src/http/modules/ngx_http_limit_req_module.c:237: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64.

src/http/modules/ngx_http_limit_req_module.c:241:13: <LHS trace>
239.             ngx_shmtx_unlock(&ctx->shpool->mutex);
240. 
241.             ctx->node = NULL;
                 ^
242.         }
243. 

src/http/modules/ngx_http_limit_req_module.c:241:13: Assignment
239.             ngx_shmtx_unlock(&ctx->shpool->mutex);
240. 
241.             ctx->node = NULL;
                 ^
242.         }
243. 

src/http/modules/ngx_http_limit_req_module.c:235:13: Call
233.             }
234. 
235.             ngx_shmtx_lock(&ctx->shpool->mutex);
                 ^
236. 
237.             ctx->node->count--;

src/core/ngx_shmtx.c:69:1: Parameter `mtx->spin`
  67. 
  68. 
  69. void
      ^
  70. ngx_shmtx_lock(ngx_shmtx_t *mtx)
  71. {

src/http/modules/ngx_http_limit_req_module.c:237:13: Binary operation: ([0, +oo] - 1):unsigned64
235.             ngx_shmtx_lock(&ctx->shpool->mutex);
236. 
237.             ctx->node->count--;
                 ^
238. 
239.             ngx_shmtx_unlock(&ctx->shpool->mutex);

