src/http/ngx_http_core_module.c:4085: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64 by call to `ngx_parse_size`.

src/http/ngx_http_core_module.c:4082:13: Assignment
4080. 
4081.         if (ngx_strncmp(value[n].data, "rcvbuf=", 7) == 0) {
4082.             size.len = value[n].len - 7;
                  ^
4083.             size.data = value[n].data + 7;
4084. 

src/http/ngx_http_core_module.c:4085:28: Call
4083.             size.data = value[n].data + 7;
4084. 
4085.             lsopt.rcvbuf = ngx_parse_size(&size);
                                 ^
4086.             lsopt.set = 1;
4087.             lsopt.bind = 1;

src/core/ngx_parse.c:12:1: <LHS trace>
10. 
11. 
12. ssize_t
    ^
13. ngx_parse_size(ngx_str_t *line)
14. {

src/core/ngx_parse.c:12:1: Parameter `line->len`
  10. 
  11. 
  12. ssize_t
      ^
  13. ngx_parse_size(ngx_str_t *line)
  14. {

src/core/ngx_parse.c:19:5: Assignment
  17.     ssize_t  size, scale, max;
  18. 
  19.     len = line->len;
          ^
  20.     unit = line->data[len - 1];
  21. 

src/core/ngx_parse.c:20:12: Binary operation: ([0, +oo] - 1):unsigned64 by call to `ngx_parse_size` 
  18. 
  19.     len = line->len;
  20.     unit = line->data[len - 1];
                 ^
  21. 
  22.     switch (unit) {

