src/http/modules/ngx_http_log_module.c:940: error: Integer Overflow L2
  ([0, +oo] - 7):unsigned64.

src/http/modules/ngx_http_log_module.c:865:9: <LHS trace>
863.     ngx_memzero(log, sizeof(ngx_http_log_t));
864. 
865.     n = ngx_http_script_variables_count(&value[1]);
             ^
866. 
867.     if (n == 0) {

src/http/modules/ngx_http_log_module.c:865:9: Call
863.     ngx_memzero(log, sizeof(ngx_http_log_t));
864. 
865.     n = ngx_http_script_variables_count(&value[1]);
             ^
866. 
867.     if (n == 0) {

src/http/ngx_http_script.c:214:1: Parameter `value->len`
  212. 
  213. 
  214. ngx_uint_t
       ^
  215. ngx_http_script_variables_count(ngx_str_t *value)
  216. {

src/http/modules/ngx_http_log_module.c:868:21: Call
866. 
867.     if (n == 0) {
868.         log->file = ngx_conf_open_file(cf->cycle, &value[1]);
                         ^
869.         if (log->file == NULL) {
870.             return NGX_CONF_ERROR;

src/core/ngx_conf_file.c:897:1: Parameter `name->len`
  895. 
  896. 
  897. ngx_open_file_t *
       ^
  898. ngx_conf_open_file(ngx_cycle_t *cycle, ngx_str_t *name)
  899. {

src/http/modules/ngx_http_log_module.c:940:9: Binary operation: ([0, +oo] - 7):unsigned64
938.         }
939. 
940.         name.len = value[3].len - 7;
             ^
941.         name.data = value[3].data + 7;
942. 

