src/http/ngx_http_request.c:950: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ngx_http_finalize_request`.

src/http/ngx_http_request.c:931:22: Call
929.             if (r->header_in->pos == r->header_in->end) {
930. 
931.                 rv = ngx_http_alloc_large_header_buffer(r, 0);
                          ^
932. 
933.                 if (rv == NGX_ERROR) {

src/http/ngx_http_request.c:1121:1: Parameter `*r->header_in->pos`
  1119. 
  1120. 
  1121. static ngx_int_t
        ^
  1122. ngx_http_alloc_large_header_buffer(ngx_http_request_t *r,
  1123.     ngx_uint_t request_line)

src/http/ngx_http_request.c:950:21: Call
948.                                   "client sent too long header line: \"%*s\"",
949.                                   len, r->header_name_start);
950.                     ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);
                         ^
951.                     return;
952.                 }

src/http/ngx_http_request.c:1831:1: Parameter `r->uri_changes`
  1829. 
  1830. 
  1831. void
        ^
  1832. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
  1833. {

src/http/ngx_http_request.c:1870:13: Call
  1868.         || c->error)
  1869.     {
  1870.         if (ngx_http_post_action(r) == NGX_OK) {
                    ^
  1871.             return;
  1872.         }

src/http/ngx_http_request.c:2809:1: Parameter `r->uri_changes`
    2807. 
    2808. 
    2809. static ngx_int_t
          ^
    2810. ngx_http_post_action(ngx_http_request_t *r)
    2811. {

src/http/ngx_http_request.c:2832:9: Call
    2830. 
    2831.     if (clcf->post_action.data[0] == '/') {
    2832.         ngx_http_internal_redirect(r, &clcf->post_action, NULL);
                  ^
    2833. 
    2834.     } else {

src/http/ngx_http_core_module.c:2163:1: <LHS trace>
2161. 
2162. 
2163. ngx_int_t
      ^
2164. ngx_http_internal_redirect(ngx_http_request_t *r,
2165.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2163:1: Parameter `r->uri_changes`
      2161. 
      2162. 
      2163. ngx_int_t
            ^
      2164. ngx_http_internal_redirect(ngx_http_request_t *r,
      2165.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2169:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ngx_http_finalize_request` 
      2167.     ngx_http_core_srv_conf_t  *cscf;
      2168. 
      2169.     r->uri_changes--;
                ^
      2170. 
      2171.     if (r->uri_changes == 0) {

