server/apreq_parser_header.c:314: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `split_header_line`.

server/apreq_parser_header.c:156:1: Parameter `parser->ctx->vlen`
154. 
155. 
156. APREQ_DECLARE_PARSER(apreq_parse_headers)
     ^
157. {
158.     apr_pool_t *pool = parser->pool;

server/apreq_parser_header.c:314:25: Call
312.                     if (off > 0)
313.                         apr_bucket_split(e, off);
314.                     s = split_header_line(&param, pool, ctx->bb, ctx->nlen, ctx->glen, ctx->vlen);
                             ^
315.                     if (parser->hook != NULL && s == APR_SUCCESS)
316.                         s = apreq_hook_run(parser->hook, param, NULL);

server/apreq_parser_header.c:51:1: <LHS trace>
49. 
50. 
51. static apr_status_t split_header_line(apreq_param_t **p,
    ^
52.                                       apr_pool_t *pool,
53.                                       apr_bucket_brigade *bb,

server/apreq_parser_header.c:51:1: Parameter `vlen`
  49. 
  50. 
  51. static apr_status_t split_header_line(apreq_param_t **p,
      ^
  52.                                       apr_pool_t *pool,
  53.                                       apr_bucket_brigade *bb,

server/apreq_parser_header.c:71:13: Binary operation: ([0, +oo] - 1):unsigned64 by call to `split_header_line` 
  69.         return APR_EBADARG;
  70. 
  71.     param = apreq_param_make(pool, NULL, nlen, NULL, vlen - 1); /*drop (CR)LF */
                  ^
  72.     *(const apreq_value_t **)&v = &param->v;
  73. 