static ngx_int_t
ngx_http_limit_req_handler(ngx_http_request_t *r)
{
    size_t                       len;
    uint32_t                     hash;
    ngx_int_t                    rc;
    ngx_uint_t                   n, excess;
    ngx_msec_t                   delay;
    ngx_http_variable_value_t   *vv;
    ngx_http_limit_req_ctx_t    *ctx;
    ngx_http_limit_req_conf_t   *lrcf;
    ngx_http_limit_req_limit_t  *limit, *limits;
    if (r->main->limit_req_set) {
        return NGX_DECLINED;
    }
    lrcf = ngx_http_get_module_loc_conf(r, ngx_http_limit_req_module);
    limits = lrcf->limits.elts;
    excess = 0;
    rc = NGX_DECLINED;
    for (n = 0; n < lrcf->limits.nelts; n++) {
        limit = &limits[n];
        ctx = limit->shm_zone->data;
        vv = ngx_http_get_indexed_variable(r, ctx->index);
        if (vv == NULL || vv->not_found) {
            continue;
        }
        len = vv->len;
        if (len == 0) {
            continue;
        }
        if (len > 65535) {
            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                          "the value of the \"%V\" variable "
                          "is more than 65535 bytes: \"%v\"",
                          &ctx->var, vv);
            continue;
        }
        hash = ngx_crc32_short(vv->data, len);
        ngx_shmtx_lock(&ctx->shpool->mutex);
        rc = ngx_http_limit_req_lookup(limit, hash, vv->data, len, &excess,
                                       (n == lrcf->limits.nelts - 1));
        ngx_shmtx_unlock(&ctx->shpool->mutex);
        ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                       "limit_req[%ui]: %i %ui.%03ui",
                       n, rc, excess / 1000, excess % 1000);
        if (rc != NGX_AGAIN) {
            break;
        }
    }
    if (rc == NGX_DECLINED) {
        return NGX_DECLINED;
    }
    r->main->limit_req_set = 1;
    if (rc == NGX_BUSY || rc == NGX_ERROR) {
        if (rc == NGX_BUSY) {
            ngx_log_error(lrcf->limit_log_level, r->connection->log, 0,
                          "limiting requests, excess: %ui.%03ui by zone \"%V\"",
                          excess / 1000, excess % 1000,
                          &limit->shm_zone->shm.name);
        }
        while (n--) {
            ctx = limits[n].shm_zone->data;
            if (ctx->node == NULL) {
                continue;
            }
            ngx_shmtx_lock(&ctx->shpool->mutex);
            ctx->node->count--;
            ngx_shmtx_unlock(&ctx->shpool->mutex);
            ctx->node = NULL;
        }
        return NGX_HTTP_SERVICE_UNAVAILABLE;
    }
    if (rc == NGX_AGAIN) {
        excess = 0;
    }
    delay = ngx_http_limit_req_account(limits, n, &excess, &limit);
    if (!delay) {
        return NGX_DECLINED;
    }
    ngx_log_error(lrcf->delay_log_level, r->connection->log, 0,
                  "delaying request, excess: %ui.%03ui, by zone \"%V\"",
                  excess / 1000, excess % 1000, &limit->shm_zone->shm.name);
    if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {
        return NGX_HTTP_INTERNAL_SERVER_ERROR;
    }
    r->read_event_handler = ngx_http_test_reading;
    r->write_event_handler = ngx_http_limit_req_delay;
    ngx_add_timer(r->connection->write, delay);
    return NGX_AGAIN;
}
['static ngx_int_t\nngx_http_limit_req_handler(ngx_http_request_t *r)\n{\n    size_t                       len;\n    uint32_t                     hash;\n    ngx_int_t                    rc;\n    ngx_uint_t                   n, excess;\n    ngx_msec_t                   delay;\n    ngx_http_variable_value_t   *vv;\n    ngx_http_limit_req_ctx_t    *ctx;\n    ngx_http_limit_req_conf_t   *lrcf;\n    ngx_http_limit_req_limit_t  *limit, *limits;\n    if (r->main->limit_req_set) {\n        return NGX_DECLINED;\n    }\n    lrcf = ngx_http_get_module_loc_conf(r, ngx_http_limit_req_module);\n    limits = lrcf->limits.elts;\n    excess = 0;\n    rc = NGX_DECLINED;\n    for (n = 0; n < lrcf->limits.nelts; n++) {\n        limit = &limits[n];\n        ctx = limit->shm_zone->data;\n        vv = ngx_http_get_indexed_variable(r, ctx->index);\n        if (vv == NULL || vv->not_found) {\n            continue;\n        }\n        len = vv->len;\n        if (len == 0) {\n            continue;\n        }\n        if (len > 65535) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "the value of the \\"%V\\" variable "\n                          "is more than 65535 bytes: \\"%v\\"",\n                          &ctx->var, vv);\n            continue;\n        }\n        hash = ngx_crc32_short(vv->data, len);\n        ngx_shmtx_lock(&ctx->shpool->mutex);\n        rc = ngx_http_limit_req_lookup(limit, hash, vv->data, len, &excess,\n                                       (n == lrcf->limits.nelts - 1));\n        ngx_shmtx_unlock(&ctx->shpool->mutex);\n        ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "limit_req[%ui]: %i %ui.%03ui",\n                       n, rc, excess / 1000, excess % 1000);\n        if (rc != NGX_AGAIN) {\n            break;\n        }\n    }\n    if (rc == NGX_DECLINED) {\n        return NGX_DECLINED;\n    }\n    r->main->limit_req_set = 1;\n    if (rc == NGX_BUSY || rc == NGX_ERROR) {\n        if (rc == NGX_BUSY) {\n            ngx_log_error(lrcf->limit_log_level, r->connection->log, 0,\n                          "limiting requests, excess: %ui.%03ui by zone \\"%V\\"",\n                          excess / 1000, excess % 1000,\n                          &limit->shm_zone->shm.name);\n        }\n        while (n--) {\n            ctx = limits[n].shm_zone->data;\n            if (ctx->node == NULL) {\n                continue;\n            }\n            ngx_shmtx_lock(&ctx->shpool->mutex);\n            ctx->node->count--;\n            ngx_shmtx_unlock(&ctx->shpool->mutex);\n            ctx->node = NULL;\n        }\n        return NGX_HTTP_SERVICE_UNAVAILABLE;\n    }\n    if (rc == NGX_AGAIN) {\n        excess = 0;\n    }\n    delay = ngx_http_limit_req_account(limits, n, &excess, &limit);\n    if (!delay) {\n        return NGX_DECLINED;\n    }\n    ngx_log_error(lrcf->delay_log_level, r->connection->log, 0,\n                  "delaying request, excess: %ui.%03ui, by zone \\"%V\\"",\n                  excess / 1000, excess % 1000, &limit->shm_zone->shm.name);\n    if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {\n        return NGX_HTTP_INTERNAL_SERVER_ERROR;\n    }\n    r->read_event_handler = ngx_http_test_reading;\n    r->write_event_handler = ngx_http_limit_req_delay;\n    ngx_add_timer(r->connection->write, delay);\n    return NGX_AGAIN;\n}', 'void\nngx_shmtx_lock(ngx_shmtx_t *mtx)\n{\n    ngx_uint_t         i, n;\n    ngx_log_debug0(NGX_LOG_DEBUG_CORE, ngx_cycle->log, 0, "shmtx lock");\n    for ( ;; ) {\n        if (*mtx->lock == 0 && ngx_atomic_cmp_set(mtx->lock, 0, ngx_pid)) {\n            return;\n        }\n        if (ngx_ncpu > 1) {\n            for (n = 1; n < mtx->spin; n <<= 1) {\n                for (i = 0; i < n; i++) {\n                    ngx_cpu_pause();\n                }\n                if (*mtx->lock == 0\n                    && ngx_atomic_cmp_set(mtx->lock, 0, ngx_pid))\n                {\n                    return;\n                }\n            }\n        }\n#if (NGX_HAVE_POSIX_SEM)\n        if (mtx->semaphore) {\n            (void) ngx_atomic_fetch_add(mtx->wait, 1);\n            if (*mtx->lock == 0 && ngx_atomic_cmp_set(mtx->lock, 0, ngx_pid)) {\n                return;\n            }\n            ngx_log_debug1(NGX_LOG_DEBUG_CORE, ngx_cycle->log, 0,\n                           "shmtx wait %uA", *mtx->wait);\n            while (sem_wait(&mtx->sem) == -1) {\n                ngx_err_t  err;\n                err = ngx_errno;\n                if (err != NGX_EINTR) {\n                    ngx_log_error(NGX_LOG_ALERT, ngx_cycle->log, err,\n                                  "sem_wait() failed while waiting on shmtx");\n                    break;\n                }\n                ngx_log_debug0(NGX_LOG_DEBUG_CORE, ngx_cycle->log, 0,\n                               "shmtx awoke");\n            }\n            continue;\n        }\n#endif\n        ngx_sched_yield();\n    }\n}']