src/http/modules/ngx_http_rewrite_module.c:332: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64.

src/http/modules/ngx_http_rewrite_module.c:321:20: <LHS trace>
319.     /* TODO: NGX_REGEX_CASELESS */
320. 
321.     regex->regex = ngx_regex_compile(&value[1], 0, cf->pool, &err);
                        ^
322. 
323.     if (regex->regex == NULL) {

src/http/modules/ngx_http_rewrite_module.c:321:20: Call
319.     /* TODO: NGX_REGEX_CASELESS */
320. 
321.     regex->regex = ngx_regex_compile(&value[1], 0, cf->pool, &err);
                        ^
322. 
323.     if (regex->regex == NULL) {

src/core/ngx_regex.c:26:1: Parameter `pattern->len`
  24. 
  25. 
  26. ngx_regex_t *
      ^
  27. ngx_regex_compile(ngx_str_t *pattern, ngx_int_t options, ngx_pool_t *pool,
  28.     ngx_str_t *err)

src/http/modules/ngx_http_rewrite_module.c:332:9: Binary operation: ([0, +oo] - 1):unsigned64
330.     regex->name = value[1];
331. 
332.     if (value[2].data[value[2].len - 1] == '?') {
             ^
333. 
334.         /* the last "?" drops the original arguments */