static apr_status_t split_header_line(apreq_param_t **p,
                                      apr_pool_t *pool,
                                      apr_bucket_brigade *bb,
                                      apr_size_t nlen,
                                      apr_size_t glen,
                                      apr_size_t vlen)
{
    apreq_param_t *param;
    apreq_value_t *v;
    apr_bucket *e, *f;
    apr_status_t s;
    struct iovec vec[APREQ_DEFAULT_NELTS], *iov, *end;
    apr_array_header_t arr;
    char *dest;
    const char *data;
    apr_size_t dlen;
    if (nlen == 0)
        return APR_EBADARG;
    param = apreq_param_make(pool, NULL, nlen, NULL, vlen - 1);
    *(const apreq_value_t **)&v = &param->v;
    arr.pool     = pool;
    arr.elt_size = sizeof(struct iovec);
    arr.nelts    = 0;
    arr.nalloc   = APREQ_DEFAULT_NELTS;
    arr.elts     = (char *)vec;
    e = APR_BRIGADE_FIRST(bb);
    while (nlen > 0) {
        apr_size_t len;
        end = apr_array_push(&arr);
        s = apr_bucket_read(e, (const char **)&end->iov_base,
                            &len, APR_BLOCK_READ);
        if (s != APR_SUCCESS)
            return s;
        assert(nlen >= len);
        end->iov_len = len;
        nlen -= len;
        e = APR_BUCKET_NEXT(e);
    }
    while (glen > 0) {
        s = apr_bucket_read(e, &data, &dlen, APR_BLOCK_READ);
        if (s != APR_SUCCESS)
            return s;
        assert(glen >= dlen);
        glen -= dlen;
        e = APR_BUCKET_NEXT(e);
    }
    assert(vlen > 0);
    dest = v->data;
    while (vlen > 0) {
        s = apr_bucket_read(e, &data, &dlen, APR_BLOCK_READ);
        if (s != APR_SUCCESS)
            return s;
        memcpy(dest, data, dlen);
        dest += dlen;
        assert(vlen >= dlen);
        vlen -= dlen;
        e = APR_BUCKET_NEXT(e);
    }
    assert(dest[-1] == '\n');
    if (dest[-2] == '\r')
        --dest;
    dest[-1] = 0;
    v->dlen = (dest - v->data) - 1;
    v->name = dest;
    iov = (struct iovec *)arr.elts;
    while (iov <= end) {
        memcpy(dest, iov->iov_base, iov->iov_len);
        dest += iov->iov_len;
        ++iov;
    }
    *dest = 0;
    while ((f = APR_BRIGADE_FIRST(bb)) != e)
        apr_bucket_delete(f);
    apreq_param_tainted_on(param);
    *p = param;
    return APR_SUCCESS;
}
["APREQ_DECLARE_PARSER(apreq_parse_headers)\n{\n    apr_pool_t *pool = parser->pool;\n    apr_bucket *e;\n    struct hdr_ctx *ctx;\n    if (parser->ctx == NULL) {\n        ctx = apr_pcalloc(pool, sizeof *ctx);\n        ctx->bb = apr_brigade_create(pool, parser->bucket_alloc);\n        parser->ctx = ctx;\n        ctx->status = HDR_NAME;\n    }\n    else\n        ctx = parser->ctx;\n    PARSER_STATUS_CHECK(HDR);\n    e = APR_BRIGADE_LAST(ctx->bb);\n    APR_BRIGADE_CONCAT(ctx->bb, bb);\n parse_hdr_brigade:\n    for (e = APR_BUCKET_NEXT(e);\n         e != APR_BRIGADE_SENTINEL(ctx->bb);\n         e = APR_BUCKET_NEXT(e))\n    {\n        apr_size_t off = 0, dlen;\n        const char *data;\n        apr_status_t s;\n        apreq_param_t *param = NULL;\n        if (APR_BUCKET_IS_EOS(e)) {\n            ctx->status = HDR_COMPLETE;\n            APR_BRIGADE_CONCAT(bb, ctx->bb);\n            return APR_SUCCESS;\n        }\n        s = apr_bucket_read(e, &data, &dlen, APR_BLOCK_READ);\n        if ( s != APR_SUCCESS ) {\n            ctx->status = HDR_ERROR;\n            return s;\n        }\n        if (dlen == 0)\n            continue;\n    parse_hdr_bucket:\n        switch (ctx->status) {\n        case HDR_NAME:\n            while (off < dlen) {\n                switch (data[off++]) {\n                case '\\n':\n                    if (off < dlen)\n                        apr_bucket_split(e, off);\n                    e = APR_BUCKET_NEXT(e);\n                    do {\n                        apr_bucket *f = APR_BRIGADE_FIRST(ctx->bb);\n                        apr_bucket_delete(f);\n                    } while (e != APR_BRIGADE_FIRST(ctx->bb));\n                    APR_BRIGADE_CONCAT(bb, ctx->bb);\n                    ctx->status = HDR_COMPLETE;\n                    return APR_SUCCESS;\n                case ':':\n                    if (off > 1) {\n                        apr_bucket_split(e, off - 1);\n                        dlen -= off - 1;\n                        data += off - 1;\n                        off = 1;\n                        e = APR_BUCKET_NEXT(e);\n                    }\n                    ++ctx->glen;\n                    ctx->status = HDR_GAP;\n                    goto parse_hdr_bucket;\n                default:\n                    ++ctx->nlen;\n                }\n            }\n            break;\n        case HDR_GAP:\n            while (off < dlen) {\n                switch (data[off++]) {\n                case ' ':\n                case '\\t':\n                    ++ctx->glen;\n                    break;\n                case '\\n':\n                    ctx->status = HDR_NEWLINE;\n                    goto parse_hdr_bucket;\n                