src/http/modules/ngx_http_limit_conn_module.c:728: error: Null Dereference
  pointer `limit` last assigned on line 727 could be null and is dereferenced at line 728, column 5.

src/http/modules/ngx_http_limit_conn_module.c:678:1: start of procedure ngx_http_limit_conn()
676. 
677. 
678. static char *
     ^
679. ngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
680. {

src/http/modules/ngx_http_limit_conn_module.c:682:5: 
680. {
681.     ngx_shm_zone_t               *shm_zone;
682.     ngx_http_limit_conn_conf_t   *lccf = conf;
         ^
683.     ngx_http_limit_conn_limit_t  *limit, *limits;
684. 

src/http/modules/ngx_http_limit_conn_module.c:689:5: 
687.     ngx_uint_t  i;
688. 
689.     value = cf->args->elts;
         ^
690. 
691.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,

src/http/modules/ngx_http_limit_conn_module.c:691:5: Skipping ngx_shared_memory_add(): empty list of specs
689.     value = cf->args->elts;
690. 
691.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
         ^
692.                                      &ngx_http_limit_conn_module);
693.     if (shm_zone == NULL) {

src/http/modules/ngx_http_limit_conn_module.c:693:9: Taking false branch
691.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
692.                                      &ngx_http_limit_conn_module);
693.     if (shm_zone == NULL) {
             ^
694.         return NGX_CONF_ERROR;
695.     }

src/http/modules/ngx_http_limit_conn_module.c:697:5: 
695.     }
696. 
697.     limits = lccf->limits.elts;
         ^
698. 
699.     if (limits == NULL) {

src/http/modules/ngx_http_limit_conn_module.c:699:9: Taking false branch
697.     limits = lccf->limits.elts;
698. 
699.     if (limits == NULL) {
             ^
700.         if (ngx_array_init(&lccf->limits, cf->pool, 1,
701.                            sizeof(ngx_http_limit_conn_limit_t))

src/http/modules/ngx_http_limit_conn_module.c:708:10: 
706.     }
707. 
708.     for (i = 0; i < lccf->limits.nelts; i++) {
              ^
709.         if (shm_zone == limits[i].shm_zone) {
710.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:708:17: Loop condition is true. Entering loop body
706.     }
707. 
708.     for (i = 0; i < lccf->limits.nelts; i++) {
                     ^
709.         if (shm_zone == limits[i].shm_zone) {
710.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:709:13: Taking false branch
707. 
708.     for (i = 0; i < lccf->limits.nelts; i++) {
709.         if (shm_zone == limits[i].shm_zone) {
                 ^
710.             return "is duplicate";
711.         }

src/http/modules/ngx_http_limit_conn_module.c:708:41: 
706.     }
707. 
708.     for (i = 0; i < lccf->limits.nelts; i++) {
                                             ^
709.         if (shm_zone == limits[i].shm_zone) {
710.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:708:17: Loop condition is false. Leaving loop
706.     }
707. 
708.     for (i = 0; i < lccf->limits.nelts; i++) {
                     ^
709.         if (shm_zone == limits[i].shm_zone) {
710.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:714:5: 
712.     }
713. 
714.     n = ngx_atoi(value[2].data, value[2].len);
         ^
715.     if (n <= 0) {
716.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,

src/core/ngx_string.c:851:1: start of procedure ngx_atoi()
  849. 
  850. 
  851. ngx_int_t
       ^
  852. ngx_atoi(u_char *line, size_t n)
  853. {

src/core/ngx_string.c:856:9: Taking false branch
  854.     ngx_int_t  value;
  855. 
  856.     if (n == 0) {
               ^
  857.         return NGX_ERROR;
  858.     }

src/core/ngx_string.c:860:10: 
  858.     }
  859. 
  860.     for (value = 0; n--; line++) {
                ^
  861.         if (*line < '0' || *line > '9') {
  862.             return NGX_ERROR;

src/core/ngx_string.c:860:21: Loop condition is true. Entering loop body
  858.     }
  859. 
  860.     for (value = 0; n--; line++) {
                           ^
  861.         if (*line < '0' || *line > '9') {
  862.             return NGX_ERROR;

src/core/ngx_string.c:861:13: Taking false branch
  859. 
  860.     for (value = 0; n--; line++) {
  861.         if (*line < '0' || *line > '9') {
                   ^
  862.             return NGX_ERROR;
  863.         }

src/core/ngx_string.c:861:28: Taking false branch
  859. 
  860.     for (value = 0; n--; line++) {
  861.         if (*line < '0' || *line > '9') {
                                  ^
  862.             return NGX_ERROR;
  863.         }

src/core/ngx_string.c:865:9: 
  863.         }
  864. 
  865.         value = value * 10 + (*line - '0');
               ^
  866.     }
  867. 

