src/http/ngx_http_upstream.c:812: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64 by call to `ngx_http_upstream_finalize_request`.

src/http/ngx_http_upstream.c:812:9: Call
810.                       ngx_resolver_strerror(ctx->state));
811. 
812.         ngx_http_upstream_finalize_request(r, u, NGX_HTTP_BAD_GATEWAY);
             ^
813.         return;
814.     }

src/http/ngx_http_upstream.c:2843:1: Parameter `r->uri.len`
  2841. 
  2842. 
  2843. static void
        ^
  2844. ngx_http_upstream_finalize_request(ngx_http_request_t *r,
  2845.     ngx_http_upstream_t *u, ngx_int_t rc)

src/http/ngx_http_upstream.c:2952:5: Call
  2950.     }
  2951. 
  2952.     ngx_http_finalize_request(r, rc);
            ^
  2953. }
  2954. 

src/http/ngx_http_request.c:1847:1: Parameter `r->uri.len`
    1845. 
    1846. 
    1847. void
          ^
    1848. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
    1849. {

src/http/ngx_http_request.c:1920:38: Call
    1918.         c->write->handler = ngx_http_request_handler;
    1919. 
    1920.         ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));
                                               ^
    1921.         return;
    1922.     }

src/http/ngx_http_special_response.c:333:1: Parameter `r->uri.len`
      331. 
      332. 
      333. ngx_int_t
           ^
      334. ngx_http_special_response_handler(ngx_http_request_t *r, ngx_int_t error)
      335. {

src/http/ngx_http_special_response.c:383:24: Call
      381.         for (i = 0; i < clcf->error_pages->nelts; i++) {
      382.             if (err_page[i].status == error) {
      383.                 return ngx_http_send_error_page(r, &err_page[i]);
                                  ^
      384.             }
      385.         }

src/http/ngx_http_special_response.c:504:1: Parameter `r->uri.len`
        502. 
        503. 
        504. static ngx_int_t
             ^
        505. ngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)
        506. {

src/http/ngx_http_special_response.c:540:16: Call
        538.         }
        539. 
        540.         return ngx_http_internal_redirect(r, &uri, &args);
                            ^
        541.     }
        542. 

src/http/ngx_http_core_module.c:2172:1: Parameter `r->uri.len`
          2170. 
          2171. 
          2172. ngx_int_t
                ^
          2173. ngx_http_internal_redirect(ngx_http_request_t *r,
          2174.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2203:5: Call
          2201.                    "internal redirect: \"%V?%V\"", uri, &r->args);
          2202. 
          2203.     ngx_http_set_exten(r);
                    ^
          2204. 
          2205.     /* clear the modules contexts */

src/http/ngx_http_core_module.c:1681:1: <LHS trace>
1679. 
1680. 
1681. void
      ^
1682. ngx_http_set_exten(ngx_http_request_t *r)
1683. {

src/http/ngx_http_core_module.c:1681:1: Parameter `r->uri.len`
            1679. 
            1680. 
            1681. void
                  ^
            1682. ngx_http_set_exten(ngx_http_request_t *r)
            1683. {

src/http/ngx_http_core_module.c:1689:10: Binary operation: ([0, +oo] - 1):unsigned64 by call to `ngx_http_upstream_finalize_request` 
            1687.     r->exten.data = NULL;
            1688. 
            1689.     for (i = r->uri.len - 1; i > 1; i--) {
                           ^
            1690.         if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {
            1691. 

