):unsigned64
437.                         else {
438.                             buffer[offset++] = c;
439.                             size--;
                                 ^
440.                         }
441.                     }

static int ap_parse_request_form(request_rec * r, ap_filter_t * f,
                                 apr_array_header_t ** ptr,
                                 apr_size_t num, apr_size_t size)
{
    apr_bucket_brigade *bb = NULL;
    int seen_eos = 0;
    char buffer[HUGE_STRING_LEN + 1];
    const char *ct;
    apr_size_t offset = 0;
    ap_form_type_t state = FORM_NAME, percent = FORM_NORMAL;
    ap_form_pair_t *pair = NULL;
    apr_array_header_t *pairs = apr_array_make(r->pool, 4, sizeof(ap_form_pair_t));
    char hi = 0;
    char low = 0;
    *ptr = pairs;
    ct = apr_table_get(r->headers_in, "Content-Type");
    if (!ct || strcmp("application/x-www-form-urlencoded", ct)) {
        return ap_discard_request_body(r);
    }
    if (!f) {
        f = r->input_filters;
    }
    bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
    do {
        apr_bucket *bucket = NULL, *last = NULL;
        int rv = ap_get_brigade(f, bb, AP_MODE_READBYTES,
                                APR_BLOCK_READ, HUGE_STRING_LEN);
        if (rv != APR_SUCCESS) {
            apr_brigade_destroy(bb);
            return (rv == AP_FILTER_ERROR) ? rv : HTTP_BAD_REQUEST;
        }
        for (bucket = APR_BRIGADE_FIRST(bb);
             bucket != APR_BRIGADE_SENTINEL(bb);
             last = bucket, bucket = APR_BUCKET_NEXT(bucket)) {
            const char *data;
            apr_size_t len, slide;
            if (last) {
                apr_bucket_delete(last);
            }
            if (APR_BUCKET_IS_EOS(bucket)) {
                seen_eos = 1;
                break;
            }
            if (bucket->length == 0) {
                continue;
            }
            rv = apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);
            if (rv != APR_SUCCESS) {
                apr_brigade_destroy(bb);
                return HTTP_BAD_REQUEST;
            }
            slide = len;
            while (state != FORM_ABORT && slide-- > 0 && size >= 0 && num != 0) {
                char c = *data++;
                if ('+' == c) {
                    c = ' ';
                }
                else if ('&' == c) {
                    state = FORM_AMP;
                }
                if ('%' == c) {
                    percent = FORM_PERCENTA;
                    continue;
                }
                if (FORM_PERCENTA == percent) {
                    if (c >= 'a') {
                        hi = c - 'a' + 10;
                    }
                    else if (c >= 'A') {
                        hi = c - 'A' + 10;
                    }
                    else if (c >= '0') {
                        hi = c - '0';
                    }
                    hi = hi << 4;
                    percent = FORM_PERCENTB;
                    continue;
                }
                if (FORM_PERCENTB == percent) {
                    if (c >= 'a') {
                        low = c - 'a' + 10;
                    }
                    else if (c >= 'A') {
                        low = c - 'A' + 10;
                    }
                    else if (c >= '0') {
                        low = c - '0';
                    }
                    c = low | hi;
                    percent = FORM_NORMAL;
                }
                switch (state) {
                case FORM_AMP:
                    if (pair) {
                        const char *tmp = apr_pmemdup(r->pool, buffer, offset);
                        apr_bucket *b = apr_bucket_pool_create(tmp, offset, r->pool, r->connection->bucket_alloc);
                        APR_BRIGADE_INSERT_TAIL(pair->value, b);
                    }
                    state = FORM_NAME;
                    pair = NULL;
                    offset = 0;
                    num--;
                    break;
                case FORM_NAME:
                    if (offset < HUGE_STRING_LEN) {
                        if ('=' == c) {
                            buffer[offset] = 0;
                            offset = 0;
                            pair = (ap_form_pair_t *) apr_array_push(pairs);
                            pair->name = apr_pstrdup(r->pool, buffer);
                            pair->value = apr_brigade_create(r->pool, r->connection->bucket_alloc);
                            state = FORM_VALUE;
                        }
                        else {
                            buffer[offset++] = c;
                            size--;
                        }
                    }
                    else {
                        state = FORM_ABORT;
                    }
                    break;
                case FORM_VALUE:
                    if (offset >= HUGE_STRING_LEN) {
                        const char *tmp = apr_pmemdup(r->pool, buffer, offset);
                        apr_bucket *b = apr_bucket_pool_create(tmp, offset, r->pool, r->connection->bucket_alloc);
                        APR_BRIGADE_INSERT_TAIL(pair->value, b);
                        offset = 0;
                    }
                    buffer[offset++] = c;
                    size--;
                    break;
                default:
                    break;
                }
            }
        }
        apr_brigade_cleanup(bb);
    } while (!seen_eos);
    if (FORM_ABORT == state || size < 0 || num == 0) {
        return HTTP_REQUEST_ENTITY_TOO_LARGE;
    }
    else if (FORM_VALUE == state && pair && offset > 0) {
        const char *tmp = apr_pmemdup(r->pool, buffer, offset);
        apr_bucket *b = apr_bucket_pool_create(tmp, offset, r->pool, r->connection->bucket_alloc);
        APR_BRIGADE_INSERT_TAIL(pair->value, b);
