src/http/modules/ngx_http_limit_conn_module.c:729: error: Null Dereference
  pointer `limit` last assigned on line 728 could be null and is dereferenced at line 729, column 5.

src/http/modules/ngx_http_limit_conn_module.c:679:1: start of procedure ngx_http_limit_conn()
677. 
678. 
679. static char *
     ^
680. ngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
681. {

src/http/modules/ngx_http_limit_conn_module.c:683:5: 
681. {
682.     ngx_shm_zone_t               *shm_zone;
683.     ngx_http_limit_conn_conf_t   *lccf = conf;
         ^
684.     ngx_http_limit_conn_limit_t  *limit, *limits;
685. 

src/http/modules/ngx_http_limit_conn_module.c:690:5: 
688.     ngx_uint_t  i;
689. 
690.     value = cf->args->elts;
         ^
691. 
692.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,

src/http/modules/ngx_http_limit_conn_module.c:692:5: Skipping ngx_shared_memory_add(): empty list of specs
690.     value = cf->args->elts;
691. 
692.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
         ^
693.                                      &ngx_http_limit_conn_module);
694.     if (shm_zone == NULL) {

src/http/modules/ngx_http_limit_conn_module.c:694:9: Taking false branch
692.     shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
693.                                      &ngx_http_limit_conn_module);
694.     if (shm_zone == NULL) {
             ^
695.         return NGX_CONF_ERROR;
696.     }

src/http/modules/ngx_http_limit_conn_module.c:698:5: 
696.     }
697. 
698.     limits = lccf->limits.elts;
         ^
699. 
700.     if (limits == NULL) {

src/http/modules/ngx_http_limit_conn_module.c:700:9: Taking false branch
698.     limits = lccf->limits.elts;
699. 
700.     if (limits == NULL) {
             ^
701.         if (ngx_array_init(&lccf->limits, cf->pool, 1,
702.                            sizeof(ngx_http_limit_conn_limit_t))

src/http/modules/ngx_http_limit_conn_module.c:709:10: 
707.     }
708. 
709.     for (i = 0; i < lccf->limits.nelts; i++) {
              ^
710.         if (shm_zone == limits[i].shm_zone) {
711.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:709:17: Loop condition is true. Entering loop body
707.     }
708. 
709.     for (i = 0; i < lccf->limits.nelts; i++) {
                     ^
710.         if (shm_zone == limits[i].shm_zone) {
711.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:710:13: Taking false branch
708. 
709.     for (i = 0; i < lccf->limits.nelts; i++) {
710.         if (shm_zone == limits[i].shm_zone) {
                 ^
711.             return "is duplicate";
712.         }

src/http/modules/ngx_http_limit_conn_module.c:709:41: 
707.     }
708. 
709.     for (i = 0; i < lccf->limits.nelts; i++) {
                                             ^
710.         if (shm_zone == limits[i].shm_zone) {
711.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:709:17: Loop condition is false. Leaving loop
707.     }
708. 
709.     for (i = 0; i < lccf->limits.nelts; i++) {
                     ^
710.         if (shm_zone == limits[i].shm_zone) {
711.             return "is duplicate";

src/http/modules/ngx_http_limit_conn_module.c:715:5: 
713.     }
714. 
715.     n = ngx_atoi(value[2].data, value[2].len);
         ^
716.     if (n <= 0) {
717.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,

src/core/ngx_string.c:852:1: start of procedure ngx_atoi()
  850. 
  851. 
  852. ngx_int_t
       ^
  853. ngx_atoi(u_char *line, size_t n)
  854. {

src/core/ngx_string.c:857:9: Taking false branch
  855.     ngx_int_t  value;
  856. 
  857.     if (n == 0) {
               ^
  858.         return NGX_ERROR;
  859.     }

src/core/ngx_string.c:861:10: 
  859.     }
  860. 
  861.     for (value = 0; n--; line++) {
                ^
  862.         if (*line < '0' || *line > '9') {
  863.             return NGX_ERROR;

src/core/ngx_string.c:861:21: Loop condition is true. Entering loop body
  859.     }
  860. 
  861.     for (value = 0; n--; line++) {
                           ^
  862.         if (*line < '0' || *line > '9') {
  863.             return NGX_ERROR;

src/core/ngx_string.c:862:13: Taking false branch
  860. 
  861.     for (value = 0; n--; line++) {
  862.         if (*line < '0' || *line > '9') {
                   ^
  863.             return NGX_ERROR;
  864.         }

src/core/ngx_string.c:862:28: Taking false branch
  860. 
  861.     for (value = 0; n--; line++) {
  862.         if (*line < '0' || *line > '9') {
                                  ^
  863.             return NGX_ERROR;
  864.         }

src/core/ngx_string.c:866:9: 
  864.         }
  865. 
  866.         value = value * 10 + (*line - '0');
               ^
  867.     }
  868. 