void
ngx_http_set_exten(ngx_http_request_t *r)
{
    ngx_int_t  i;
    r->exten.len = 0;
    r->exten.data = NULL;
    for (i = r->uri.len - 1; i > 1; i--) {
        if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {
            r->exten.len = r->uri.len - i - 1;
            r->exten.data = &r->uri.data[i + 1];
            return;
        } else if (r->uri.data[i] == '/') {
            return;
        }
    }
    return;
}
['static void\nngx_http_upstream_resolve_handler(ngx_resolver_ctx_t *ctx)\n{\n    ngx_http_request_t            *r;\n    ngx_http_upstream_t           *u;\n    ngx_http_upstream_resolved_t  *ur;\n    r = ctx->data;\n    u = r->upstream;\n    ur = u->resolved;\n    if (ctx->state) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "%V could not be resolved (%i: %s)",\n                      &ctx->name, ctx->state,\n                      ngx_resolver_strerror(ctx->state));\n        ngx_http_upstream_finalize_request(r, u, NGX_HTTP_BAD_GATEWAY);\n        return;\n    }\n    ur->naddrs = ctx->naddrs;\n    ur->addrs = ctx->addrs;\n#if (NGX_DEBUG)\n    {\n    in_addr_t   addr;\n    ngx_uint_t  i;\n    for (i = 0; i < ctx->naddrs; i++) {\n        addr = ntohl(ur->addrs[i]);\n        ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "name was resolved to %ud.%ud.%ud.%ud",\n                       (addr >> 24) & 0xff, (addr >> 16) & 0xff,\n                       (addr >> 8) & 0xff, addr & 0xff);\n    }\n    }\n#endif\n    if (ngx_http_upstream_create_round_robin_peer(r, ur) != NGX_OK) {\n        ngx_http_upstream_finalize_request(r, u,\n                                           NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    ngx_resolve_name_done(ctx);\n    ur->ctx = NULL;\n    ngx_http_upstream_connect(r, u);\n}', 'static void\nngx_http_upstream_finalize_request(ngx_http_request_t *r,\n    ngx_http_upstream_t *u, ngx_int_t rc)\n{\n    ngx_time_t  *tp;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "finalize http upstream request: %i", rc);\n    if (u->cleanup) {\n        *u->cleanup = NULL;\n    }\n    if (u->resolved && u->resolved->ctx) {\n        ngx_resolve_name_done(u->resolved->ctx);\n        u->resolved->ctx = NULL;\n    }\n    if (u->state && u->state->response_sec) {\n        tp = ngx_timeofday();\n        u->state->response_sec = tp->sec - u->state->response_sec;\n        u->state->response_msec = tp->msec - u->state->response_msec;\n        if (u->pipe) {\n            u->state->response_length = u->pipe->read_length;\n        }\n    }\n    u->finalize_request(r, rc);\n    if (u->peer.free) {\n        u->peer.free(&u->peer, u->peer.data, 0);\n    }\n    if (u->peer.connection) {\n#if (NGX_HTTP_SSL)\n        if (u->peer.connection->ssl) {\n            u->peer.connection->ssl->no_wait_shutdown = 1;\n            (void) ngx_ssl_shutdown(u->peer.connection);\n        }\n#endif\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "close http upstream connection: %d",\n                       u->peer.connection->fd);\n        ngx_close_connection(u->peer.connection);\n    }\n    u->peer.connection = NULL;\n    if (u->pipe && u->pipe->temp_file) {\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream temp fd: %d",\n                       u->pipe->temp_file->file.fd);\n    }\n#if (NGX_HTTP_CACHE)\n    if (u->cacheable && r->cache) {\n        time_t  valid;\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream cache fd: %d",\n                       r->cache->file.fd);\n        if (rc == NGX_HTTP_BAD_GATEWAY || rc == NGX_HTTP_GATEWAY_TIME_OUT) {\n            valid = ngx_http_file_cache_valid(u->conf->cache_valid, rc);\n            if (valid) {\n                r->cache->valid_sec = ngx_time() + valid;\n                r->cache->error = rc;\n            }\n        }\n        ngx_http_file_cache_free(r, u->pipe->temp_file);\n    }\n#endif\n    if (u->header_sent\n        && (rc == NGX_ERROR || rc >= NGX_HTTP_SPECIAL_RESPONSE))\n    {\n        rc = 0;\n    }\n    if (rc == NGX_DECLINED) {\n        return;\n    }\n    r->connection->log->action = "sending to client";\n    if (rc == 0) {\n        rc = ngx_http_send_special(r, NGX_HTTP_LAST);\n    }\n    ngx_http_finalize_request(r, rc);\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %d, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n        return;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        if (r->main->blocked) {\n            r->write_event_handler = ngx_http_request_finalizer;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n#if (NGX_DEBUG)\n        if (r != c->data) {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n        }\n#endif\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed || r->blocked) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'ngx_int_t\nngx_http_special_response_handler(ngx_http_request_t *r, ngx_int_t error)\n{\n    ngx_uint_t                 i, err;\n    ngx_http_err_page_t       *err_page;\n    ngx_http_core_loc_conf_t  *clcf;\n    ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http special response: %d, \\"%V?