src/http/ngx_http_request.c:1078: error: Integer Overflow L1
  (0 - 1):unsigned64 by call to `ngx_http_finalize_request`.

src/http/ngx_http_request.c:1074:13: Assignment
1072. 
1073.         if (ngx_http_parse_complex_uri(r, cscf->merge_slashes) != NGX_OK) {
1074.             r->uri.len = 0;
                  ^
1075. 
1076.             ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,

src/http/ngx_http_request.c:1078:13: Call
1076.             ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
1077.                           "client sent invalid request");
1078.             ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
                  ^
1079.             return NGX_ERROR;
1080.         }

src/http/ngx_http_request.c:2253:1: Parameter `r->uri.len`
  2251. 
  2252. 
  2253. void
        ^
  2254. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
  2255. {

src/http/ngx_http_request.c:2325:38: Call
  2323.         c->write->handler = ngx_http_request_handler;
  2324. 
  2325.         ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));
                                             ^
  2326.         return;
  2327.     }

src/http/ngx_http_special_response.c:365:1: Parameter `r->uri.len`
    363. 
    364. 
    365. ngx_int_t
         ^
    366. ngx_http_special_response_handler(ngx_http_request_t *r, ngx_int_t error)
    367. {

src/http/ngx_http_special_response.c:416:24: Call
    414.         for (i = 0; i < clcf->error_pages->nelts; i++) {
    415.             if (err_page[i].status == error) {
    416.                 return ngx_http_send_error_page(r, &err_page[i]);
                                ^
    417.             }
    418.         }

src/http/ngx_http_special_response.c:534:1: Parameter `r->uri.len`
      532. 
      533. 
      534. static ngx_int_t
           ^
      535. ngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)
      536. {

src/http/ngx_http_special_response.c:570:16: Call
      568.         }
      569. 
      570.         return ngx_http_internal_redirect(r, &uri, &args);
                          ^
      571.     }
      572. 

src/http/ngx_http_core_module.c:2592:1: Parameter `r->uri.len`
        2590. 
        2591. 
        2592. ngx_int_t
              ^
        2593. ngx_http_internal_redirect(ngx_http_request_t *r,
        2594.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2622:5: Call
        2620.                    "internal redirect: \"%V?%V\"", uri, &r->args);
        2621. 
        2622.     ngx_http_set_exten(r);
                  ^
        2623. 
        2624.     /* clear the modules contexts */

src/http/ngx_http_core_module.c:1794:1: <LHS trace>
1792. 
1793. 
1794. void
      ^
1795. ngx_http_set_exten(ngx_http_request_t *r)
1796. {

src/http/ngx_http_core_module.c:1794:1: Parameter `r->uri.len`
          1792. 
          1793. 
          1794. void
                ^
          1795. ngx_http_set_exten(ngx_http_request_t *r)
          1796. {

src/http/ngx_http_core_module.c:1801:10: Binary operation: (0 - 1):unsigned64 by call to `ngx_http_finalize_request` 
          1799.     ngx_str_null(&r->exten);
          1800. 
          1801.     for (i = r->uri.len - 1; i > 1; i--) {
                         ^
          1802.         if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {
          1803. 