src/core/ngx_string.c:861:26: 
  859.     }
  860. 
  861.     for (value = 0; n--; line++) {
                                ^
  862.         if (*line < '0' || *line > '9') {
  863.             return NGX_ERROR;

src/core/ngx_string.c:861:21: Loop condition is false. Leaving loop
  859.     }
  860. 
  861.     for (value = 0; n--; line++) {
                           ^
  862.         if (*line < '0' || *line > '9') {
  863.             return NGX_ERROR;

src/core/ngx_string.c:869:9: Taking false branch
  867.     }
  868. 
  869.     if (value < 0) {
               ^
  870.         return NGX_ERROR;
  871. 

src/core/ngx_string.c:873:9: 
  871. 
  872.     } else {
  873.         return value;
               ^
  874.     }
  875. }

src/core/ngx_string.c:875:1: return from a call to ngx_atoi
  873.         return value;
  874.     }
  875. }
       ^
  876. 
  877. 

src/http/modules/ngx_http_limit_conn_module.c:716:9: Taking false branch
714. 
715.     n = ngx_atoi(value[2].data, value[2].len);
716.     if (n <= 0) {
             ^
717.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
718.                            "invalid number of connections \"%V\"", &value[2]);

src/http/modules/ngx_http_limit_conn_module.c:722:9: Taking false branch
720.     }
721. 
722.     if (n > 65535) {
             ^
723.         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
724.                            "connection limit must be less 65536");

src/http/modules/ngx_http_limit_conn_module.c:728:5: 
726.     }
727. 
728.     limit = ngx_array_push(&lccf->limits);
         ^
729.     limit->conn = n;
730.     limit->shm_zone = shm_zone;

src/core/ngx_array.c:53:1: start of procedure ngx_array_push()
  51. 
  52. 
  53. void *
      ^
  54. ngx_array_push(ngx_array_t *a)
  55. {

src/core/ngx_array.c:60:9: Taking true branch
  58.     ngx_pool_t  *p;
  59. 
  60.     if (a->nelts == a->nalloc) {
              ^
  61. 
  62.         /* the array is full */

src/core/ngx_array.c:64:9: 
  62.         /* the array is full */
  63. 
  64.         size = a->size * a->nalloc;
              ^
  65. 
  66.         p = a->pool;

src/core/ngx_array.c:66:9: 
  64.         size = a->size * a->nalloc;
  65. 
  66.         p = a->pool;
              ^
  67. 
  68.         if ((u_char *) a->elts + size == p->d.last

src/core/ngx_array.c:68:13: Taking false branch
  66.         p = a->pool;
  67. 
  68.         if ((u_char *) a->elts + size == p->d.last
                  ^
  69.             && p->d.last + a->size <= p->d.end)
  70.         {

src/core/ngx_array.c:82:13: Skipping ngx_palloc(): empty list of specs
  80.             /* allocate a new array */
  81. 
  82.             new = ngx_palloc(p, 2 * size);
                  ^
  83.             if (new == NULL) {
  84.                 return NULL;

src/core/ngx_array.c:83:17: Taking true branch
  81. 
  82.             new = ngx_palloc(p, 2 * size);
  83.             if (new == NULL) {
                      ^
  84.                 return NULL;
  85.             }

src/core/ngx_array.c:84:17: 
  82.             new = ngx_palloc(p, 2 * size);
  83.             if (new == NULL) {
  84.                 return NULL;
                      ^
  85.             }
  86. 

src/core/ngx_array.c:97:1: return from a call to ngx_array_push
  95. 
  96.     return elt;
  97. }
      ^
  98. 
  99. 

src/http/modules/ngx_http_limit_conn_module.c:729:5: 
727. 
728.     limit = ngx_array_push(&lccf->limits);
729.     limit->conn = n;
         ^
730.     limit->shm_zone = shm_zone;
731. 