static char *
ngx_http_log_set_log(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    ngx_http_log_loc_conf_t *llcf = conf;
    ssize_t                     buf;
    ngx_uint_t                  i, n;
    ngx_str_t                  *value, name;
    ngx_http_log_t             *log;
    ngx_http_log_fmt_t         *fmt;
    ngx_http_log_main_conf_t   *lmcf;
    ngx_http_script_compile_t   sc;
    value = cf->args->elts;
    if (ngx_strcmp(value[1].data, "off") == 0) {
        llcf->off = 1;
        if (cf->args->nelts == 2) {
            return NGX_CONF_OK;
        }
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "invalid parameter \"%V\"", &value[2]);
        return NGX_CONF_ERROR;
    }
    if (llcf->logs == NULL) {
        llcf->logs = ngx_array_create(cf->pool, 2, sizeof(ngx_http_log_t));
        if (llcf->logs == NULL) {
            return NGX_CONF_ERROR;
        }
    }
    lmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_log_module);
    log = ngx_array_push(llcf->logs);
    if (log == NULL) {
        return NGX_CONF_ERROR;
    }
    ngx_memzero(log, sizeof(ngx_http_log_t));
    n = ngx_http_script_variables_count(&value[1]);
    if (n == 0) {
        log->file = ngx_conf_open_file(cf->cycle, &value[1]);
        if (log->file == NULL) {
            return NGX_CONF_ERROR;
        }
    } else {
        if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {
            return NGX_CONF_ERROR;
        }
        log->script = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_script_t));
        if (log->script == NULL) {
            return NGX_CONF_ERROR;
        }
        ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));
        sc.cf = cf;
        sc.source = &value[1];
        sc.lengths = &log->script->lengths;
        sc.values = &log->script->values;
        sc.variables = n;
        sc.complete_lengths = 1;
        sc.complete_values = 1;
        if (ngx_http_script_compile(&sc) != NGX_OK) {
            return NGX_CONF_ERROR;
        }
    }
    if (cf->args->nelts >= 3) {
        name = value[2];
        if (ngx_strcmp(name.data, "combined") == 0) {
            lmcf->combined_used = 1;
        }
    } else {
        name.len = sizeof("combined") - 1;
        name.data = (u_char *) "combined";
        lmcf->combined_used = 1;
    }
    fmt = lmcf->formats.elts;
    for (i = 0; i < lmcf->formats.nelts; i++) {
        if (fmt[i].name.len == name.len
            && ngx_strcasecmp(fmt[i].name.data, name.data) == 0)
        {
            log->format = &fmt[i];
            goto buffer;
        }
    }
    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                       "unknown log format \"%V\"", &name);
    return NGX_CONF_ERROR;
buffer:
    if (cf->args->nelts == 4) {
        if (ngx_strncmp(value[3].data, "buffer=", 7) != 0) {
            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                               "invalid parameter \"%V\"", &value[3]);
            return NGX_CONF_ERROR;
        }
        if (log->script) {
            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                               "buffered logs can not have variables in name");
            return NGX_CONF_ERROR;
        }
        name.len = value[3].len - 7;
        name.data = value[3].data + 7;
        buf = ngx_parse_size(&name);
        if (buf == NGX_ERROR) {
            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                               "invalid parameter \"%V\"", &value[3]);
            return NGX_CONF_ERROR;
        }
        if (log->file->buffer && log->file->last - log->file->pos != buf) {
            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                               "access_log \"%V\" already defined "
                               "with different buffer size", &value[1]);
            return NGX_CONF_ERROR;
        }
        log->file->buffer = ngx_palloc(cf->pool, buf);
        if (log->file->buffer == NULL) {
            return NGX_CONF_ERROR;
        }
        log->file->pos = log->file->buffer;
        log->file->last = log->file->buffer + buf;
    }
    return NGX_CONF_OK;
}
['static char *\nngx_http_log_set_log(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_log_loc_conf_t *llcf = conf;\n    ssize_t                     buf;\n    ngx_uint_t                  i, n;\n    ngx_str_t                  *value, name;\n    ngx_http_log_t             *log;\n    ngx_http_log_fmt_t         *fmt;\n    ngx_http_log_main_conf_t   *lmcf;\n    ngx_http_script_compile_t   sc;\n    value = cf->args->elts;\n    if (ngx_strcmp(value[1].data, "off") == 0) {\n        llcf->off = 1;\n        if (cf->args->nelts == 2) {\n            return NGX_CONF_OK;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (llcf->logs == NULL) {\n        llcf->logs = ngx_array_create(cf->pool, 2, sizeof(ngx_http_log_t));\n        if (llcf->logs == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    lmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_log_module);\n    log = ngx_array_push(llcf->logs);\n    if (log == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    ngx_memzero(log, sizeof(ngx_http_log_t));\n    n = ngx_http_script_variables_count(&value[1]);\n    if (n == 0) {\n        log->file = ngx_conf_open_file(cf->cycle, &value[1]);\n        if (log->file == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    } else {\n        if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n        log->script = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_script_t));\n        if (log->script == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n        sc.cf = cf;\n        sc.source = &value[1];\n        sc.lengths = &log->script->lengths;\n        sc.values = &log->script->values;\n        sc.variables = n;\n        sc.complete_lengths = 1;\n        sc.complete_values = 1;\n        if (ngx_http_script_compile(&sc) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    if (cf->args->nelts >= 3) {\n        name = value[2];\n        if (ngx_strcmp(name.data, "combined") == 0) {\n            lmcf->combined_used = 1;\n        }\n    } else {\n        name.len = sizeof("combined") - 1;\n        name.data = (u_char *) "combined";\n        lmcf->combined_used = 1;\n    }\n    fmt = lmcf->formats.elts;\n    for (i = 0; i < lmcf->formats.nelts; i++) {\n        if (fmt[i].name.len == name.len\n            && ngx_strcasecmp(fmt[i].name.data, name.data) == 0)\n        {\n            log->format = &fmt[i];\n            goto buffer;\n        }\n    }\n    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                       "unknown log format \\"%V\\"", &name);\n    return NGX_CONF_ERROR;\nbuffer:\n    if (cf->args->nelts == 4) {\n        if (ngx_strncmp(value[3].data, "buffer=", 7) != 0) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "invalid parameter \\"%V\\"", &value[3]);\n            return NGX_CONF_ERROR;\n        }\n        if (log->script) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "buffered logs can not have variables in name");\n            return NGX_CONF_ERROR;\n        }\n        name.len = value[3].len - 7;\n        name.data = value[3].data + 7;\n        buf = ngx_parse_size(&name);\n        if (buf == NGX_ERROR) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "invalid parameter \\"%V\\"", &value[3]);\n            return NGX_CONF_ERROR;\n        }\n        if (log->file->buffer && log->file->last - log->file->pos != buf) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "access_log \\"%V\\" already defined "\n                               "with different buffer size", &value[1]);\n            return NGX_CONF_ERROR;\n        }\n        log->file->buffer = ngx_palloc(cf->pool, buf);\n        if (log->file->buffer == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        log->file->pos = log->file->buffer;\n        log->file->last = log->file->buffer + buf;\n    }\n    return NGX_CONF_OK;\n}', "ngx_uint_t\nngx_http_script_variables_count(ngx_str_t *value)\n{\n    ngx_uint_t  i, n;\n    for (n = 0, i = 0; i < value->len; i++) {\n        if (value->data[i] == '$') {\n            n++;\n        }\n    }\n    return n;\n}", 'ngx_open_file_t *\nngx_conf_open_file(ngx_cycle_t *cycle, ngx_str_t *name)\n{\n    ngx_str_t         full;\n    ngx_uint_t        i;\n    ngx_list_part_t  *part;\n    ngx_open_file_t  *file;\n#if (NGX_SUPPRESS_WARN)\n    full.len = 0;\n    full.data = NULL;\n#endif\n    if (name->len) {\n        full = *name;\n        if (ngx_conf_full_name(cycle, &full, 0) != NGX_OK) {\n            return NULL;\n        }\n        part = &cycle->open_files.part;\n        file = part->elts;\n        for (i = 0;   ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                file = part->elts;\n                i = 0;\n            }\n            if (full.len != file[i].name.len) {\n                continue;\n            }\n            if (ngx_strcmp(full.data, file[i].name.data) == 0) {\n                return &file[i];\n            }\n        }\n    }\n    file = ngx_list_push(&cycle->open_files);\n    if (file == NULL) {\n        return NULL;\n    }\n    if (name->len) {\n        file->fd = NGX_INVALID_FILE;\n        file->name = full;\n    } else {\n        file->fd = ngx_stderr;\n        file->name = *name;\n    }\n    file->buffer = NULL;\n    return file;\n}']