src/http/ngx_http_upstream.c:5871: error: Integer Overflow L2
  ([1, +oo] - 2):unsigned64 by call to `ngx_parse_addr_port`.

src/http/ngx_http_upstream.c:5846:9: Call
5844.     ccv.complex_value = &cv;
5845. 
5846.     if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
              ^
5847.         return NGX_CONF_ERROR;
5848.     }

src/http/ngx_http_script.c:107:1: Parameter `ccv->value->len`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_upstream.c:5871:14: Call
5869.         }
5870. 
5871.         rc = ngx_parse_addr_port(cf->pool, local->addr, value[1].data,
                   ^
5872.                                  value[1].len);
5873. 

src/core/ngx_inet.c:615:1: <LHS trace>
613. 
614. 
615. ngx_int_t
     ^
616. ngx_parse_addr_port(ngx_pool_t *pool, ngx_addr_t *addr, u_char *text,
617.     size_t len)

src/core/ngx_inet.c:615:1: Parameter `len`
  613. 
  614. 
  615. ngx_int_t
       ^
  616. ngx_parse_addr_port(ngx_pool_t *pool, ngx_addr_t *addr, u_char *text,
  617.     size_t len)

src/core/ngx_inet.c:641:9: Binary operation: ([1, +oo] - 2):unsigned64 by call to `ngx_parse_addr_port` 
  639. 
  640.         text++;
  641.         len -= 2;
               ^
  642. 
  643.     } else

