src/core/ngx_slab.c:640: error: Integer Overflow L2
  ([0, `pool->pages->slab`] - 1):unsigned64 by call to `ngx_slab_free_pages`.

src/core/ngx_slab.c:460:1: Parameter `pool->pages->slab`
458. 
459. 
460. void
     ^
461. ngx_slab_free_locked(ngx_slab_pool_t *pool, void *p)
462. {

src/core/ngx_slab.c:477:5: Assignment
475.     n = ((u_char *) p - pool->start) >> ngx_pagesize_shift;
476.     page = &pool->pages[n];
477.     slab = page->slab;
         ^
478.     type = ngx_slab_page_type(page);
479. 

src/core/ngx_slab.c:638:9: Assignment
636.         }
637. 
638.         size = slab & ~NGX_SLAB_PAGE_START;
             ^
639. 
640.         ngx_slab_free_pages(pool, page, size);

src/core/ngx_slab.c:640:9: Call
638.         size = slab & ~NGX_SLAB_PAGE_START;
639. 
640.         ngx_slab_free_pages(pool, page, size);
             ^
641. 
642.         ngx_slab_junk(p, size << ngx_pagesize_shift);

src/core/ngx_slab.c:733:1: <LHS trace>
731. 
732. 
733. static void
     ^
734. ngx_slab_free_pages(ngx_slab_pool_t *pool, ngx_slab_page_t *page,
735.     ngx_uint_t pages)

src/core/ngx_slab.c:733:1: Parameter `pages`
  731. 
  732. 
  733. static void
       ^
  734. ngx_slab_free_pages(ngx_slab_pool_t *pool, ngx_slab_page_t *page,
  735.     ngx_uint_t pages)

src/core/ngx_slab.c:741:18: Binary operation: ([0, pool->pages->slab] - 1):unsigned64 by call to `ngx_slab_free_pages` 
  739.     pool->pfree += pages;
  740. 
  741.     page->slab = pages--;
                        ^
  742. 
  743.     if (pages) {