static char *
ngx_http_rewrite(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    ngx_http_rewrite_loc_conf_t  *lcf = conf;
    ngx_str_t                         *value, err;
    ngx_int_t                          n;
    ngx_uint_t                         last;
    ngx_http_script_code_pt           *code;
    ngx_http_script_compile_t          sc;
    ngx_http_script_regex_code_t      *regex;
    ngx_http_script_regex_end_code_t  *regex_end;
    u_char                             errstr[NGX_MAX_CONF_ERRSTR];
    regex = ngx_http_script_start_code(cf->pool, &lcf->codes,
                                       sizeof(ngx_http_script_regex_code_t));
    if (regex == NULL) {
        return NGX_CONF_ERROR;
    }
    ngx_memzero(regex, sizeof(ngx_http_script_regex_code_t));
    value = cf->args->elts;
    err.len = NGX_MAX_CONF_ERRSTR;
    err.data = errstr;
    regex->regex = ngx_regex_compile(&value[1], 0, cf->pool, &err);
    if (regex->regex == NULL) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "%s", err.data);
        return NGX_CONF_ERROR;
    }
    regex->code = ngx_http_script_regex_start_code;
    regex->uri = 1;
    regex->name = value[1];
    if (value[2].data[value[2].len - 1] == '?') {
        value[2].len--;
    } else {
        regex->add_args = 1;
    }
    last = 0;
    if (ngx_strncmp(value[2].data, "http://", sizeof("http://") - 1) == 0) {
        regex->status = NGX_HTTP_MOVED_TEMPORARILY;
        regex->redirect = 1;
        last = 1;
    }
    if (ngx_strncmp(value[2].data, "https://", sizeof("https://") - 1) == 0) {
        regex->status = NGX_HTTP_MOVED_TEMPORARILY;
        regex->redirect = 1;
        last = 1;
    }
    if (cf->args->nelts == 4) {
        if (ngx_strcmp(value[3].data, "last") == 0) {
            last = 1;
        } else if (ngx_strcmp(value[3].data, "break") == 0) {
            regex->break_cycle = 1;
            last = 1;
        } else if (ngx_strcmp(value[3].data, "redirect") == 0) {
            regex->status = NGX_HTTP_MOVED_TEMPORARILY;
            regex->redirect = 1;
            last = 1;
        } else if (ngx_strcmp(value[3].data, "permanent") == 0) {
            regex->status = NGX_HTTP_MOVED_PERMANENTLY;
            regex->redirect = 1;
            last = 1;
        } else {
            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                               "invalid parameter \"%V\"", &value[3]);
            return NGX_CONF_ERROR;
        }
    }
    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));
    sc.cf = cf;
    sc.source = &value[2];
    sc.lengths = &regex->lengths;
    sc.values = &lcf->codes;
    sc.variables = ngx_http_script_variables_count(&value[2]);
    sc.main = regex;
    sc.complete_lengths = 1;
    sc.compile_args = !regex->redirect;
    if (ngx_http_script_compile(&sc) != NGX_OK) {
        return NGX_CONF_ERROR;
    }
    regex = sc.main;
    regex->ncaptures = sc.ncaptures;
    regex->size = sc.size;
    regex->args = sc.args;
    if (sc.variables == 0 && !sc.dup_capture) {
        regex->lengths = NULL;
    }
    n = ngx_regex_capture_count(regex->regex);
    if (n < 0) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           ngx_regex_capture_count_n " failed for "
                           "pattern \"%V\"", &value[1]);
        return NGX_CONF_ERROR;
    }
    if (regex->ncaptures > (ngx_uint_t) n) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "pattern \"%V\" has less captures "
                           "than referrenced in substitution \"%V\"",
                           &value[1], &value[2]);
        return NGX_CONF_ERROR;
    }
    if (regex->ncaptures < (ngx_uint_t) n) {
        regex->ncaptures = (ngx_uint_t) n;
    }
    if (regex->ncaptures) {
        regex->ncaptures = (regex->ncaptures + 1) * 3;
    }
    regex_end = ngx_http_script_add_code(lcf->codes,
                                      sizeof(ngx_http_script_regex_end_code_t),
                                      &regex);
    if (regex_end == NULL) {
        return NGX_CONF_ERROR;
    }
    regex_end->code = ngx_http_script_regex_end_code;
    regex_end->uri = regex->uri;
    regex_end->args = regex->args;
    regex_end->add_args = regex->add_args;
    regex_end->redirect = regex->redirect;
    if (last) {
        code = ngx_http_script_add_code(lcf->codes, sizeof(uintptr_t), &regex);
        if (code == NULL) {
            return NGX_CONF_ERROR;
        }
        *code = (uintptr_t) NULL;
    }
    regex->next = (u_char *) lcf->codes->elts + lcf->codes->nelts
                                              - (u_char *) regex;
    return NGX_CONF_OK;
}
