src/http/ngx_http_request.c:447: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64 by call to `ngx_create_pool`.

src/http/ngx_http_request.c:447:15: Call
445.     }
446. 
447.     r->pool = ngx_create_pool(cscf->request_pool_size, c->log);
                   ^
448.     if (r->pool == NULL) {
449.         ngx_http_close_connection(c);

src/core/ngx_palloc.c:15:1: <LHS trace>
13. 
14. 
15. ngx_pool_t *
    ^
16. ngx_create_pool(size_t size, ngx_log_t *log)
17. {

src/core/ngx_palloc.c:15:1: Global `ngx_pagesize`
  13. 
  14. 
  15. ngx_pool_t *
      ^
  16. ngx_create_pool(size_t size, ngx_log_t *log)
  17. {

src/core/ngx_palloc.c:31:15: Binary operation: ([0, +oo] - 1):unsigned64 by call to `ngx_create_pool` 
  29. 
  30.     size = size - sizeof(ngx_pool_t);
  31.     p->max = (size < NGX_MAX_ALLOC_FROM_POOL) ? size : NGX_MAX_ALLOC_FROM_POOL;
                    ^
  32. 
  33.     p->current = p;

ngx_pool_t *
ngx_create_pool(size_t size, ngx_log_t *log)
{
    ngx_pool_t  *p;
    p = ngx_alloc(size, log);
    if (p == NULL) {
        return NULL;
    }
    p->d.last = (u_char *) p + sizeof(ngx_pool_t);
    p->d.end = (u_char *) p + size;
    p->d.next = NULL;
    p->d.failed = 0;
    size = size - sizeof(ngx_pool_t);
    p->max = (size < NGX_MAX_ALLOC_FROM_POOL) ? size : NGX_MAX_ALLOC_FROM_POOL;
    p->current = p;
    p->chain = NULL;
    p->large = NULL;
    p->cleanup = NULL;
    p->log = log;
    return p;
}
['static void\nngx_http_init_request(ngx_event_t *rev)\n{\n    ngx_time_t                 *tp;\n    ngx_uint_t                  i;\n    ngx_connection_t           *c;\n    ngx_http_request_t         *r;\n    struct sockaddr_in         *sin;\n    ngx_http_port_t            *port;\n    ngx_http_in_addr_t         *addr;\n    ngx_http_log_ctx_t         *ctx;\n    ngx_http_addr_conf_t       *addr_conf;\n    ngx_http_connection_t      *hc;\n    ngx_http_core_srv_conf_t   *cscf;\n    ngx_http_core_loc_conf_t   *clcf;\n    ngx_http_core_main_conf_t  *cmcf;\n#if (NGX_HAVE_INET6)\n    struct sockaddr_in6        *sin6;\n    ngx_http_in6_addr_t        *addr6;\n#endif\n#if (NGX_STAT_STUB)\n    (void) ngx_atomic_fetch_add(ngx_stat_reading, -1);\n#endif\n    c = rev->data;\n    if (rev->timedout) {\n        ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");\n        ngx_http_close_connection(c);\n        return;\n    }\n    c->requests++;\n    hc = c->data;\n    if (hc == NULL) {\n        hc = ngx_pcalloc(c->pool, sizeof(ngx_http_connection_t));\n        if (hc == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n    }\n    r = hc->request;\n    if (r) {\n        ngx_memzero(r, sizeof(ngx_http_request_t));\n        r->pipeline = hc->pipeline;\n        if (hc->nbusy) {\n            r->header_in = hc->busy[0];\n        }\n    } else {\n        r = ngx_pcalloc(c->pool, sizeof(ngx_http_request_t));\n        if (r == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        hc->request = r;\n    }\n    c->data = r;\n    r->http_connection = hc;\n    c->sent = 0;\n    r->signature = NGX_HTTP_MODULE;\n    port = c->listening->servers;\n    r->connection = c;\n    if (port->naddrs > 1) {\n        if (ngx_connection_local_sockaddr(c, NULL, 0) != NGX_OK) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        switch (c->local_sockaddr->sa_family) {\n#if (NGX_HAVE_INET6)\n        case AF_INET6:\n            sin6 = (struct sockaddr_in6 *) c->local_sockaddr;\n            addr6 = port->addrs;\n            for (i = 0; i < port->naddrs - 1; i++) {\n                if (ngx_memcmp(&addr6[i].addr6, &sin6->sin6_addr, 16) == 0) {\n                    break;\n                }\n            }\n            addr_conf = &addr6[i].conf;\n            break;\n#endif\n        default:\n            sin = (struct sockaddr_in *) c->local_sockaddr;\n            addr = port->addrs;\n            for (i = 0; i < port->naddrs - 1; i++) {\n                if (addr[i].addr == sin->sin_addr.s_addr) {\n                    break;\n                }\n            }\n            addr_conf = &addr[i].conf;\n            break;\n        }\n    } else {\n        switch (c->local_sockaddr->sa_family) {\n#if (NGX_HAVE_INET6)\n        case AF_INET6:\n            addr6 = port->addrs;\n            addr_conf = &addr6[0].conf;\n            break;\n#endif\n        default:\n            addr = port->addrs;\n            addr_conf = &addr[0].conf;\n            break;\n        }\n    }\n    r->virtual_names = addr_conf->virtual_names;\n    cscf = addr_conf->core_srv_conf;\n    r->main_conf = cscf->ctx->main_conf;\n    r->srv_conf = cscf->ctx->srv_conf;\n    r->loc_conf = cscf->ctx->loc_conf;\n    rev->handler = ngx_http_process_request_line;\n    r->read_event_handler = ngx_http_block_reading;\n#if (NGX_HTTP_SSL)\n    {\n    ngx_http_ssl_srv_conf_t  *sscf;\n    sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module);\n    if (sscf->enable || addr_conf->ssl) {\n        if (c->ssl == NULL) {\n            c->log->action = "SSL handshaking";\n            if (addr_conf->ssl && sscf->ssl.ctx == NULL) {\n                ngx_log_error(NGX_LOG_ERR, c->log, 0,\n                              "no \\"ssl_certificate\\" is defined "\n                              "in server listening on SSL port");\n                ngx_http_close_connection(c);\n                return;\n            }\n            if (ngx_ssl_create_connection(&sscf->ssl, c, NGX_SSL_BUFFER)\n                != NGX_OK)\n            {\n                ngx_http_close_connection(c);\n                return;\n            }\n            rev->handler = ngx_http_ssl_handshake;\n        }\n        r->main_filter_need_in_memory = 1;\n    }\n    }\n#endif\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    c->log->file = clcf->error_log->file;\n    if (!(c->log->log_level & NGX_LOG_DEBUG_CONNECTION)) {\n        c->log->log_level = clcf->error_log->log_level;\n    }\n    if (c->buffer == NULL) {\n        c->buffer = ngx_create_temp_buf(c->pool,\n                                        cscf->client_header_buffer_size);\n        if (c->buffer == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n    }\n    if (r->header_in == NULL) {\n        r->header_in = c->buffer;\n    }\n    r->pool = ngx_create_pool(cscf->request_pool_size, c->log);\n    if (r->pool == NULL) {\n        ngx_http_close_connection(c);\n        return;\n    }\n    if (ngx_list_init(&r->headers_out.headers, r->pool, 20,\n                      sizeof(ngx_table_elt_t))\n        != NGX_OK)\n    {\n        ngx_destroy_pool(r->pool);\n        ngx_http_close_connection(c);\n        return;\n    }\n    r->ctx = ngx_pcalloc(r->pool, sizeof(void *) * ngx_http_max_module);\n    if (r->ctx == NULL) {\n        ngx_destroy_pool(r->pool);\n        ngx_http_close_connection(c);\n        return;\n    }\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    r->variables = ngx_pcalloc(r->pool, cmcf->variables.nelts\n                                        * sizeof(ngx_http_variable_value_t));\n    if (r->variables == NULL) {\n        ngx_destroy_pool(r->pool);\n        ngx_http_close_connection(c);\n        return;\n    }\n    c->single_connection = 1;\n    c->destroyed = 0;\n    r->main = r;\n    r->count = 1;\n    tp = ngx_timeofday();\n    r->start_sec = tp->sec;\n    r->start_msec = tp->msec;\n    r->method = NGX_HTTP_UNKNOWN;\n    r->headers_in.content_length_n = -1;\n    r->headers_in.keep_alive_n = -1;\n    r->headers_out.content_length_n = -1;\n    r->headers_out.last_modified_time = -1;\n    r->uri_changes = NGX_HTTP_MAX_URI_CHANGES + 1;\n    r->subrequests = NGX_HTTP_MAX_SUBREQUESTS + 1;\n    r->http_state = NGX_HTTP_READING_REQUEST_STATE;\n    ctx = c->log->data;\n    ctx->request = r;\n    ctx->current_request = r;\n    r->log_handler = ngx_http_log_error_handler;\n#if (NGX_STAT_STUB)\n    (void) ngx_atomic_fetch_add(ngx_stat_reading, 1);\n    r->stat_reading = 1;\n    (void) ngx_atomic_fetch_add(ngx_stat_requests, 1);\n#endif\n    rev->handler(rev);\n}', 'ngx_pool_t *\nngx_create_pool(size_t size, ngx_log_t *log)\n{\n    ngx_pool_t  *p;\n    p = ngx_alloc(size, log);\n    if (p == NULL) {\n        return NULL;\n    }\n    p->d.last = (u_char *) p + sizeof(ngx_pool_t);\n    p->d.end = (u_char *) p + size;\n    p->d.next = NULL;\n    p->d.failed = 0;\n    size = size - sizeof(ngx_pool_t);\n    p->max = (size < NGX_MAX_ALLOC_FROM_POOL) ? size : NGX_MAX_ALLOC_FROM_POOL;\n    p->current = p;\n    p->chain = NULL;\n    p->large = NULL;\n    p->cleanup = NULL;\n    p->log = log;\n    return p;\n}']