void
ngx_http_set_exten(ngx_http_request_t *r)
{
    ngx_int_t  i;
    ngx_str_null(&r->exten);
    for (i = r->uri.len - 1; i > 1; i--) {
        if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {
            r->exten.len = r->uri.len - i - 1;
            r->exten.data = &r->uri.data[i + 1];
            return;
        } else if (r->uri.data[i] == '/') {
            return;
        }
    }
    return;
}
['ngx_int_t\nngx_http_process_request_uri(ngx_http_request_t *r)\n{\n    ngx_http_core_srv_conf_t  *cscf;\n    if (r->args_start) {\n        r->uri.len = r->args_start - 1 - r->uri_start;\n    } else {\n        r->uri.len = r->uri_end - r->uri_start;\n    }\n    if (r->complex_uri || r->quoted_uri) {\n        r->uri.data = ngx_pnalloc(r->pool, r->uri.len + 1);\n        if (r->uri.data == NULL) {\n            ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return NGX_ERROR;\n        }\n        cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n        if (ngx_http_parse_complex_uri(r, cscf->merge_slashes) != NGX_OK) {\n            r->uri.len = 0;\n            ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,\n                          "client sent invalid request");\n            ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);\n            return NGX_ERROR;\n        }\n    } else {\n        r->uri.data = r->uri_start;\n    }\n    r->unparsed_uri.len = r->uri_end - r->uri_start;\n    r->unparsed_uri.data = r->uri_start;\n    r->valid_unparsed_uri = r->space_in_uri ? 0 : 1;\n    if (r->uri_ext) {\n        if (r->args_start) {\n            r->exten.len = r->args_start - 1 - r->uri_ext;\n        } else {\n            r->exten.len = r->uri_end - r->uri_ext;\n        }\n        r->exten.data = r->uri_ext;\n    }\n    if (r->args_start && r->uri_end > r->args_start) {\n        r->args.len = r->uri_end - r->args_start;\n        r->args.data = r->args_start;\n    }\n#if (NGX_WIN32)\n    {\n    u_char  *p, *last;\n    p = r->uri.data;\n    last = r->uri.data + r->uri.len;\n    while (p < last) {\n        if (*p++ == \':\') {\n            if (p < last && *p == \'$\') {\n                ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,\n                              "client sent unsafe win32 URI");\n                ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);\n                return NGX_ERROR;\n            }\n        }\n    }\n    p = r->uri.data + r->uri.len - 1;\n    while (p > r->uri.data) {\n        if (*p == \' \') {\n            p--;\n            continue;\n        }\n        if (*p == \'.\') {\n            p--;\n            continue;\n        }\n        break;\n    }\n    if (p != r->uri.data + r->uri.len - 1) {\n        r->uri.len = p + 1 - r->uri.data;\n        ngx_http_set_exten(r);\n    }\n    }\n#endif\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http uri: \\"%V\\"", &r->uri);\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http args: \\"%V\\"", &r->args);\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http exten: \\"%V\\"", &r->exten);\n    return NGX_OK;\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %d, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        if (r->main->blocked) {\n            r->write_event_handler = ngx_http_request_finalizer;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            r->main->subrequests++;\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed || r->blocked) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    r->write_event_handler = ngx_http_request_empty_handler;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'ngx_int_t\nngx_http_special_response_handler(ngx_http_request_t *r, ngx_int_t error)\n{\n    ngx_uint_t                 i, err;\n    ngx_http_err_page_t       *err_page;\n    ngx_http_core_loc_conf_t  *clcf;\n    ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http special response: %i, \\"%V?%V\\"",\n                   error, &r->uri, &r->args);\n    r->err_status = error;\n    if (r->keepalive) {\n        switch (error) {\n            case NGX_HTTP_BAD_REQUEST:\n            case NGX_HTTP_REQUEST_ENTITY_TOO_LARGE:\n            case NGX_HTTP_REQUEST_URI_TOO_LARGE:\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n            case NGX_HTTP_INTERNAL_SERVER_ERROR:\n            case NGX_HTTP_NOT_IMPLEMENTED:\n                r->keepalive = 0;\n        }\n    }\n    if (r->lingering_close) {\n        switch (error) {\n            case NGX_HTTP_BAD_REQUEST:\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n                r->lingering_close = 0;\n        }\n    }\n    r->headers_out.content_type.len = 0;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (!r->error_page && clcf->error_pages && r->uri_changes != 0) {\n        if (clcf->recursive_error_pages == 0) {\n            r->error_page = 1;\n        }\n        err_page = clcf->error_pages->elts;\n        for (i = 0; i < clcf->error_pages->nelts; i++) {\n            if (err_page[i].status == error) {\n                return ngx_http_send_error_page(r, &err_page[i]);\n            }\n        }\n    }\n    r->expect_tested = 1;\n    if (ngx_http_discard_request_body(r) != NGX_OK) {\n        r->keepalive = 0;\n    }\n    if (clcf->msie_refresh\n        && r->headers_in.msie\n        && (error == NGX_HTTP_MOVED_PERMANENTLY\n            || error == NGX_HTTP_MOVED_TEMPORARILY))\n    {\n        return ngx_http_send_refresh(r);\n    }\n    if (error == NGX_HTTP_CREATED) {\n        err = 0;\n    } else if (error == NGX_HTTP_NO_CONTENT) {\n        err = 0;\n    } else if (error >= NGX_HTTP_MOVED_PERMANENTLY\n               && error < NGX_HTTP_LAST_3XX)\n    {\n        err = error - NGX_HTTP_MOVED_PERMANENTLY + NGX_HTTP_OFF_3XX;\n    } else if (error >= NGX_HTTP_BAD_REQUEST\n               && error < NGX_HTTP_LAST_4XX)\n    {\n        err = error - NGX_HTTP_BAD_REQUEST + NGX_HTTP_OFF_4XX;\n    } else if (error >= NGX_HTTP_NGINX_CODES\n               && error < NGX_HTTP_LAST_5XX)\n    {\n        err = error - NGX_HTTP_NGINX_CODES + NGX_HTTP_OFF_5XX;\n        switch (error) {\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n            case NGX_HTTP_REQUEST_HEADER_TOO_LARGE:\n                r->err_status = NGX_HTTP_BAD_REQUEST;\n                break;\n        }\n    } else {\n        err = 0;\n    }\n    return ngx_http_send_special_response(r, clcf, err);\n}', 'static ngx_int_t\nngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)\n{\n    ngx_int_t                  overwrite;\n    ngx_str_t                  uri, args;\n    ngx_table_elt_t           *location;\n    ngx_http_core_loc_conf_t  *clcf;\n    overwrite = err_page->overwrite;\n    if (overwrite && overwrite != NGX_HTTP_OK) {\n        r->expect_tested = 1;\n    }\n    if (overwrite >= 0) {\n        r->err_status = overwrite;\n    }\n    if (ngx_http_complex_value(r, &err_page->value, &uri) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (uri.data[0] == \'/\') {\n        if (err_page->value.lengths) {\n            ngx_http_split_args(r, &uri, &args);\n        } else {\n            args = err_page->args;\n        }\n        if (r->method != NGX_HTTP_HEAD) {\n            r->method = NGX_HTTP_GET;\n            r->method_name = ngx_http_get_name;\n        }\n        return ngx_http_internal_redirect(r, &uri, &args);\n    }\n    if (uri.data[0] == \'@\') {\n        return ngx_http_named_location(r, &uri);\n    }\n    location = ngx_list_push(&r->headers_out.headers);\n    if (location == NULL) {\n        return NGX_ERROR;\n    }\n    if (overwrite != NGX_HTTP_MOVED_PERMANENTLY\n        && overwrite != NGX_HTTP_MOVED_TEMPORARILY\n        && overwrite != NGX_HTTP_SEE_OTHER\n        && overwrite != NGX_HTTP_TEMPORARY_REDIRECT)\n    {\n        r->err_status = NGX_HTTP_MOVED_TEMPORARILY;\n    }\n    location->hash = 1;\n    ngx_str_set(&location->key, "Location");\n    location->value = uri;\n    ngx_http_clear_location(r);\n    r->headers_out.location = location;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->msie_refresh && r->headers_in.msie) {\n        return ngx_http_send_refresh(r);\n    }\n    return ngx_http_send_special_response(r, clcf, r->err_status\n                                                   - NGX_HTTP_MOVED_PERMANENTLY\n                                                   + NGX_HTTP_OFF_3XX);\n}', 'ngx_int_t\nngx_http_internal_redirect(ngx_http_request_t *r,\n    ngx_str_t *uri, ngx_str_t *args)\n{\n    ngx_http_core_srv_conf_t  *cscf;\n    r->uri_changes--;\n    if (r->uri_changes == 0) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "rewrite or internal redirection cycle "\n                      "while internally redirecting to \\"%V\\"", uri);\n        r->main->count++;\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return NGX_DONE;\n    }\n    r->uri = *uri;\n    if (args) {\n        r->args = *args;\n    } else {\n        ngx_str_null(&r->args);\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "internal redirect: \\"%V?%V\\"", uri, &r->args);\n    ngx_http_set_exten(r);\n    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    r->loc_conf = cscf->ctx->loc_conf;\n    ngx_http_update_location_config(r);\n#if (NGX_HTTP_CACHE)\n    r->cache = NULL;\n#endif\n    r->internal = 1;\n    r->valid_unparsed_uri = 0;\n    r->add_uri_to_alias = 0;\n    r->main->count++;\n    ngx_http_handler(r);\n    return NGX_DONE;\n}', "void\nngx_http_set_exten(ngx_http_request_t *r)\n{\n    ngx_int_t  i;\n    ngx_str_null(&r->exten);\n    for (i = r->uri.len - 1; i > 1; i--) {\n        if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {\n            r->exten.len = r->uri.len - i - 1;\n            r->exten.data = &r->uri.data[i + 1];\n            return;\n        } else if (r->uri.data[i] == '/') {\n            return;\n        }\n    }\n    return;\n}"]