%V\\"",\n                   error, &r->uri, &r->args);\n    r->err_status = error;\n    if (r->keepalive) {\n        switch (error) {\n            case NGX_HTTP_BAD_REQUEST:\n            case NGX_HTTP_REQUEST_ENTITY_TOO_LARGE:\n            case NGX_HTTP_REQUEST_URI_TOO_LARGE:\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n            case NGX_HTTP_INTERNAL_SERVER_ERROR:\n                r->keepalive = 0;\n        }\n    }\n    if (r->lingering_close == 1) {\n        switch (error) {\n            case NGX_HTTP_BAD_REQUEST:\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n                r->lingering_close = 0;\n        }\n    }\n    r->headers_out.content_type.len = 0;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (!r->error_page && clcf->error_pages && r->uri_changes != 0) {\n        if (clcf->recursive_error_pages == 0) {\n            r->error_page = 1;\n        }\n        err_page = clcf->error_pages->elts;\n        for (i = 0; i < clcf->error_pages->nelts; i++) {\n            if (err_page[i].status == error) {\n                return ngx_http_send_error_page(r, &err_page[i]);\n            }\n        }\n    }\n    r->expect_tested = 1;\n    if (ngx_http_discard_request_body(r) != NGX_OK) {\n        error = NGX_HTTP_INTERNAL_SERVER_ERROR;\n    }\n    if (clcf->msie_refresh\n        && r->headers_in.msie\n        && (error == NGX_HTTP_MOVED_PERMANENTLY\n            || error == NGX_HTTP_MOVED_TEMPORARILY))\n    {\n        return ngx_http_send_refresh(r);\n    }\n    if (error == NGX_HTTP_CREATED) {\n        err = 0;\n        r->header_only = 1;\n    } else if (error == NGX_HTTP_NO_CONTENT) {\n        err = 0;\n    } else if (error >= NGX_HTTP_MOVED_PERMANENTLY\n               && error < NGX_HTTP_LAST_LEVEL_300)\n    {\n        err = error - NGX_HTTP_MOVED_PERMANENTLY + NGX_HTTP_LEVEL_200;\n    } else if (error >= NGX_HTTP_BAD_REQUEST\n               && error < NGX_HTTP_LAST_LEVEL_400)\n    {\n        err = error - NGX_HTTP_BAD_REQUEST + NGX_HTTP_LEVEL_200\n                                           + NGX_HTTP_LEVEL_300;\n    } else if (error >= NGX_HTTP_OWN_CODES\n               && error < NGX_HTTP_LAST_LEVEL_500)\n    {\n        err = error - NGX_HTTP_OWN_CODES + NGX_HTTP_LEVEL_200\n                                         + NGX_HTTP_LEVEL_300\n                                         + NGX_HTTP_LEVEL_400;\n        switch (error) {\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n                r->err_status = NGX_HTTP_BAD_REQUEST;\n                break;\n        }\n    } else {\n        err = 0;\n    }\n    return ngx_http_send_special_response(r, clcf, err);\n}', 'static ngx_int_t\nngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)\n{\n    ngx_int_t                  overwrite;\n    ngx_str_t                  uri, args;\n    ngx_table_elt_t           *location;\n    ngx_http_core_loc_conf_t  *clcf;\n    overwrite = err_page->overwrite;\n    if (overwrite && overwrite != NGX_HTTP_OK) {\n        r->expect_tested = 1;\n    }\n    r->err_status = overwrite;\n    r->zero_in_uri = 0;\n    if (ngx_http_complex_value(r, &err_page->value, &uri) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (uri.data[0] == \'/\') {\n        if (err_page->value.lengths) {\n            ngx_http_split_args(r, &uri, &args);\n        } else {\n            args = err_page->args;\n        }\n        if (r->method != NGX_HTTP_HEAD) {\n            r->method = NGX_HTTP_GET;\n            r->method_name = ngx_http_get_name;\n        }\n        return ngx_http_internal_redirect(r, &uri, &args);\n    }\n    if (uri.data[0] == \'@\') {\n        return ngx_http_named_location(r, &uri);\n    }\n    location = ngx_list_push(&r->headers_out.headers);\n    if (location == NULL) {\n        return NGX_ERROR;\n    }\n    r->err_status = NGX_HTTP_MOVED_TEMPORARILY;\n    location->hash = 1;\n    location->key.len = sizeof("Location") - 1;\n    location->key.data = (u_char *) "Location";\n    location->value = uri;\n    r->headers_out.location = location;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->msie_refresh && r->headers_in.msie) {\n        return ngx_http_send_refresh(r);\n    }\n    return ngx_http_send_special_response(r, clcf, NGX_HTTP_MOVED_TEMPORARILY\n                                                   - NGX_HTTP_MOVED_PERMANENTLY\n                                                   + NGX_HTTP_LEVEL_200);\n}', 'ngx_int_t\nngx_http_internal_redirect(ngx_http_request_t *r,\n    ngx_str_t *uri, ngx_str_t *args)\n{\n    ngx_http_core_srv_conf_t  *cscf;\n    r->uri_changes--;\n    if (r->uri_changes == 0) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "rewrite or internal redirection cycle "\n                      "while internal redirect to \\"%V\\"", uri);\n        r->main->count++;\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return NGX_DONE;\n    }\n    r->uri = *uri;\n    if (args) {\n        r->args = *args;\n    } else {\n        r->args.len = 0;\n        r->args.data = NULL;\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "internal redirect: \\"%V?%V\\"", uri, &r->args);\n    ngx_http_set_exten(r);\n    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    r->loc_conf = cscf->ctx->loc_conf;\n    ngx_http_update_location_config(r);\n#if (NGX_HTTP_CACHE)\n    r->cache = NULL;\n#endif\n    r->internal = 1;\n    r->main->count++;\n    ngx_http_handler(r);\n    return NGX_DONE;\n}', "void\nngx_http_set_exten(ngx_http_request_t *r)\n{\n    ngx_int_t  i;\n    r->exten.len = 0;\n    r->exten.data = NULL;\n    for (i = r->uri.len - 1; i > 1; i--) {\n        if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {\n            r->exten.len = r->uri.len - i - 1;\n            r->exten.data = &r->uri.data[i + 1];\n            return;\n        } else if (r->uri.data[i] == '/') {\n            return;\n        }\n    }\n    return;\n}"]