default:\n                    ctx->status = HDR_VALUE;\n                    if (off > 1) {\n                        apr_bucket_split(e, off - 1);\n                        dlen -= off - 1;\n                        data += off - 1;\n                        off = 1;\n                        e = APR_BUCKET_NEXT(e);\n                    }\n                    ++ctx->vlen;\n                    goto parse_hdr_bucket;\n                }\n            }\n            break;\n        case HDR_VALUE:\n            while (off < dlen) {\n                ++ctx->vlen;\n                if (data[off++] == '\\n') {\n                    ctx->status = HDR_NEWLINE;\n                    goto parse_hdr_bucket;\n                }\n            }\n            break;\n        case HDR_NEWLINE:\n            if (off == dlen)\n                break;\n            else {\n                switch (data[off]) {\n                case ' ':\n                case '\\t':\n                    ctx->status = HDR_CONTINUE;\n                    ++off;\n                    ++ctx->vlen;\n                    break;\n                default:\n                    if (off > 0)\n                        apr_bucket_split(e, off);\n                    s = split_header_line(&param, pool, ctx->bb, ctx->nlen, ctx->glen, ctx->vlen);\n                    if (parser->hook != NULL && s == APR_SUCCESS)\n                        s = apreq_hook_run(parser->hook, param, NULL);\n                    if (s != APR_SUCCESS) {\n                        ctx->status = HDR_ERROR;\n                        return s;\n                    }\n                    apreq_value_table_add(&param->v, t);\n                    e = APR_BRIGADE_SENTINEL(ctx->bb);\n                    ctx->status = HDR_NAME;\n                    ctx->nlen = 0;\n                    ctx->vlen = 0;\n                    ctx->glen = 0;\n                    goto parse_hdr_brigade;\n                }\n            }\n        case HDR_CONTINUE:\n            while (off < dlen) {\n                switch (data[off++]) {\n                case ' ':\n                case '\\t':\n                    ++ctx->vlen;\n                    break;\n                case '\\n':\n                    ctx->status = HDR_NEWLINE;\n                    goto parse_hdr_bucket;\n                default:\n                    ctx->status = HDR_VALUE;\n                    ++ctx->vlen;\n                    goto parse_hdr_bucket;\n                }\n            }\n            break;\n        default:\n            ;\n        }\n    }\n    apreq_brigade_setaside(ctx->bb,pool);\n    return APR_INCOMPLETE;\n}", "static apr_status_t split_header_line(apreq_param_t **p,\n                                      apr_pool_t *pool,\n                                      apr_bucket_brigade *bb,\n                                      apr_size_t nlen,\n                                      apr_size_t glen,\n                                      apr_size_t vlen)\n{\n    apreq_param_t *param;\n    apreq_value_t *v;\n    apr_bucket *e, *f;\n    apr_status_t s;\n    struct iovec vec[APREQ_DEFAULT_NELTS], *iov, *end;\n    apr_array_header_t arr;\n    char *dest;\n    const char *data;\n    apr_size_t dlen;\n    if (nlen == 0)\n        return APR_EBADARG;\n    param = apreq_param_make(pool, NULL, nlen, NULL, vlen - 1);\n    *(const apreq_value_t **)&v = &param->v;\n    arr.pool     = pool;\n    arr.elt_size = sizeof(struct iovec);\n    arr.nelts    = 0;\n    arr.nalloc   = APREQ_DEFAULT_NELTS;\n    arr.elts     = (char *)vec;\n    e = APR_BRIGADE_FIRST(bb);\n    while (nlen > 0) {\n        apr_size_t len;\n        end = apr_array_push(&arr);\n        s = apr_bucket_read(e, (const char **)&end->iov_base,\n                            &len, APR_BLOCK_READ);\n        if (s != APR_SUCCESS)\n            return s;\n        assert(nlen >= len);\n        end->iov_len = len;\n        nlen -= len;\n        e = APR_BUCKET_NEXT(e);\n    }\n    while (glen > 0) {\n        s = apr_bucket_read(e, &data, &dlen, APR_BLOCK_READ);\n        if (s != APR_SUCCESS)\n            return s;\n        assert(glen >= dlen);\n        glen -= dlen;\n        e = APR_BUCKET_NEXT(e);\n    }\n    assert(vlen > 0);\n    dest = v->data;\n    while (vlen > 0) {\n        s = apr_bucket_read(e, &data, &dlen, APR_BLOCK_READ);\n        if (s != APR_SUCCESS)\n            return s;\n        memcpy(dest, data, dlen);\n        dest += dlen;\n        assert(vlen >= dlen);\n        vlen -= dlen;\n        e = APR_BUCKET_NEXT(e);\n    }\n    assert(dest[-1] == '\\n');\n    if (dest[-2] == '\\r')\n        --dest;\n    dest[-1] = 0;\n    v->dlen = (dest - v->data) - 1;\n    v->name = dest;\n    iov = (struct iovec *)arr.elts;\n    while (iov <= end) {\n        memcpy(dest, iov->iov_base, iov->iov_len);\n        dest += iov->iov_len;\n        ++iov;\n    }\n    *dest = 0;\n    while ((f = APR_BRIGADE_FIRST(bb)) != e)\n        apr_bucket_delete(f);\n    apreq_param_tainted_on(param);\n    *p = param;\n    return APR_SUCCESS;\n}"]