static char *
ngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    ngx_shm_zone_t               *shm_zone;
    ngx_http_limit_conn_conf_t   *lccf = conf;
    ngx_http_limit_conn_limit_t  *limit, *limits;
    ngx_str_t  *value;
    ngx_int_t   n;
    ngx_uint_t  i;
    value = cf->args->elts;
    shm_zone = ngx_shared_memory_add(cf, &value[1], 0,
                                     &ngx_http_limit_conn_module);
    if (shm_zone == NULL) {
        return NGX_CONF_ERROR;
    }
    limits = lccf->limits.elts;
    if (limits == NULL) {
        if (ngx_array_init(&lccf->limits, cf->pool, 1,
                           sizeof(ngx_http_limit_conn_limit_t))
            != NGX_OK)
        {
            return NGX_CONF_ERROR;
        }
    }
    for (i = 0; i < lccf->limits.nelts; i++) {
        if (shm_zone == limits[i].shm_zone) {
            return "is duplicate";
        }
    }
    n = ngx_atoi(value[2].data, value[2].len);
    if (n <= 0) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "invalid number of connections \"%V\"", &value[2]);
        return NGX_CONF_ERROR;
    }
    if (n > 65535) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "connection limit must be less 65536");
        return NGX_CONF_ERROR;
    }
    limit = ngx_array_push(&lccf->limits);
    limit->conn = n;
    limit->shm_zone = shm_zone;
    return NGX_CONF_OK;
}
['static char *\nngx_http_limit_conn(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_shm_zone_t               *shm_zone;\n    ngx_http_limit_conn_conf_t   *lccf = conf;\n    ngx_http_limit_conn_limit_t  *limit, *limits;\n    ngx_str_t  *value;\n    ngx_int_t   n;\n    ngx_uint_t  i;\n    value = cf->args->elts;\n    shm_zone = ngx_shared_memory_add(cf, &value[1], 0,\n                                     &ngx_http_limit_conn_module);\n    if (shm_zone == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    limits = lccf->limits.elts;\n    if (limits == NULL) {\n        if (ngx_array_init(&lccf->limits, cf->pool, 1,\n                           sizeof(ngx_http_limit_conn_limit_t))\n            != NGX_OK)\n        {\n            return NGX_CONF_ERROR;\n        }\n    }\n    for (i = 0; i < lccf->limits.nelts; i++) {\n        if (shm_zone == limits[i].shm_zone) {\n            return "is duplicate";\n        }\n    }\n    n = ngx_atoi(value[2].data, value[2].len);\n    if (n <= 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid number of connections \\"%V\\"", &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (n > 65535) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "connection limit must be less 65536");\n        return NGX_CONF_ERROR;\n    }\n    limit = ngx_array_push(&lccf->limits);\n    limit->conn = n;\n    limit->shm_zone = shm_zone;\n    return NGX_CONF_OK;\n}', "ngx_int_t\nngx_atoi(u_char *line, size_t n)\n{\n    ngx_int_t  value;\n    if (n == 0) {\n        return NGX_ERROR;\n    }\n    for (value = 0; n--; line++) {\n        if (*line < '0' || *line > '9') {\n            return NGX_ERROR;\n        }\n        value = value * 10 + (*line - '0');\n    }\n    if (value < 0) {\n        return NGX_ERROR;\n    } else {\n        return value;\n    }\n}", 'void *\nngx_array_push(ngx_array_t *a)\n{\n    void        *elt, *new;\n    size_t       size;\n    ngx_pool_t  *p;\n    if (a->nelts == a->nalloc) {\n        size = a->size * a->nalloc;\n        p = a->pool;\n        if ((u_char *) a->elts + size == p->d.last\n            && p->d.last + a->size <= p->d.end)\n        {\n            p->d.last += a->size;\n            a->nalloc++;\n        } else {\n            new = ngx_palloc(p, 2 * size);\n            if (new == NULL) {\n                return NULL;\n            }\n            ngx_memcpy(new, a->elts, size);\n            a->elts = new;\n            a->nalloc *= 2;\n        }\n    }\n    elt = (u_char *) a->elts + a->size * a->nelts;\n    a->nelts++;\n    return elt;\n}']