src/core/ngx_string.c:860:26: 
  858.     }
  859. 
  860.     for (value = 0; n--; line++) {
                                ^
  861.         if (*line < '0' || *line > '9') {
  862.             return NGX_ERROR;

src/core/ngx_string.c:860:21: Loop condition is false. Leaving loop
  858.     }
  859. 
  860.     for (value = 0; n--; line++) {
                           ^
  861.         if (*line < '0' || *line > '9') {
  862.             return NGX_ERROR;

src/core/ngx_string.c:868:9: Taking false branch
  866.     }
  867. 
  868.     if (value < 0) {
               ^
  869.         return NGX_ERROR;
  870. 

src/core/ngx_string.c:872:9: 
  870. 
  871.     } else {
  872.         return value;
               ^
  873.     }
  874. }

src/core/ngx_string.c:874:1: return from a call to ngx_atoi
  872.         return value;
  873.     }
  874. }
       ^
  875. 
  876. 

src/http/modules/ngx_http_limit_conn_module.c:715:9: Taking false branch
713. 
714.     n = ngx_atoi(value[2].data, value[2].len);
715.     if (n <= 0) {
             ^
716.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
717.                            "invalid number of connections \"%V\"", &value[2]);

src/http/modules/ngx_http_limit_conn_module.c:721:9: Taking false branch
719.     }
720. 
721.     if (n > 65535) {
             ^
722.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
723.                            "connection limit must be less 65536");

src/http/modules/ngx_http_limit_conn_module.c:727:5: 
725.     }
726. 
727.     limit = ngx_array_push(&lccf->limits);
         ^
728.     limit->conn = n;
729.     limit->shm_zone = shm_zone;

src/core/ngx_array.c:52:1: start of procedure ngx_array_push()
  50. 
  51. 
  52. void *
      ^
  53. ngx_array_push(ngx_array_t *a)
  54. {

src/core/ngx_array.c:59:9: Taking true branch
  57.     ngx_pool_t  *p;
  58. 
  59.     if (a->nelts == a->nalloc) {
              ^
  60. 
  61.         /* the array is full */

src/core/ngx_array.c:63:9: 
  61.         /* the array is full */
  62. 
  63.         size = a->size * a->nalloc;
              ^
  64. 
  65.         p = a->pool;

src/core/ngx_array.c:65:9: 
  63.         size = a->size * a->nalloc;
  64. 
  65.         p = a->pool;
              ^
  66. 
  67.         if ((u_char *) a->elts + size == p->d.last

src/core/ngx_array.c:67:13: Taking false branch
  65.         p = a->pool;
  66. 
  67.         if ((u_char *) a->elts + size == p->d.last
                  ^
  68.             && p->d.last + a->size <= p->d.end)
  69.         {

src/core/ngx_array.c:81:13: Skipping ngx_palloc(): empty list of specs
  79.             /* allocate a new array */
  80. 
  81.             new = ngx_palloc(p, 2 * size);
                  ^
  82.             if (new == NULL) {
  83.                 return NULL;

src/core/ngx_array.c:82:17: Taking true branch
  80. 
  81.             new = ngx_palloc(p, 2 * size);
  82.             if (new == NULL) {
                      ^
  83.                 return NULL;
  84.             }

src/core/ngx_array.c:83:17: 
  81.             new = ngx_palloc(p, 2 * size);
  82.             if (new == NULL) {
  83.                 return NULL;
                      ^
  84.             }
  85. 

src/core/ngx_array.c:96:1: return from a call to ngx_array_push
  94. 
  95.     return elt;
  96. }
      ^
  97. 
  98. 

