src/http/modules/ngx_http_referer_module.c:498: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64 by call to `ngx_http_add_regex_referer`.

src/http/modules/ngx_http_referer_module.c:498:17: Call
496. 
497.         if (value[i].data[0] == '~') {
498.             if (ngx_http_add_regex_referer(cf, rlcf, &value[i]) != NGX_OK) {
                     ^
499.                 return NGX_CONF_ERROR;
500.             }

src/http/modules/ngx_http_referer_module.c:561:1: Parameter `name->len`
  559. 
  560. 
  561. static ngx_int_t
       ^
  562. ngx_http_add_regex_referer(ngx_conf_t *cf, ngx_http_referer_conf_t *rlcf,
  563.     ngx_str_t *name)

src/http/modules/ngx_http_referer_module.c:498:17: Call
496. 
497.         if (value[i].data[0] == '~') {
498.             if (ngx_http_add_regex_referer(cf, rlcf, &value[i]) != NGX_OK) {
                     ^
499.                 return NGX_CONF_ERROR;
500.             }

src/http/modules/ngx_http_referer_module.c:561:1: <LHS trace>
559. 
560. 
561. static ngx_int_t
     ^
562. ngx_http_add_regex_referer(ngx_conf_t *cf, ngx_http_referer_conf_t *rlcf,
563.     ngx_str_t *name)

src/http/modules/ngx_http_referer_module.c:561:1: Parameter `name->len`
  559. 
  560. 
  561. static ngx_int_t
       ^
  562. ngx_http_add_regex_referer(ngx_conf_t *cf, ngx_http_referer_conf_t *rlcf,
  563.     ngx_str_t *name)

src/http/modules/ngx_http_referer_module.c:587:5: Binary operation: ([0, +oo] - 1):unsigned64 by call to `ngx_http_add_regex_referer` 
  585.     }
  586. 
  587.     name->len--;
           ^
  588.     name->data++;
  589. 

