src/http/ngx_http_core_module.c:1311: error: Integer Overflow L2
  ([0, -1+max(1, `r->uri_changes`)] - 1):unsigned32 by call to `ngx_http_finalize_request`.

src/http/ngx_http_core_module.c:1176:1: Parameter `r->uri_changes`
1174. 
1175. 
1176. ngx_int_t
      ^
1177. ngx_http_core_try_files_phase(ngx_http_request_t *r,
1178.     ngx_http_phase_handler_t *ph)

src/http/ngx_http_core_module.c:1303:24: Call
1301. 
1302.             if (path.data[0] == '@') {
1303.                 (void) ngx_http_named_location(r, &path);
                             ^
1304. 
1305.             } else {

src/http/ngx_http_core_module.c:2551:1: Parameter `r->uri_changes`
  2549. 
  2550. 
  2551. ngx_int_t
        ^
  2552. ngx_http_named_location(ngx_http_request_t *r, ngx_str_t *name)
  2553. {

src/http/ngx_http_core_module.c:2559:5: Assignment
  2557. 
  2558.     r->main->count++;
  2559.     r->uri_changes--;
            ^
  2560. 
  2561.     if (r->uri_changes == 0) {

src/http/ngx_http_core_module.c:1311:13: Call
1309.             }
1310. 
1311.             ngx_http_finalize_request(r, NGX_DONE);
                  ^
1312.             return NGX_OK;
1313.         }

src/http/ngx_http_request.c:1916:1: Parameter `r->uri_changes`
  1914. 
  1915. 
  1916. void
        ^
  1917. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
  1918. {

src/http/ngx_http_request.c:2088:9: Call
  2086.     }
  2087. 
  2088.     if (ngx_http_post_action(r) == NGX_OK) {
                ^
  2089.         return;
  2090.     }

src/http/ngx_http_request.c:2924:1: Parameter `r->uri_changes`
    2922. 
    2923. 
    2924. static ngx_int_t
          ^
    2925. ngx_http_post_action(ngx_http_request_t *r)
    2926. {

src/http/ngx_http_request.c:2951:9: Call
    2949. 
    2950.     if (clcf->post_action.data[0] == '/') {
    2951.         ngx_http_internal_redirect(r, &clcf->post_action, NULL);
                  ^
    2952. 
    2953.     } else {

src/http/ngx_http_core_module.c:2496:1: <LHS trace>
2494. 
2495. 
2496. ngx_int_t
      ^
2497. ngx_http_internal_redirect(ngx_http_request_t *r,
2498.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2496:1: Parameter `r->uri_changes`
      2494. 
      2495. 
      2496. ngx_int_t
            ^
      2497. ngx_http_internal_redirect(ngx_http_request_t *r,
      2498.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2502:5: Binary operation: ([0, -1+max(1, r->uri_changes)] - 1):unsigned32 by call to `ngx_http_finalize_request` 
      2500.     ngx_http_core_srv_conf_t  *cscf;
      2501. 
      2502.     r->uri_changes--;
                ^
      2503. 
      2504.     if (r->uri_changes == 0) {