ssize_t
ngx_parse_size(ngx_str_t *line)
{
    u_char   unit;
    size_t   len;
    ssize_t  size, scale, max;
    len = line->len;
    unit = line->data[len - 1];
    switch (unit) {
    case 'K':
    case 'k':
        len--;
        max = NGX_MAX_SIZE_T_VALUE / 1024;
        scale = 1024;
        break;
    case 'M':
    case 'm':
        len--;
        max = NGX_MAX_SIZE_T_VALUE / (1024 * 1024);
        scale = 1024 * 1024;
        break;
    default:
        max = NGX_MAX_SIZE_T_VALUE;
        scale = 1;
    }
    size = ngx_atosz(line->data, len);
    if (size == NGX_ERROR || size > max) {
        return NGX_ERROR;
    }
    size *= scale;
    return size;
}
['static char *\nngx_http_core_listen(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_core_srv_conf_t *cscf = conf;\n    ngx_str_t              *value, size;\n    ngx_url_t               u;\n    ngx_uint_t              n;\n    ngx_http_listen_opt_t   lsopt;\n    cscf->listen = 1;\n    value = cf->args->elts;\n    ngx_memzero(&u, sizeof(ngx_url_t));\n    u.url = value[1];\n    u.listen = 1;\n    u.default_port = 80;\n    if (ngx_parse_url(cf->pool, &u) != NGX_OK) {\n        if (u.err) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "%s in \\"%V\\" of the \\"listen\\" directive",\n                               u.err, &u.url);\n        }\n        return NGX_CONF_ERROR;\n    }\n    ngx_memzero(&lsopt, sizeof(ngx_http_listen_opt_t));\n    ngx_memcpy(&lsopt.u.sockaddr, u.sockaddr, u.socklen);\n    lsopt.socklen = u.socklen;\n    lsopt.backlog = NGX_LISTEN_BACKLOG;\n    lsopt.rcvbuf = -1;\n    lsopt.sndbuf = -1;\n#if (NGX_HAVE_SETFIB)\n    lsopt.setfib = -1;\n#endif\n#if (NGX_HAVE_TCP_FASTOPEN)\n    lsopt.fastopen = -1;\n#endif\n    lsopt.wildcard = u.wildcard;\n#if (NGX_HAVE_INET6 && defined IPV6_V6ONLY)\n    lsopt.ipv6only = 1;\n#endif\n    (void) ngx_sock_ntop(&lsopt.u.sockaddr, lsopt.socklen, lsopt.addr,\n                         NGX_SOCKADDR_STRLEN, 1);\n    for (n = 2; n < cf->args->nelts; n++) {\n        if (ngx_strcmp(value[n].data, "default_server") == 0\n            || ngx_strcmp(value[n].data, "default") == 0)\n        {\n            lsopt.default_server = 1;\n            continue;\n        }\n        if (ngx_strcmp(value[n].data, "bind") == 0) {\n            lsopt.set = 1;\n            lsopt.bind = 1;\n            continue;\n        }\n#if (NGX_HAVE_SETFIB)\n        if (ngx_strncmp(value[n].data, "setfib=", 7) == 0) {\n            lsopt.setfib = ngx_atoi(value[n].data + 7, value[n].len - 7);\n            lsopt.set = 1;\n            lsopt.bind = 1;\n            if (lsopt.setfib == NGX_ERROR) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid setfib \\"%V\\"", &value[n]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n#endif\n#if (NGX_HAVE_TCP_FASTOPEN)\n        if (ngx_strncmp(value[n].data, "fastopen=", 9) == 0) {\n            lsopt.fastopen = ngx_atoi(value[n].data + 9, value[n].len - 9);\n            lsopt.set = 1;\n            lsopt.bind = 1;\n            if (lsopt.fastopen == NGX_ERROR) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid fastopen \\"%V\\"", &value[n]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n#endif\n        if (ngx_strncmp(value[n].data, "backlog=", 8) == 0) {\n            lsopt.backlog = ngx_atoi(value[n].data + 8, value[n].len - 8);\n            lsopt.set = 1;\n            lsopt.bind = 1;\n            if (lsopt.backlog == NGX_ERROR || lsopt.backlog == 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid backlog \\"%V\\"", &value[n]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[n].data, "rcvbuf=", 7) == 0) {\n            size.len = value[n].len - 7;\n            size.data = value[n].data + 7;\n            lsopt.rcvbuf = ngx_parse_size(&size);\n            lsopt.set = 1;\n            lsopt.bind = 1;\n            if (lsopt.rcvbuf == NGX_ERROR) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid rcvbuf \\"%V\\"", &value[n]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[n].data, "sndbuf=", 7) == 0) {\n            size.len = value[n].len - 7;\n            size.data = value[n].data + 7;\n            lsopt.sndbuf = ngx_parse_size(&size);\n            lsopt.set = 1;\n            lsopt.bind = 1;\n            if (lsopt.sndbuf == NGX_ERROR) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid sndbuf \\"%V\\"", &value[n]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[n].data, "accept_filter=", 14) == 0) {\n#if (NGX_HAVE_DEFERRED_ACCEPT && defined SO_ACCEPTFILTER)\n            lsopt.accept_filter = (char *) &value[n].data[14];\n            lsopt.set = 1;\n            lsopt.bind = 1;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "accept filters \\"%V\\" are not supported "\n                               "on this platform, ignored",\n                               &value[n]);\n#endif\n            continue;\n        }\n        if (ngx_strcmp(value[n].data, "deferred") == 0) {\n#if (NGX_HAVE_DEFERRED_ACCEPT && defined TCP_DEFER_ACCEPT)\n            lsopt.deferred_accept = 1;\n            lsopt.set = 1;\n            lsopt.bind = 1;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "the deferred accept is not supported "\n                               "on this platform, ignored");\n#endif\n            continue;\n        }\n        if (ngx_strncmp(value[n].data, "ipv6only=o", 10) == 0) {\n#if (NGX_HAVE_INET6 && defined IPV6_V6ONLY)\n            struct sockaddr  *sa;\n            sa = &lsopt.u.sockaddr;\n            if (sa->sa_family == AF_INET6) {\n                if (ngx_strcmp(&value[n].data[10], "n") == 0) {\n                    lsopt.ipv6only = 1;\n                } else if (ngx_strcmp(&value[n].data[10], "ff") == 0) {\n                    lsopt.ipv6only = 0;\n                } else {\n                    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                       "invalid ipv6only flags \\"%s\\"",\n                                       &value[n].data[9]);\n                    return NGX_CONF_ERROR;\n                }\n                lsopt.set = 1;\n                lsopt.bind = 1;\n            } else {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "ipv6only is not supported "\n                                   "on addr \\"%s\\", ignored", lsopt.addr);\n            }\n            continue;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "ipv6only is not supported "\n                               "on this platform");\n            return NGX_CONF_ERROR;\n#endif\n        }\n        if (ngx_strcmp(value[n].data, "ssl") == 0) {\n#if (NGX_HTTP_SSL)\n            lsopt.ssl = 1;\n            continue;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "the \\"ssl\\" parameter requires "\n                               "ngx_http_ssl_module");\n            return NGX_CONF_ERROR;\n#endif\n        }\n        if (ngx_strcmp(value[n].data, "spdy") == 0) {\n#if (NGX_HTTP_SPDY)\n            lsopt.spdy = 1;\n            continue;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "the \\"spdy\\" parameter requires "\n                               "ngx_http_spdy_module");\n            return NGX_CONF_ERROR;\n#endif\n        }\n        if (ngx_strncmp(value[n].data, "so_keepalive=", 13) == 0) {\n            if (ngx_strcmp(&value[n].data[13], "on") == 0) {\n                lsopt.so_keepalive = 1;\n            } else if (ngx_strcmp(&value[n].data[13], "off") == 0) {\n                lsopt.so_keepalive = 2;\n            } else {\n#if (NGX_HAVE_KEEPALIVE_TUNABLE)\n                u_char     *p, *end;\n                ngx_str_t   s;\n                end = value[n].data + value[n].len;\n                s.data = value[n].data + 13;\n                p = ngx_strlchr(s.data, end, \':\');\n                if (p == NULL) {\n                    p = end;\n                }\n                if (p > s.data) {\n                    s.len = p - s.data;\n                    lsopt.tcp_keepidle = ngx_parse_time(&s, 1);\n                    if (lsopt.tcp_keepidle == (time_t) NGX_ERROR) {\n                        goto invalid_so_keepalive;\n                    }\n                }\n                s.data = (p < end) ? (p + 1) : end;\n                p = ngx_strlchr(s.data, end, \':\');\n                if (p == NULL) {\n                    p = end;\n                }\n                if (p > s.data) {\n                    s.len = p - s.data;\n                    lsopt.tcp_keepintvl = ngx_parse_time(&s, 1);\n                    if (lsopt.tcp_keepintvl == (time_t) NGX_ERROR) {\n                        goto invalid_so_keepalive;\n                    }\n                }\n                s.data = (p < end) ? (p + 1) : end;\n                if (s.data < end) {\n                    s.len = end - s.data;\n                    lsopt.tcp_keepcnt = ngx_atoi(s.data, s.len);\n                    if (lsopt.tcp_keepcnt == NGX_ERROR) {\n                        goto invalid_so_keepalive;\n                    }\n                }\n                if (lsopt.tcp_keepidle == 0 && lsopt.tcp_keepintvl == 0\n                    && lsopt.tcp_keepcnt == 0)\n                {\n                    goto invalid_so_keepalive;\n                }\n                lsopt.so_keepalive = 1;\n#else\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "the \\"so_keepalive\\" parameter accepts "\n                                   "only \\"on\\" or \\"off\\" on this platform");\n                return NGX_CONF_ERROR;\n#endif\n            }\n            lsopt.set = 1;\n            lsopt.bind = 1;\n            continue;\n#if (NGX_HAVE_KEEPALIVE_TUNABLE)\n        invalid_so_keepalive:\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "invalid so_keepalive value: \\"%s\\"",\n                               &value[n].data[13]);\n            return NGX_CONF_ERROR;\n#endif\n        }\n        if (ngx_strcmp(value[n].data, "proxy_protocol") == 0) {\n            lsopt.proxy_protocol = 1;\n            continue;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[n]);\n        return NGX_CONF_ERROR;\n    }\n    if (ngx_http_add_listen(cf, cscf, &lsopt) == NGX_OK) {\n        return NGX_CONF_OK;\n    }\n    return NGX_CONF_ERROR;\n}', "ssize_t\nngx_parse_size(ngx_str_t *line)\n{\n    u_char   unit;\n    size_t   len;\n    ssize_t  size, scale, max;\n    len = line->len;\n    unit = line->data[len - 1];\n    switch (unit) {\n    case 'K':\n    case 'k':\n        len--;\n        max = NGX_MAX_SIZE_T_VALUE / 1024;\n        scale = 1024;\n        break;\n    case 'M':\n    case 'm':\n        len--;\n        max = NGX_MAX_SIZE_T_VALUE / (1024 * 1024);\n        scale = 1024 * 1024;\n        break;\n    default:\n        max = NGX_MAX_SIZE_T_VALUE;\n        scale = 1;\n    }\n    size = ngx_atosz(line->data, len);\n    if (size == NGX_ERROR || size > max) {\n        return NGX_ERROR;\n    }\n    size *= scale;\n    return size;\n}"]