src/http/ngx_http_upstream.c:1735: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ngx_http_file_cache_free`.

src/http/ngx_http_upstream.c:1735:17: Call
1733.                 }
1734. 
1735.                 ngx_http_file_cache_free(r->cache, u->pipe->temp_file);
                      ^
1736.             }
1737. #endif

src/http/ngx_http_file_cache.c:907:1: <LHS trace>
905. 
906. 
907. void
     ^
908. ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
909. {

src/http/ngx_http_file_cache.c:907:1: Parameter `c->node->count`
  905. 
  906. 
  907. void
       ^
  908. ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
  909. {

src/http/ngx_http_file_cache.c:925:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ngx_http_file_cache_free` 
  923. 
  924.     fcn = c->node;
  925.     fcn->count--;
           ^
  926. 
  927.     if (c->updating) {

void
ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
{
    ngx_http_file_cache_t       *cache;
    ngx_http_file_cache_node_t  *fcn;
    if (c->updated) {
        return;
    }
    cache = c->file_cache;
    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,
                   "http file cache free, fd: %d", c->file.fd);
    ngx_shmtx_lock(&cache->shpool->mutex);
    fcn = c->node;
    fcn->count--;
    if (c->updating) {
        fcn->updating = 0;
    }
    if (c->error) {
        fcn->error = c->error;
        if (c->valid_sec) {
            fcn->valid_sec = c->valid_sec;
            fcn->valid_msec = c->valid_msec;
        }
    } else if (!fcn->exists && fcn->count == 0 && c->min_uses == 1) {
        ngx_queue_remove(&fcn->queue);
        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);
        ngx_slab_free_locked(cache->shpool, fcn);
        c->node = NULL;
    }
    ngx_shmtx_unlock(&cache->shpool->mutex);
    c->updated = 1;
    c->updating = 0;
    if (c->temp_file) {
        if (tf && tf->file.fd != NGX_INVALID_FILE) {
            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,
                           "http file cache incomplete: \"%s\"",
                           tf->file.name.data);
            if (ngx_delete_file(tf->file.name.data) == NGX_FILE_ERROR) {
                ngx_log_error(NGX_LOG_CRIT, c->file.log, ngx_errno,
                              ngx_delete_file_n " \"%s\" failed",
                              tf->file.name.data);
            }
        }
    }
}
['static ngx_int_t\nngx_http_upstream_intercept_errors(ngx_http_request_t *r,\n    ngx_http_upstream_t *u)\n{\n    ngx_int_t                  status;\n    ngx_uint_t                 i;\n    ngx_table_elt_t           *h;\n    ngx_http_err_page_t       *err_page;\n    ngx_http_core_loc_conf_t  *clcf;\n    status = u->headers_in.status_n;\n    if (status == NGX_HTTP_NOT_FOUND && u->conf->intercept_404) {\n        ngx_http_upstream_finalize_request(r, u, NGX_HTTP_NOT_FOUND);\n        return NGX_OK;\n    }\n    if (!u->conf->intercept_errors) {\n        return NGX_DECLINED;\n    }\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->error_pages == NULL) {\n        return NGX_DECLINED;\n    }\n    err_page = clcf->error_pages->elts;\n    for (i = 0; i < clcf->error_pages->nelts; i++) {\n        if (err_page[i].status == status) {\n            if (status == NGX_HTTP_UNAUTHORIZED\n                && u->headers_in.www_authenticate)\n            {\n                h = ngx_list_push(&r->headers_out.headers);\n                if (h == NULL) {\n                    ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n                    return NGX_OK;\n                }\n                *h = *u->headers_in.www_authenticate;\n                r->headers_out.www_authenticate = h;\n            }\n#if (NGX_HTTP_CACHE)\n            if (r->cache) {\n                time_t  valid;\n                valid = ngx_http_file_cache_valid(u->conf->cache_valid, status);\n                if (valid) {\n                    r->cache->valid_sec = ngx_time() + valid;\n                    r->cache->error = status;\n                }\n                ngx_http_file_cache_free(r->cache, u->pipe->temp_file);\n            }\n#endif\n            ngx_http_upstream_finalize_request(r, u, status);\n            return NGX_OK;\n        }\n    }\n    return NGX_DECLINED;\n}', 'void\nngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)\n{\n    ngx_http_file_cache_t       *cache;\n    ngx_http_file_cache_node_t  *fcn;\n    if (c->updated) {\n        return;\n    }\n    cache = c->file_cache;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,\n                   "http file cache free, fd: %d", c->file.fd);\n    ngx_shmtx_lock(&cache->shpool->mutex);\n    fcn = c->node;\n    fcn->count--;\n    if (c->updating) {\n        fcn->updating = 0;\n    }\n    if (c->error) {\n        fcn->error = c->error;\n        if (c->valid_sec) {\n            fcn->valid_sec = c->valid_sec;\n            fcn->valid_msec = c->valid_msec;\n        }\n    } else if (!fcn->exists && fcn->count == 0 && c->min_uses == 1) {\n        ngx_queue_remove(&fcn->queue);\n        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);\n        ngx_slab_free_locked(cache->shpool, fcn);\n        c->node = NULL;\n    }\n    ngx_shmtx_unlock(&cache->shpool->mutex);\n    c->updated = 1;\n    c->updating = 0;\n    if (c->temp_file) {\n        if (tf && tf->file.fd != NGX_INVALID_FILE) {\n            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,\n                           "http file cache incomplete: \\"%s\\"",\n                           tf->file.name.data);\n            if (ngx_delete_file(tf->file.name.data) == NGX_FILE_ERROR) {\n                ngx_log_error(NGX_LOG_CRIT, c->file.log, ngx_errno,\n                              ngx_delete_file_n " \\"%s\\" failed",\n                              tf->file.name.data);\n            }\n        }\n    }\n}']