static void
ngx_slab_free_pages(ngx_slab_pool_t *pool, ngx_slab_page_t *page,
    ngx_uint_t pages)
{
    ngx_slab_page_t  *prev, *join;
    pool->pfree += pages;
    page->slab = pages--;
    if (pages) {
        ngx_memzero(&page[1], pages * sizeof(ngx_slab_page_t));
    }
    if (page->next) {
        prev = ngx_slab_page_prev(page);
        prev->next = page->next;
        page->next->prev = page->prev;
    }
    join = page + page->slab;
    if (join < pool->last) {
        if (ngx_slab_page_type(join) == NGX_SLAB_PAGE) {
            if (join->next != NULL) {
                pages += join->slab;
                page->slab += join->slab;
                prev = ngx_slab_page_prev(join);
                prev->next = join->next;
                join->next->prev = join->prev;
                join->slab = NGX_SLAB_PAGE_FREE;
                join->next = NULL;
                join->prev = NGX_SLAB_PAGE;
            }
        }
    }
    if (page > pool->pages) {
        join = page - 1;
        if (ngx_slab_page_type(join) == NGX_SLAB_PAGE) {
            if (join->slab == NGX_SLAB_PAGE_FREE) {
                join = ngx_slab_page_prev(join);
            }
            if (join->next != NULL) {
                pages += join->slab;
                join->slab += page->slab;
                prev = ngx_slab_page_prev(join);
                prev->next = join->next;
                join->next->prev = join->prev;
                page->slab = NGX_SLAB_PAGE_FREE;
                page->next = NULL;
                page->prev = NGX_SLAB_PAGE;
                page = join;
            }
        }
    }
    if (pages) {
        page[pages].prev = (uintptr_t) page;
    }
    page->prev = (uintptr_t) &pool->free;
    page->next = pool->free.next;
    page->next->prev = (uintptr_t) page;
    pool->free.next = page;
}
['void\nngx_slab_free_locked(ngx_slab_pool_t *pool, void *p)\n{\n    size_t            size;\n    uintptr_t         slab, m, *bitmap;\n    ngx_uint_t        i, n, type, slot, shift, map;\n    ngx_slab_page_t  *slots, *page;\n    ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0, "slab free: %p", p);\n    if ((u_char *) p < pool->start || (u_char *) p > pool->end) {\n        ngx_slab_error(pool, NGX_LOG_ALERT, "ngx_slab_free(): outside of pool");\n        goto fail;\n    }\n    n = ((u_char *) p - pool->start) >> ngx_pagesize_shift;\n    page = &pool->pages[n];\n    slab = page->slab;\n    type = ngx_slab_page_type(page);\n    switch (type) {\n    case NGX_SLAB_SMALL:\n        shift = slab & NGX_SLAB_SHIFT_MASK;\n        size = (size_t) 1 << shift;\n        if ((uintptr_t) p & (size - 1)) {\n            goto wrong_chunk;\n        }\n        n = ((uintptr_t) p & (ngx_pagesize - 1)) >> shift;\n        m = (uintptr_t) 1 << (n % (8 * sizeof(uintptr_t)));\n        n /= 8 * sizeof(uintptr_t);\n        bitmap = (uintptr_t *)\n                             ((uintptr_t) p & ~((uintptr_t) ngx_pagesize - 1));\n        if (bitmap[n] & m) {\n            slot = shift - pool->min_shift;\n            if (page->next == NULL) {\n                slots = ngx_slab_slots(pool);\n                page->next = slots[slot].next;\n                slots[slot].next = page;\n                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_SMALL;\n                page->next->prev = (uintptr_t) page | NGX_SLAB_SMALL;\n            }\n            bitmap[n] &= ~m;\n            n = (ngx_pagesize >> shift) / ((1 << shift) * 8);\n            if (n == 0) {\n                n = 1;\n            }\n            i = n / (8 * sizeof(uintptr_t));\n            m = ((uintptr_t) 1 << (n % (8 * sizeof(uintptr_t)))) - 1;\n            if (bitmap[i] & ~m) {\n                goto done;\n            }\n            map = (ngx_pagesize >> shift) / (8 * sizeof(uintptr_t));\n            for (i = i + 1; i < map; i++) {\n                if (bitmap[i]) {\n                    goto done;\n                }\n            }\n            ngx_slab_free_pages(pool, page, 1);\n            pool->stats[slot].total -= (ngx_pagesize >> shift) - n;\n            goto done;\n        }\n        goto chunk_already_free;\n    case NGX_SLAB_EXACT:\n        m = (uintptr_t) 1 <<\n                (((uintptr_t) p & (ngx_pagesize - 1)) >> ngx_slab_exact_shift);\n        size = ngx_slab_exact_size;\n        if ((uintptr_t) p & (size - 1)) {\n            goto wrong_chunk;\n        }\n        if (slab & m) {\n            slot = ngx_slab_exact_shift - pool->min_shift;\n            if (slab == NGX_SLAB_BUSY) {\n                slots = ngx_slab_slots(pool);\n                page->next = slots[slot].next;\n                slots[slot].next = page;\n                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_EXACT;\n                page->next->prev = (uintptr_t) page | NGX_SLAB_EXACT;\n            }\n            page->slab &= ~m;\n            if (page->slab) {\n                goto done;\n            }\n            ngx_slab_free_pages(pool, page, 1);\n            pool->stats[slot].total -= 8 * sizeof(uintptr_t);\n            goto done;\n        }\n        goto chunk_already_free;\n    case NGX_SLAB_BIG:\n        shift = slab & NGX_SLAB_SHIFT_MASK;\n        size = (size_t) 1 << shift;\n        if ((uintptr_t) p & (size - 1)) {\n            goto wrong_chunk;\n        }\n        m = (uintptr_t) 1 << ((((uintptr_t) p & (ngx_pagesize - 1)) >> shift)\n                              + NGX_SLAB_MAP_SHIFT);\n        if (slab & m) {\n            slot = shift - pool->min_shift;\n            if (page->next == NULL) {\n                slots = ngx_slab_slots(pool);\n                page->next = slots[slot].next;\n                slots[slot].next = page;\n                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_BIG;\n                page->next->prev = (uintptr_t) page | NGX_SLAB_BIG;\n            }\n            page->slab &= ~m;\n            if (page->slab & NGX_SLAB_MAP_MASK) {\n                goto done;\n            }\n            ngx_slab_free_pages(pool, page, 1);\n            pool->stats[slot].total -= ngx_pagesize >> shift;\n            goto done;\n        }\n        goto chunk_already_free;\n    case NGX_SLAB_PAGE:\n        if ((uintptr_t) p & (ngx_pagesize - 1)) {\n            goto wrong_chunk;\n        }\n        if (!(slab & NGX_SLAB_PAGE_START)) {\n            ngx_slab_error(pool, NGX_LOG_ALERT,\n                           "ngx_slab_free(): page is already free");\n            goto fail;\n        }\n        if (slab == NGX_SLAB_PAGE_BUSY) {\n            ngx_slab_error(pool, NGX_LOG_ALERT,\n                           "ngx_slab_free(): pointer to wrong page");\n            goto fail;\n        }\n        size = slab & ~NGX_SLAB_PAGE_START;\n        ngx_slab_free_pages(pool, page, size);\n        ngx_slab_junk(p, size << ngx_pagesize_shift);\n        return;\n    }\n    return;\ndone:\n    pool->stats[slot].used--;\n    ngx_slab_junk(p, size);\n    return;\nwrong_chunk:\n    ngx_slab_error(pool, NGX_LOG_ALERT,\n                   "ngx_slab_free(): pointer to wrong chunk");\n    goto fail;\nchunk_already_free:\n    ngx_slab_error(pool, NGX_LOG_ALERT,\n                   "ngx_slab_free(): chunk is already free");\nfail:\n    return;\n}', 'static void\nngx_slab_free_pages(ngx_slab_pool_t *pool, ngx_slab_page_t *page,\n    ngx_uint_t pages)\n{\n    ngx_slab_page_t  *prev, *join;\n    pool->pfree += pages;\n    page->slab = pages--;\n    if (pages) {\n        ngx_memzero(&page[1], pages * sizeof(ngx_slab_page_t));\n    }\n    if (page->next) {\n        prev = ngx_slab_page_prev(page);\n        prev->next = page->next;\n        page->next->prev = page->prev;\n    }\n    join = page + page->slab;\n    if (join < pool->last) {\n        if (ngx_slab_page_type(join) == NGX_SLAB_PAGE) {\n            if (join->next != NULL) {\n                pages += join->slab;\n                page->slab += join->slab;\n                prev = ngx_slab_page_prev(join);\n                prev->next = join->next;\n                join->next->prev = join->prev;\n                join->slab = NGX_SLAB_PAGE_FREE;\n                join->next = NULL;\n                join->prev = NGX_SLAB_PAGE;\n            }\n        }\n    }\n    if (page > pool->pages) {\n        join = page - 1;\n        if (ngx_slab_page_type(join) == NGX_SLAB_PAGE) {\n            if (join->slab == NGX_SLAB_PAGE_FREE) {\n                join = ngx_slab_page_prev(join);\n            }\n            if (join->next != NULL) {\n                pages += join->slab;\n                join->slab += page->slab;\n                prev = ngx_slab_page_prev(join);\n                prev->next = join->next;\n                join->next->prev = join->prev;\n                page->slab = NGX_SLAB_PAGE_FREE;\n                page->next = NULL;\n                page->prev = NGX_SLAB_PAGE;\n                page = join;\n            }\n        }\n    }\n    if (pages) {\n        page[pages].prev = (uintptr_t) page;\n    }\n    page->prev = (uintptr_t) &pool->free;\n    page->next = pool->free.next;\n    page->next->prev = (uintptr_t) page;\n    pool->free.next = page;\n}']