ngx_int_t
ngx_parse_addr_port(ngx_pool_t *pool, ngx_addr_t *addr, u_char *text,
    size_t len)
{
    u_char     *p, *last;
    size_t      plen;
    ngx_int_t   rc, port;
    rc = ngx_parse_addr(pool, addr, text, len);
    if (rc != NGX_DECLINED) {
        return rc;
    }
    last = text + len;
#if (NGX_HAVE_INET6)
    if (len && text[0] == '[') {
        p = ngx_strlchr(text, last, ']');
        if (p == NULL || p == last - 1 || *++p != ':') {
            return NGX_DECLINED;
        }
        text++;
        len -= 2;
    } else
#endif
    {
        p = ngx_strlchr(text, last, ':');
        if (p == NULL) {
            return NGX_DECLINED;
        }
    }
    p++;
    plen = last - p;
    port = ngx_atoi(p, plen);
    if (port < 1 || port > 65535) {
        return NGX_DECLINED;
    }
    len -= plen + 1;
    rc = ngx_parse_addr(pool, addr, text, len);
    if (rc != NGX_OK) {
        return rc;
    }
    ngx_inet_set_port(addr->sockaddr, (in_port_t) port);
    return NGX_OK;
}
['char *\nngx_http_upstream_bind_set_slot(ngx_conf_t *cf, ngx_command_t *cmd,\n    void *conf)\n{\n    char  *p = conf;\n    ngx_int_t                           rc;\n    ngx_str_t                          *value;\n    ngx_http_complex_value_t            cv;\n    ngx_http_upstream_local_t         **plocal, *local;\n    ngx_http_compile_complex_value_t    ccv;\n    plocal = (ngx_http_upstream_local_t **) (p + cmd->offset);\n    if (*plocal != NGX_CONF_UNSET_PTR) {\n        return "is duplicate";\n    }\n    value = cf->args->elts;\n    if (cf->args->nelts == 2 && ngx_strcmp(value[1].data, "off") == 0) {\n        *plocal = NULL;\n        return NGX_CONF_OK;\n    }\n    ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));\n    ccv.cf = cf;\n    ccv.value = &value[1];\n    ccv.complex_value = &cv;\n    if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {\n        return NGX_CONF_ERROR;\n    }\n    local = ngx_pcalloc(cf->pool, sizeof(ngx_http_upstream_local_t));\n    if (local == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    *plocal = local;\n    if (cv.lengths) {\n        local->value = ngx_palloc(cf->pool, sizeof(ngx_http_complex_value_t));\n        if (local->value == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        *local->value = cv;\n    } else {\n        local->addr = ngx_palloc(cf->pool, sizeof(ngx_addr_t));\n        if (local->addr == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        rc = ngx_parse_addr_port(cf->pool, local->addr, value[1].data,\n                                 value[1].len);\n        switch (rc) {\n        case NGX_OK:\n            local->addr->name = value[1];\n            break;\n        case NGX_DECLINED:\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "invalid address \\"%V\\"", &value[1]);\n        default:\n            return NGX_CONF_ERROR;\n        }\n    }\n    if (cf->args->nelts > 2) {\n        if (ngx_strcmp(value[2].data, "transparent") == 0) {\n#if (NGX_HAVE_TRANSPARENT_PROXY)\n            local->transparent = 1;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "transparent proxying is not supported "\n                               "on this platform, ignored");\n#endif\n        } else {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "invalid parameter \\"%V\\"", &value[2]);\n            return NGX_CONF_ERROR;\n        }\n    }\n    return NGX_CONF_OK;\n}', "ngx_int_t\nngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)\n{\n    ngx_str_t                  *v;\n    ngx_uint_t                  i, n, nv, nc;\n    ngx_array_t                 flushes, lengths, values, *pf, *pl, *pv;\n    ngx_http_script_compile_t   sc;\n    v = ccv->value;\n    nv = 0;\n    nc = 0;\n    for (i = 0; i < v->len; i++) {\n        if (v->data[i] == '$') {\n            if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {\n                nc++;\n            } else {\n                nv++;\n            }\n        }\n    }\n    if ((v->len == 0 || v->data[0] != '$')\n        && (ccv->conf_prefix || ccv->root_prefix))\n    {\n        if (ngx_conf_full_name(ccv->cf->cycle, v, ccv->conf_prefix) != NGX_OK) {\n            return NGX_ERROR;\n        }\n        ccv->conf_prefix = 0;\n        ccv->root_prefix = 0;\n    }\n    ccv->complex_value->value = *v;\n    ccv->complex_value->flushes = NULL;\n    ccv->complex_value->lengths = NULL;\n    ccv->complex_value->values = NULL;\n    if (nv == 0 && nc == 0) {\n        return NGX_OK;\n    }\n    n = nv + 1;\n    if (ngx_array_init(&flushes, ccv->cf->pool, n, sizeof(ngx_uint_t))\n        != NGX_OK)\n    {\n        return NGX_ERROR;\n    }\n    n = nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                  + sizeof(ngx_http_script_var_code_t))\n        + sizeof(uintptr_t);\n    if (ngx_array_init(&lengths, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    n = (nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                   + sizeof(ngx_http_script_var_code_t))\n                + sizeof(uintptr_t)\n                + v->len\n                + sizeof(uintptr_t) - 1)\n            & ~(sizeof(uintptr_t) - 1);\n    if (ngx_array_init(&values, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    pf = &flushes;\n    pl = &lengths;\n    pv = &values;\n    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n    sc.cf = ccv->cf;\n    sc.source = v;\n    sc.flushes = &pf;\n    sc.lengths = &pl;\n    sc.values = &pv;\n    sc.complete_lengths = 1;\n    sc.complete_values = 1;\n    sc.zero = ccv->zero;\n    sc.conf_prefix = ccv->conf_prefix;\n    sc.root_prefix = ccv->root_prefix;\n    if (ngx_http_script_compile(&sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (flushes.nelts) {\n        ccv->complex_value->flushes = flushes.elts;\n        ccv->complex_value->flushes[flushes.nelts] = (ngx_uint_t) -1;\n    }\n    ccv->complex_value->lengths = lengths.elts;\n    ccv->complex_value->values = values.elts;\n    return NGX_OK;\n}", "ngx_int_t\nngx_parse_addr_port(ngx_pool_t *pool, ngx_addr_t *addr, u_char *text,\n    size_t len)\n{\n    u_char     *p, *last;\n    size_t      plen;\n    ngx_int_t   rc, port;\n    rc = ngx_parse_addr(pool, addr, text, len);\n    if (rc != NGX_DECLINED) {\n        return rc;\n    }\n    last = text + len;\n#if (NGX_HAVE_INET6)\n    if (len && text[0] == '[') {\n        p = ngx_strlchr(text, last, ']');\n        if (p == NULL || p == last - 1 || *++p != ':') {\n            return NGX_DECLINED;\n        }\n        text++;\n        len -= 2;\n    } else\n#endif\n    {\n        p = ngx_strlchr(text, last, ':');\n        if (p == NULL) {\n            return NGX_DECLINED;\n        }\n    }\n    p++;\n    plen = last - p;\n    port = ngx_atoi(p, plen);\n    if (port < 1 || port > 65535) {\n        return NGX_DECLINED;\n    }\n    len -= plen + 1;\n    rc = ngx_parse_addr(pool, addr, text, len);\n    if (rc != NGX_OK) {\n        return rc;\n    }\n    ngx_inet_set_port(addr->sockaddr, (in_port_t) port);\n    return NGX_OK;\n}"]