['static char *\nngx_http_rewrite(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_rewrite_loc_conf_t  *lcf = conf;\n    ngx_str_t                         *value, err;\n    ngx_int_t                          n;\n    ngx_uint_t                         last;\n    ngx_http_script_code_pt           *code;\n    ngx_http_script_compile_t          sc;\n    ngx_http_script_regex_code_t      *regex;\n    ngx_http_script_regex_end_code_t  *regex_end;\n    u_char                             errstr[NGX_MAX_CONF_ERRSTR];\n    regex = ngx_http_script_start_code(cf->pool, &lcf->codes,\n                                       sizeof(ngx_http_script_regex_code_t));\n    if (regex == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    ngx_memzero(regex, sizeof(ngx_http_script_regex_code_t));\n    value = cf->args->elts;\n    err.len = NGX_MAX_CONF_ERRSTR;\n    err.data = errstr;\n    regex->regex = ngx_regex_compile(&value[1], 0, cf->pool, &err);\n    if (regex->regex == NULL) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "%s", err.data);\n        return NGX_CONF_ERROR;\n    }\n    regex->code = ngx_http_script_regex_start_code;\n    regex->uri = 1;\n    regex->name = value[1];\n    if (value[2].data[value[2].len - 1] == \'?\') {\n        value[2].len--;\n    } else {\n        regex->add_args = 1;\n    }\n    last = 0;\n    if (ngx_strncmp(value[2].data, "http://", sizeof("http://") - 1) == 0) {\n        regex->status = NGX_HTTP_MOVED_TEMPORARILY;\n        regex->redirect = 1;\n        last = 1;\n    }\n    if (ngx_strncmp(value[2].data, "https://", sizeof("https://") - 1) == 0) {\n        regex->status = NGX_HTTP_MOVED_TEMPORARILY;\n        regex->redirect = 1;\n        last = 1;\n    }\n    if (cf->args->nelts == 4) {\n        if (ngx_strcmp(value[3].data, "last") == 0) {\n            last = 1;\n        } else if (ngx_strcmp(value[3].data, "break") == 0) {\n            regex->break_cycle = 1;\n            last = 1;\n        } else if (ngx_strcmp(value[3].data, "redirect") == 0) {\n            regex->status = NGX_HTTP_MOVED_TEMPORARILY;\n            regex->redirect = 1;\n            last = 1;\n        } else if (ngx_strcmp(value[3].data, "permanent") == 0) {\n            regex->status = NGX_HTTP_MOVED_PERMANENTLY;\n            regex->redirect = 1;\n            last = 1;\n        } else {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "invalid parameter \\"%V\\"", &value[3]);\n            return NGX_CONF_ERROR;\n        }\n    }\n    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n    sc.cf = cf;\n    sc.source = &value[2];\n    sc.lengths = &regex->lengths;\n    sc.values = &lcf->codes;\n    sc.variables = ngx_http_script_variables_count(&value[2]);\n    sc.main = regex;\n    sc.complete_lengths = 1;\n    sc.compile_args = !regex->redirect;\n    if (ngx_http_script_compile(&sc) != NGX_OK) {\n        return NGX_CONF_ERROR;\n    }\n    regex = sc.main;\n    regex->ncaptures = sc.ncaptures;\n    regex->size = sc.size;\n    regex->args = sc.args;\n    if (sc.variables == 0 && !sc.dup_capture) {\n        regex->lengths = NULL;\n    }\n    n = ngx_regex_capture_count(regex->regex);\n    if (n < 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           ngx_regex_capture_count_n " failed for "\n                           "pattern \\"%V\\"", &value[1]);\n        return NGX_CONF_ERROR;\n    }\n    if (regex->ncaptures > (ngx_uint_t) n) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "pattern \\"%V\\" has less captures "\n                           "than referrenced in substitution \\"%V\\"",\n                           &value[1], &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (regex->ncaptures < (ngx_uint_t) n) {\n        regex->ncaptures = (ngx_uint_t) n;\n    }\n    if (regex->ncaptures) {\n        regex->ncaptures = (regex->ncaptures + 1) * 3;\n    }\n    regex_end = ngx_http_script_add_code(lcf->codes,\n                                      sizeof(ngx_http_script_regex_end_code_t),\n                                      &regex);\n    if (regex_end == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    regex_end->code = ngx_http_script_regex_end_code;\n    regex_end->uri = regex->uri;\n    regex_end->args = regex->args;\n    regex_end->add_args = regex->add_args;\n    regex_end->redirect = regex->redirect;\n    if (last) {\n        code = ngx_http_script_add_code(lcf->codes, sizeof(uintptr_t), &regex);\n        if (code == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        *code = (uintptr_t) NULL;\n    }\n    regex->next = (u_char *) lcf->codes->elts + lcf->codes->nelts\n                                              - (u_char *) regex;\n    return NGX_CONF_OK;\n}', 'ngx_regex_t *\nngx_regex_compile(ngx_str_t *pattern, ngx_int_t options, ngx_pool_t *pool,\n    ngx_str_t *err)\n{\n    int              erroff;\n    const char      *errstr;\n    ngx_regex_t     *re;\n#if (NGX_THREADS)\n    ngx_core_tls_t  *tls;\n#if (NGX_SUPPRESS_WARN)\n    tls = NULL;\n#endif\n    if (ngx_threaded) {\n        tls = ngx_thread_get_tls(ngx_core_tls_key);\n        tls->pool = pool;\n    } else {\n        ngx_pcre_pool = pool;\n    }\n#else\n    ngx_pcre_pool = pool;\n#endif\n    re = pcre_compile((const char *) pattern->data, (int) options,\n                      &errstr, &erroff, NULL);\n    if (re == NULL) {\n       if ((size_t) erroff == pattern->len) {\n           ngx_snprintf(err->data, err->len - 1,\n                        "pcre_compile() failed: %s in \\"%s\\"%Z",\n                        errstr, pattern->data);\n        } else {\n           ngx_snprintf(err->data, err->len - 1,\n                        "pcre_compile() failed: %s in \\"%s\\" at \\"%s\\"%Z",\n                        errstr, pattern->data, pattern->data + erroff);\n        }\n    }\n#if (NGX_THREADS)\n    if (ngx_threaded) {\n        tls->pool = NULL;\n    } else {\n        ngx_pcre_pool = NULL;\n    }\n#else\n    ngx_pcre_pool = NULL;\n#endif\n    return re;\n}']