src/http/modules/ngx_http_limit_conn_module.c:728:5: 
726. 
727.     limit = ngx_array_push(&lccf->limits);
728.     limit->conn = n;
         ^
729.     limit->shm_zone = shm_zone;
730. 

static char *
ngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    ngx_shm_zone_t               *shm_zone;
    ngx_http_limit_conn_conf_t   *lccf = conf;
    ngx_http_limit_conn_limit_t  *limit, *limits;
    ngx_str_t  *value;
    ngx_int_t   n;
    ngx_uint_t  i;
    value = cf->args->elts;
    shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
                                     &ngx_http_limit_conn_module);
    if (shm_zone == NULL) {
        return NGX_CONF_ERROR;
    }
    limits = lccf->limits.elts;
    if (limits == NULL) {
        if (ngx_array_init(&lccf->limits, cf->pool, 1,
                           sizeof(ngx_http_limit_conn_limit_t))
            != NGX_OK)
        {
            return NGX_CONF_ERROR;
        }
    }
    for (i = 0; i < lccf->limits.nelts; i++) {
        if (shm_zone == limits[i].shm_zone) {
            return "is duplicate";
        }
    }
    n = ngx_atoi(value[2].data, value[2].len);
    if (n <= 0) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "invalid number of connections \"%V\"", &value[2]);
        return NGX_CONF_ERROR;
    }
    if (n > 65535) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "connection limit must be less 65536");
        return NGX_CONF_ERROR;
    }
    limit = ngx_array_push(&lccf->limits);
    limit->conn = n;
    limit->shm_zone = shm_zone;
    return NGX_CONF_OK;
}
['static char *\nngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_shm_zone_t               *shm_zone;\n    ngx_http_limit_conn_conf_t   *lccf = conf;\n    ngx_http_limit_conn_limit_t  *limit, *limits;\n    ngx_str_t  *value;\n    ngx_int_t   n;\n    ngx_uint_t  i;\n    value = cf->args->elts;\n    shm_zone = ngx_shared_memory_add(cf, &value[1], 0,\n                                     &ngx_http_limit_conn_module);\n    if (shm_zone == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    limits = lccf->limits.elts;\n    if (limits == NULL) {\n        if (ngx_array_init(&lccf->limits, cf->pool, 1,\n                           sizeof(ngx_http_limit_conn_limit_t))\n            != NGX_OK)\n        {\n            return NGX_CONF_ERROR;\n        }\n    }\n    for (i = 0; i < lccf->limits.nelts; i++) {\n        if (shm_zone == limits[i].shm_zone) {\n            return "is duplicate";\n        }\n    }\n    n = ngx_atoi(value[2].data, value[2].len);\n    if (n <= 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid number of connections \\"%V\\"", &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (n > 65535) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "connection limit must be less 65536");\n        return NGX_CONF_ERROR;\n    }\n    limit = ngx_array_push(&lccf->limits);\n    limit->conn = n;\n    limit->shm_zone = shm_zone;\n    return NGX_CONF_OK;\n}', "ngx_int_t\nngx_atoi(u_char *line, size_t n)\n{\n    ngx_int_t  value;\n    if (n == 0) {\n        return NGX_ERROR;\n    }\n    for (value = 0; n--; line++) {\n        if (*line < '0' || *line > '9') {\n            return NGX_ERROR;\n        }\n        value = value * 10 + (*line - '0');\n    }\n    if (value < 0) {\n        return NGX_ERROR;\n    } else {\n        return value;\n    }\n}", 'void *\nngx_array_push(ngx_array_t *a)\n{\n    void        *elt, *new;\n    size_t       size;\n    ngx_pool_t  *p;\n    if (a->nelts == a->nalloc) {\n        size = a->size * a->nalloc;\n        p = a->pool;\n        if ((u_char *) a->elts + size == p->d.last\n            && p->d.last + a->size <= p->d.end)\n        {\n            p->d.last += a->size;\n            a->nalloc++;\n        } else {\n            new = ngx_palloc(p, 2 * size);\n            if (new == NULL) {\n                return NULL;\n            }\n            ngx_memcpy(new, a->elts, size);\n            a->elts = new;\n            a->nalloc *= 2;\n        }\n    }\n    elt = (u_char *) a->elts + a->size * a->nelts;\n    a->nelts++;\n    return elt;\n}']