ngx_int_t
ngx_http_internal_redirect(ngx_http_request_t *r,
    ngx_str_t *uri, ngx_str_t *args)
{
    ngx_http_core_srv_conf_t  *cscf;
    r->uri_changes--;
    if (r->uri_changes == 0) {
        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                      "rewrite or internal redirection cycle "
                      "while internally redirecting to \"%V\"", uri);
        r->main->count++;
        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return NGX_DONE;
    }
    r->uri = *uri;
    if (args) {
        r->args = *args;
    } else {
        ngx_str_null(&r->args);
    }
    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                   "internal redirect: \"%V?%V\"", uri, &r->args);
    ngx_http_set_exten(r);
    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);
    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
    r->loc_conf = cscf->ctx->loc_conf;
    ngx_http_update_location_config(r);
#if (NGX_HTTP_CACHE)
    r->cache = NULL;
#endif
    r->internal = 1;
    r->valid_unparsed_uri = 0;
    r->add_uri_to_alias = 0;
    r->main->count++;
    ngx_http_handler(r);
    return NGX_DONE;
}
['ngx_int_t\nngx_http_core_try_files_phase(ngx_http_request_t *r,\n    ngx_http_phase_handler_t *ph)\n{\n    size_t                        len, root, alias, reserve, allocated;\n    u_char                       *p, *name;\n    ngx_str_t                     path, args;\n    ngx_uint_t                    test_dir;\n    ngx_http_try_file_t          *tf;\n    ngx_open_file_info_t          of;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_engine_t      e;\n    ngx_http_core_loc_conf_t     *clcf;\n    ngx_http_script_len_code_pt   lcode;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "try files phase: %ui", r->phase_handler);\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->try_files == NULL) {\n        r->phase_handler++;\n        return NGX_AGAIN;\n    }\n    allocated = 0;\n    root = 0;\n    name = NULL;\n    path.data = NULL;\n    tf = clcf->try_files;\n    alias = clcf->alias;\n    for ( ;; ) {\n        if (tf->lengths) {\n            ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n            e.ip = tf->lengths->elts;\n            e.request = r;\n            len = 1;\n            while (*(uintptr_t *) e.ip) {\n                lcode = *(ngx_http_script_len_code_pt *) e.ip;\n                len += lcode(&e);\n            }\n        } else {\n            len = tf->name.len;\n        }\n        if (!alias) {\n            reserve = len > r->uri.len ? len - r->uri.len : 0;\n#if (NGX_PCRE)\n        } else if (clcf->regex) {\n            reserve = len;\n#endif\n        } else {\n            reserve = len > r->uri.len - alias ? len - (r->uri.len - alias) : 0;\n        }\n        if (reserve > allocated) {\n            allocated = reserve + 16;\n            if (ngx_http_map_uri_to_path(r, &path, &root, allocated) == NULL) {\n                ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n                return NGX_OK;\n            }\n            name = path.data + root;\n         }\n        if (tf->values == NULL) {\n            ngx_memcpy(name, tf->name.data, tf->name.len);\n            path.len = (name + tf->name.len - 1) - path.data;\n        } else {\n            e.ip = tf->values->elts;\n            e.pos = name;\n            e.flushed = 1;\n            while (*(uintptr_t *) e.ip) {\n                code = *(ngx_http_script_code_pt *) e.ip;\n                code((ngx_http_script_engine_t *) &e);\n            }\n            path.len = e.pos - path.data;\n            *e.pos = \'\\0\';\n            if (alias && ngx_strncmp(name, clcf->name.data, alias) == 0) {\n                ngx_memmove(name, name + alias, len - alias);\n                path.len -= alias;\n            }\n        }\n        test_dir = tf->test_dir;\n        tf++;\n        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "trying to use %s: \\"%s\\" \\"%s\\"",\n                       test_dir ? "dir" : "file", name, path.data);\n        if (tf->lengths == NULL && tf->name.len == 0) {\n            if (tf->code) {\n                ngx_http_finalize_request(r, tf->code);\n                return NGX_OK;\n            }\n            path.len -= root;\n            path.data += root;\n            if (path.data[0] == \'@\') {\n                (void) ngx_http_named_location(r, &path);\n            } else {\n                ngx_http_split_args(r, &path, &args);\n                (void) ngx_http_internal_redirect(r, &path, &args);\n            }\n            ngx_http_finalize_request(r, NGX_DONE);\n            return NGX_OK;\n        }\n        ngx_memzero(&of, sizeof(ngx_open_file_info_t));\n        of.read_ahead = clcf->read_ahead;\n        of.directio = clcf->directio;\n        of.valid = clcf->open_file_cache_valid;\n        of.min_uses = clcf->open_file_cache_min_uses;\n        of.test_only = 1;\n        of.errors = clcf->open_file_cache_errors;\n        of.events = clcf->open_file_cache_events;\n        if (ngx_http_set_disable_symlinks(r, clcf, &path, &of) != NGX_OK) {\n            ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return NGX_OK;\n        }\n        if (ngx_open_cached_file(clcf->open_file_cache, &path, &of, r->pool)\n            != NGX_OK)\n        {\n            if (of.err != NGX_ENOENT\n                && of.err != NGX_ENOTDIR\n                && of.err != NGX_ENAMETOOLONG)\n            {\n                