static ngx_int_t
ngx_http_add_regex_referer(ngx_conf_t *cf, ngx_http_referer_conf_t *rlcf,
    ngx_str_t *name)
{
#if (NGX_PCRE)
    ngx_regex_elt_t      *re;
    ngx_regex_compile_t   rc;
    u_char                errstr[NGX_MAX_CONF_ERRSTR];
    if (name->len == 1) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "empty regex in \"%V\"", name);
        return NGX_ERROR;
    }
    if (rlcf->regex == NGX_CONF_UNSET_PTR) {
        rlcf->regex = ngx_array_create(cf->pool, 2, sizeof(ngx_regex_elt_t));
        if (rlcf->regex == NULL) {
            return NGX_ERROR;
        }
    }
    re = ngx_array_push(rlcf->regex);
    if (re == NULL) {
        return NGX_ERROR;
    }
    name->len--;
    name->data++;
    ngx_memzero(&rc, sizeof(ngx_regex_compile_t));
    rc.pattern = *name;
    rc.pool = cf->pool;
    rc.options = NGX_REGEX_CASELESS;
    rc.err.len = NGX_MAX_CONF_ERRSTR;
    rc.err.data = errstr;
    if (ngx_regex_compile(&rc) != NGX_OK) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "%V", &rc.err);
        return NGX_ERROR;
    }
    re->regex = rc.regex;
    re->name = name->data;
    return NGX_OK;
#else
    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                       "the using of the regex \"%V\" requires PCRE library",
                       name);
    return NGX_ERROR;
#endif
}
['static char *\nngx_http_valid_referers(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_referer_conf_t  *rlcf = conf;\n    u_char                    *p;\n    ngx_str_t                 *value, uri, name;\n    ngx_uint_t                 i, n;\n    ngx_http_variable_t       *var;\n    ngx_http_server_name_t    *sn;\n    ngx_http_core_srv_conf_t  *cscf;\n    ngx_str_set(&name, "invalid_referer");\n    var = ngx_http_add_variable(cf, &name, NGX_HTTP_VAR_CHANGEABLE);\n    if (var == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    var->get_handler = ngx_http_referer_variable;\n    if (rlcf->keys == NULL) {\n        rlcf->keys = ngx_pcalloc(cf->temp_pool, sizeof(ngx_hash_keys_arrays_t));\n        if (rlcf->keys == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        rlcf->keys->pool = cf->pool;\n        rlcf->keys->temp_pool = cf->pool;\n        if (ngx_hash_keys_array_init(rlcf->keys, NGX_HASH_SMALL) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    value = cf->args->elts;\n    for (i = 1; i < cf->args->nelts; i++) {\n        if (value[i].len == 0) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "invalid referer \\"%V\\"", &value[i]);\n            return NGX_CONF_ERROR;\n        }\n        if (ngx_strcmp(value[i].data, "none") == 0) {\n            rlcf->no_referer = 1;\n            continue;\n        }\n        if (ngx_strcmp(value[i].data, "blocked") == 0) {\n            rlcf->blocked_referer = 1;\n            continue;\n        }\n        ngx_str_null(&uri);\n        if (ngx_strcmp(value[i].data, "server_names") == 0) {\n            cscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_core_module);\n            sn = cscf->server_names.elts;\n            for (n = 0; n < cscf->server_names.nelts; n++) {\n#if (NGX_PCRE)\n                if (sn[n].regex) {\n                    if (ngx_http_add_regex_server_name(cf, rlcf, sn[n].regex)\n                        != NGX_OK)\n                    {\n                        return NGX_CONF_ERROR;\n                    }\n                    continue;\n                }\n#endif\n                if (ngx_http_add_referer(cf, rlcf->keys, &sn[n].name, &uri)\n                    != NGX_OK)\n                {\n                    return NGX_CONF_ERROR;\n                }\n            }\n            continue;\n        }\n        if (value[i].data[0] == \'~\') {\n            if (ngx_http_add_regex_referer(cf, rlcf, &value[i]) != NGX_OK) {\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        p = (u_char *) ngx_strchr(value[i].data, \'/\');\n        if (p) {\n            uri.len = (value[i].data + value[i].len) - p;\n            uri.data = p;\n            value[i].len = p - value[i].data;\n        }\n        if (ngx_http_add_referer(cf, rlcf->keys, &value[i], &uri) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    return NGX_CONF_OK;\n}', 'static ngx_int_t\nngx_http_add_regex_referer(ngx_conf_t *cf, ngx_http_referer_conf_t *rlcf,\n    ngx_str_t *name)\n{\n#if (NGX_PCRE)\n    ngx_regex_elt_t      *re;\n    ngx_regex_compile_t   rc;\n    u_char                errstr[NGX_MAX_CONF_ERRSTR];\n    if (name->len == 1) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "empty regex in \\"%V\\"", name);\n        return NGX_ERROR;\n    }\n    if (rlcf->regex == NGX_CONF_UNSET_PTR) {\n        rlcf->regex = ngx_array_create(cf->pool, 2, sizeof(ngx_regex_elt_t));\n        if (rlcf->regex == NULL) {\n            return NGX_ERROR;\n        }\n    }\n    re = ngx_array_push(rlcf->regex);\n    if (re == NULL) {\n        return NGX_ERROR;\n    }\n    name->len--;\n    name->data++;\n    ngx_memzero(&rc, sizeof(ngx_regex_compile_t));\n    rc.pattern = *name;\n    rc.pool = cf->pool;\n    rc.options = NGX_REGEX_CASELESS;\n    rc.err.len = NGX_MAX_CONF_ERRSTR;\n    rc.err.data = errstr;\n    if (ngx_regex_compile(&rc) != NGX_OK) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "%V", &rc.err);\n        return NGX_ERROR;\n    }\n    re->regex = rc.regex;\n    re->name = name->data;\n    return NGX_OK;\n#else\n    ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                       "the using of the regex \\"%V\\" requires PCRE library",\n                       name);\n    return NGX_ERROR;\n#endif\n}']