ngx_int_t
ngx_http_internal_redirect(ngx_http_request_t *r,
    ngx_str_t *uri, ngx_str_t *args)
{
    ngx_http_core_srv_conf_t  *cscf;
    r->uri_changes--;
    if (r->uri_changes == 0) {
        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                      "rewrite or internal redirection cycle "
                      "while internal redirect to \"%V\"", uri);
        r->main->count++;
        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return NGX_DONE;
    }
    r->uri = *uri;
    if (args) {
        r->args = *args;
    } else {
        r->args.len = 0;
        r->args.data = NULL;
    }
    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                   "internal redirect: \"%V?%V\"", uri, &r->args);
    ngx_http_set_exten(r);
    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);
    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
    r->loc_conf = cscf->ctx->loc_conf;
    ngx_http_update_location_config(r);
#if (NGX_HTTP_CACHE)
    r->cache = NULL;
#endif
    r->internal = 1;
    r->main->count++;
    ngx_http_handler(r);
    return NGX_DONE;
}
['static void\nngx_http_process_request_headers(ngx_event_t *rev)\n{\n    u_char                     *p;\n    size_t                      len;\n    ssize_t                     n;\n    ngx_int_t                   rc, rv;\n    ngx_table_elt_t            *h;\n    ngx_connection_t           *c;\n    ngx_http_header_t          *hh;\n    ngx_http_request_t         *r;\n    ngx_http_core_srv_conf_t   *cscf;\n    ngx_http_core_main_conf_t  *cmcf;\n    c = rev->data;\n    r = c->data;\n    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, rev->log, 0,\n                   "http process request header line");\n    if (rev->timedout) {\n        ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");\n        c->timedout = 1;\n        ngx_http_close_request(r, NGX_HTTP_REQUEST_TIME_OUT);\n        return;\n    }\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    rc = NGX_AGAIN;\n    for ( ;; ) {\n        if (rc == NGX_AGAIN) {\n            if (r->header_in->pos == r->header_in->end) {\n                rv = ngx_http_alloc_large_header_buffer(r, 0);\n                if (rv == NGX_ERROR) {\n                    ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n                    return;\n                }\n                if (rv == NGX_DECLINED) {\n                    len = r->header_in->end - r->header_name_start;\n                    p = r->header_name_start;\n                    if (len > NGX_MAX_ERROR_STR - 300) {\n                        len = NGX_MAX_ERROR_STR - 300;\n                        p[len++] = \'.\'; p[len++] = \'.\'; p[len++] = \'.\';\n                    }\n                    ngx_log_error(NGX_LOG_INFO, c->log, 0,\n                                  "client sent too long header line: \\"%*s\\"",\n                                  len, r->header_name_start);\n                    ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);\n                    return;\n                }\n            }\n            n = ngx_http_read_request_header(r);\n            if (n == NGX_AGAIN || n == NGX_ERROR) {\n                return;\n            }\n        }\n        rc = ngx_http_parse_header_line(r, r->header_in,\n                                        cscf->underscores_in_headers);\n        if (rc == NGX_OK) {\n            if (r->invalid_header && cscf->ignore_invalid_headers) {\n                ngx_log_error(NGX_LOG_INFO, c->log, 0,\n                              "client sent invalid header line: \\"%*s\\"",\n                              r->header_end - r->header_name_start,\n                              r->header_name_start);\n                continue;\n            }\n            h = ngx_list_push(&r->headers_in.headers);\n            if (h == NULL) {\n                ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n                return;\n            }\n            h->hash = r->header_hash;\n            h->key.len = r->header_name_end - r->header_name_start;\n            h->key.data = r->header_name_start;\n            h->key.data[h->key.len] = \'\\0\';\n            h->value.len = r->header_end - r->header_start;\n            h->value.data = r->header_start;\n            h->value.data[h->value.len] = \'\\0\';\n            h->lowcase_key = ngx_pnalloc(r->pool, h->key.len);\n            if (h->lowcase_key == NULL) {\n                ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n                return;\n            }\n            if (h->key.len == r->lowcase_index) {\n                ngx_memcpy(h->lowcase_key, r->lowcase_header, h->key.len);\n            } else {\n                ngx_strlow(h->lowcase_key, h->key.data, h->key.len);\n            }\n            hh = ngx_hash_find(&cmcf->headers_in_hash, h->hash,\n                               h->lowcase_key, h->key.len);\n            if (hh && hh->handler(r, h, hh->offset) != NGX_OK) {\n                return;\n            }\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "http header: \\"%V: %V\\"",\n                           &h->key, &h->value);\n            continue;\n        }\n        if (rc == NGX_HTTP_PARSE_HEADER_DONE) {\n            ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "http header done");\n            r->request_length += r->header_in->pos - r->header_in->start;\n            r->http_state = NGX_HTTP_PROCESS_REQUEST_STATE;\n            rc = ngx_http_process_request_header(r);\n            if (rc != NGX_OK) {\n                return;\n            }\n            ngx_http_process_request(r);\n            return;\n        }\n        if (rc == NGX_AGAIN) {\n            continue;\n        }\n        ngx_log_error(NGX_LOG_INFO, c->log, 0,\n                      "client sent invalid header line: \\"%*s\\\\r...