ngx_log_error(NGX_LOG_CRIT, r->connection->log, of.err,\n                              "%s \\"%s\\" failed", of.failed, path.data);\n            }\n            continue;\n        }\n        if (of.is_dir && !test_dir) {\n            continue;\n        }\n        path.len -= root;\n        path.data += root;\n        if (!alias) {\n            r->uri = path;\n#if (NGX_PCRE)\n        } else if (clcf->regex) {\n            if (!test_dir) {\n                r->uri = path;\n                r->add_uri_to_alias = 1;\n            }\n#endif\n        } else {\n            r->uri.len = alias + path.len;\n            r->uri.data = ngx_pnalloc(r->pool, r->uri.len);\n            if (r->uri.data == NULL) {\n                ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n                return NGX_OK;\n            }\n            p = ngx_copy(r->uri.data, clcf->name.data, alias);\n            ngx_memcpy(p, name, path.len);\n        }\n        ngx_http_set_exten(r);\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "try file uri: \\"%V\\"", &r->uri);\n        r->phase_handler++;\n        return NGX_AGAIN;\n    }\n}', 'ngx_int_t\nngx_http_named_location(ngx_http_request_t *r, ngx_str_t *name)\n{\n    ngx_http_core_srv_conf_t    *cscf;\n    ngx_http_core_loc_conf_t   **clcfp;\n    ngx_http_core_main_conf_t   *cmcf;\n    r->main->count++;\n    r->uri_changes--;\n    if (r->uri_changes == 0) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "rewrite or internal redirection cycle "\n                      "while redirect to named location \\"%V\\"", name);\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return NGX_DONE;\n    }\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    if (cscf->named_locations) {\n        for (clcfp = cscf->named_locations; *clcfp; clcfp++) {\n            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "test location: \\"%V\\"", &(*clcfp)->name);\n            if (name->len != (*clcfp)->name.len\n                || ngx_strncmp(name->data, (*clcfp)->name.data, name->len) != 0)\n            {\n                continue;\n            }\n            ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "using location: %V \\"%V?%V\\"",\n                           name, &r->uri, &r->args);\n            r->internal = 1;\n            r->content_handler = NULL;\n            r->loc_conf = (*clcfp)->loc_conf;\n            ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);\n            ngx_http_update_location_config(r);\n            cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n            r->phase_handler = cmcf->phase_engine.location_rewrite_index;\n            ngx_http_core_run_phases(r);\n            return NGX_DONE;\n        }\n    }\n    ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                  "could not find named location \\"%V\\"", name);\n    ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n    return NGX_DONE;\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %d, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n        return;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        if (r->main->blocked) {\n            r->write_event_handler = ngx_http_request_finalizer;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n#if (NGX_DEBUG)\n        if (r != c->data) {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n        }\n#endif\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            r->main->subrequests++;\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed || r->blocked) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    r->write_event_handler = ngx_http_request_empty_handler;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'static ngx_int_t\nngx_http_post_action(ngx_http_request_t *r)\n{\n    ngx_http_core_loc_conf_t  *clcf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->post_action.data == NULL) {\n        return NGX_DECLINED;\n    }\n    if (r->post_action && r->uri_changes == 0) {\n        return NGX_DECLINED;\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "post action: \\"%V\\"", &clcf->post_action);\n    r->main->count--;\n    r->http_version = NGX_HTTP_VERSION_9;\n    r->header_only = 1;\n    r->post_action = 1;\n    r->read_event_handler = ngx_http_block_reading;\n    if (clcf->post_action.data[0] == \'/\') {\n        ngx_http_internal_redirect(r, &clcf->post_action, NULL);\n    } else {\n        ngx_http_named_location(r, &clcf->post_action);\n    }\n    return NGX_OK;\n}', 'ngx_int_t\nngx_http_internal_redirect(ngx_http_request_t *r,\n    ngx_str_t *uri, ngx_str_t *args)\n{\n    ngx_http_core_srv_conf_t  *cscf;\n    r->uri_changes--;\n    if (r->uri_changes == 0) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "rewrite or internal redirection cycle "\n                      "while internally redirecting to \\"%V\\"", uri);\n        r->main->count++;\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return NGX_DONE;\n    }\n    r->uri = *uri;\n    if (args) {\n        r->args = *args;\n    } else {\n        ngx_str_null(&r->args);\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "internal redirect: \\"%V?%V\\"", uri, &r->args);\n    ngx_http_set_exten(r);\n    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    r->loc_conf = cscf->ctx->loc_conf;\n    ngx_http_update_location_config(r);\n#if (NGX_HTTP_CACHE)\n    r->cache = NULL;\n#endif\n    r->internal = 1;\n    r->valid_unparsed_uri = 0;\n    r->add_uri_to_alias = 0;\n    r->main->count++;\n    ngx_http_handler(r);\n    return NGX_DONE;\n}']