    }
    return OK;
}
['static int ap_parse_request_form(request_rec * r, ap_filter_t * f,\n                                 apr_array_header_t ** ptr,\n                                 apr_size_t num, apr_size_t size)\n{\n    apr_bucket_brigade *bb = NULL;\n    int seen_eos = 0;\n    char buffer[HUGE_STRING_LEN + 1];\n    const char *ct;\n    apr_size_t offset = 0;\n    ap_form_type_t state = FORM_NAME, percent = FORM_NORMAL;\n    ap_form_pair_t *pair = NULL;\n    apr_array_header_t *pairs = apr_array_make(r->pool, 4, sizeof(ap_form_pair_t));\n    char hi = 0;\n    char low = 0;\n    *ptr = pairs;\n    ct = apr_table_get(r->headers_in, "Content-Type");\n    if (!ct || strcmp("application/x-www-form-urlencoded", ct)) {\n        return ap_discard_request_body(r);\n    }\n    if (!f) {\n        f = r->input_filters;\n    }\n    bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);\n    do {\n        apr_bucket *bucket = NULL, *last = NULL;\n        int rv = ap_get_brigade(f, bb, AP_MODE_READBYTES,\n                                APR_BLOCK_READ, HUGE_STRING_LEN);\n        if (rv != APR_SUCCESS) {\n            apr_brigade_destroy(bb);\n            return (rv == AP_FILTER_ERROR) ? rv : HTTP_BAD_REQUEST;\n        }\n        for (bucket = APR_BRIGADE_FIRST(bb);\n             bucket != APR_BRIGADE_SENTINEL(bb);\n             last = bucket, bucket = APR_BUCKET_NEXT(bucket)) {\n            const char *data;\n            apr_size_t len, slide;\n            if (last) {\n                apr_bucket_delete(last);\n            }\n            if (APR_BUCKET_IS_EOS(bucket)) {\n                seen_eos = 1;\n                break;\n            }\n            if (bucket->length == 0) {\n                continue;\n            }\n            rv = apr_bucket_read(bucket, &data, &len, APR_BLOCK_READ);\n            if (rv != APR_SUCCESS) {\n                apr_brigade_destroy(bb);\n                return HTTP_BAD_REQUEST;\n            }\n            slide = len;\n            while (state != FORM_ABORT && slide-- > 0 && size >= 0 && num != 0) {\n                char c = *data++;\n                if (\'+\' == c) {\n                    c = \' \';\n                }\n                else if (\'&\' == c) {\n                    state = FORM_AMP;\n                }\n                if (\'%\' == c) {\n                    percent = FORM_PERCENTA;\n                    continue;\n                }\n                if (FORM_PERCENTA == percent) {\n                    if (c >= \'a\') {\n                        hi = c - \'a\' + 10;\n                    }\n                    else if (c >= \'A\') {\n                        hi = c - \'A\' + 10;\n                    }\n                    else if (c >= \'0\') {\n                        hi = c - \'0\';\n                    }\n                    hi = hi << 4;\n                    percent = FORM_PERCENTB;\n                    continue;\n                }\n                if (FORM_PERCENTB == percent) {\n                    if (c >= \'a\') {\n                        low = c - \'a\' + 10;\n                    }\n                    else if (c >= \'A\') {\n                        low = c - \'A\' + 10;\n                    }\n                    else if (c >= \'0\') {\n                        low = c - \'0\';\n                    }\n                    c = low | hi;\n                    percent = FORM_NORMAL;\n                }\n                switch (state) {\n                case FORM_AMP:\n                    if (pair) {\n                        const char *tmp = apr_pmemdup(r->pool, buffer, offset);\n                        apr_bucket *b = apr_bucket_pool_create(tmp, offset, r->pool, r->connection->bucket_alloc);\n                        APR_BRIGADE_INSERT_TAIL(pair->value, b);\n                    }\n                    state = FORM_NAME;\n                    pair = NULL;\n                    offset = 0;\n                    num--;\n                    break;\n                case FORM_NAME:\n                    if (offset < HUGE_STRING_LEN) {\n                        if (\'=\' == c) {\n                            buffer[offset] = 0;\n                            offset = 0;\n                            pair = (ap_form_pair_t *) apr_array_push(pairs);\n                            pair->name = apr_pstrdup(r->pool, buffer);\n                            pair->value = apr_brigade_create(r->pool, r->connection->bucket_alloc);\n                            state = FORM_VALUE;\n                        }\n                        else {\n                            buffer[offset++] = c;\n                            size--;\n                        }\n                    }\n                    else {\n                        state = FORM_ABORT;\n                    }\n                    break;\n                case FORM_VALUE:\n                    if (offset >= HUGE_STRING_LEN) {\n                        const char *tmp = apr_pmemdup(r->pool, buffer, offset);\n                        apr_bucket *b = apr_bucket_pool_create(tmp, offset, r->pool, r->connection->bucket_alloc);\n                        APR_BRIGADE_INSERT_TAIL(pair->value, b);\n                        offset = 0;\n                    }\n                    buffer[offset++] = c;\n                    size--;\n                    break;\n                default:\n                    break;\n                }\n            }\n        }\n        apr_brigade_cleanup(bb);\n    } while (!seen_eos);\n    if (FORM_ABORT == state || size < 0 || num == 0) {\n        return HTTP_REQUEST_ENTITY_TOO_LARGE;\n    }\n    else if (FORM_VALUE == state && pair && offset > 0) {\n        const char *tmp = apr_pmemdup(r->pool, buffer, offset);\n        apr_bucket *b = apr_bucket_pool_create(tmp, offset, r->pool, r->connection->bucket_alloc);\n        APR_BRIGADE_INSERT_TAIL(pair->value, b);\n    }\n    return OK;\n}']