\\"",\n                      r->header_end - r->header_name_start,\n                      r->header_name_start);\n        ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST);\n        return;\n    }\n}', 'static ngx_int_t\nngx_http_alloc_large_header_buffer(ngx_http_request_t *r,\n    ngx_uint_t request_line)\n{\n    u_char                    *old, *new;\n    ngx_buf_t                 *b;\n    ngx_http_connection_t     *hc;\n    ngx_http_core_srv_conf_t  *cscf;\n    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http alloc large header buffer");\n    if (request_line && r->state == 0) {\n        r->request_length += r->header_in->end - r->header_in->start;\n        r->header_in->pos = r->header_in->start;\n        r->header_in->last = r->header_in->start;\n        return NGX_OK;\n    }\n    old = request_line ? r->request_start : r->header_name_start;\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    if (r->state != 0\n        && (size_t) (r->header_in->pos - old)\n                                     >= cscf->large_client_header_buffers.size)\n    {\n        return NGX_DECLINED;\n    }\n    hc = r->http_connection;\n    if (hc->nfree) {\n        b = hc->free[--hc->nfree];\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http large header free: %p %uz",\n                       b->pos, b->end - b->last);\n    } else if (hc->nbusy < cscf->large_client_header_buffers.num) {\n        if (hc->busy == NULL) {\n            hc->busy = ngx_palloc(r->connection->pool,\n                  cscf->large_client_header_buffers.num * sizeof(ngx_buf_t *));\n            if (hc->busy == NULL) {\n                return NGX_ERROR;\n            }\n        }\n        b = ngx_create_temp_buf(r->connection->pool,\n                                cscf->large_client_header_buffers.size);\n        if (b == NULL) {\n            return NGX_ERROR;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http large header alloc: %p %uz",\n                       b->pos, b->end - b->last);\n    } else {\n        return NGX_DECLINED;\n    }\n    hc->busy[hc->nbusy++] = b;\n    if (r->state == 0) {\n        r->request_length += r->header_in->end - r->header_in->start;\n        r->header_in = b;\n        return NGX_OK;\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http large header copy: %d", r->header_in->pos - old);\n    r->request_length += old - r->header_in->start;\n    new = b->start;\n    ngx_memcpy(new, old, r->header_in->pos - old);\n    b->pos = new + (r->header_in->pos - old);\n    b->last = new + (r->header_in->pos - old);\n    if (request_line) {\n        r->request_start = new;\n        if (r->request_end) {\n            r->request_end = new + (r->request_end - old);\n        }\n        r->method_end = new + (r->method_end - old);\n        r->uri_start = new + (r->uri_start - old);\n        r->uri_end = new + (r->uri_end - old);\n        if (r->schema_start) {\n            r->schema_start = new + (r->schema_start - old);\n            r->schema_end = new + (r->schema_end - old);\n        }\n        if (r->host_start) {\n            r->host_start = new + (r->host_start - old);\n            if (r->host_end) {\n                r->host_end = new + (r->host_end - old);\n            }\n        }\n        if (r->port_start) {\n            r->port_start = new + (r->port_start - old);\n            r->port_end = new + (r->port_end - old);\n        }\n        if (r->uri_ext) {\n            r->uri_ext = new + (r->uri_ext - old);\n        }\n        if (r->args_start) {\n            r->args_start = new + (r->args_start - old);\n        }\n        if (r->http_protocol.data) {\n            r->http_protocol.data = new + (r->http_protocol.data - old);\n        }\n    } else {\n        r->header_name_start = new;\n        r->header_name_end = new + (r->header_name_end - old);\n        r->header_start = new + (r->header_start - old);\n        r->header_end = new + (r->header_end - old);\n    }\n    r->header_in = b;\n    return NGX_OK;\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %d, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n        return;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        if (r->main->blocked) {\n            r->write_event_handler = ngx_http_request_finalizer;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n#if (NGX_DEBUG)\n        if (r != c->data) {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n        }\n#endif\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed || r->blocked) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'static ngx_int_t\nngx_http_post_action(ngx_http_request_t *r)\n{\n    ngx_http_core_loc_conf_t  *clcf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->post_action.data == NULL) {\n        return NGX_DECLINED;\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "post action: \\"%V\\"", &clcf->post_action);\n    r->main->count--;\n    r->http_version = NGX_HTTP_VERSION_9;\n    r->header_only = 1;\n    r->post_action = 1;\n    r->read_event_handler = ngx_http_block_reading;\n    if (clcf->post_action.data[0] == \'/\') {\n        ngx_http_internal_redirect(r, &clcf->post_action, NULL);\n    } else {\n        ngx_http_named_location(r, &clcf->post_action);\n    }\n    return NGX_OK;\n}', 'ngx_int_t\nngx_http_internal_redirect(ngx_http_request_t *r,\n    ngx_str_t *uri, ngx_str_t *args)\n{\n    ngx_http_core_srv_conf_t  *cscf;\n    r->uri_changes--;\n    if (r->uri_changes == 0) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "rewrite or internal redirection cycle "\n                      "while internal redirect to \\"%V\\"", uri);\n        r->main->count++;\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return NGX_DONE;\n    }\n    r->uri = *uri;\n    if (args) {\n        r->args = *args;\n    } else {\n        r->args.len = 0;\n        r->args.data = NULL;\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "internal redirect: \\"%V?%V\\"", uri, &r->args);\n    ngx_http_set_exten(r);\n    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    r->loc_conf = cscf->ctx->loc_conf;\n    ngx_http_update_location_config(r);\n#if (NGX_HTTP_CACHE)\n    r->cache = NULL;\n#endif\n    r->internal = 1;\n    r->main->count++;\n    ngx_http_handler(r);\n    return NGX_DONE;\n}']