src/http/ngx_http_file_cache.c:1911: error: Integer Overflow L2
  ([0, +oo] - 64):unsigned64 by call to `ngx_slab_free_locked`.

src/http/ngx_http_file_cache.c:1911:9: Call
1909.         ngx_queue_remove(q);
1910.         ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);
1911.         ngx_slab_free_locked(cache->shpool, fcn);
              ^
1912.         cache->sh->count--;
1913.     }

src/core/ngx_slab.c:451:1: <LHS trace>
449. 
450. 
451. void
     ^
452. ngx_slab_free_locked(ngx_slab_pool_t *pool, void *p)
453. {

src/core/ngx_slab.c:451:1: Parameter `pool->stats->total`
  449. 
  450. 
  451. void
       ^
  452. ngx_slab_free_locked(ngx_slab_pool_t *pool, void *p)
  453. {

src/core/ngx_slab.c:561:13: Binary operation: ([0, +oo] - 64):unsigned64 by call to `ngx_slab_free_locked` 
  559.             ngx_slab_free_pages(pool, page, 1);
  560. 
  561.             pool->stats[slot].total -= sizeof(uintptr_t) * 8;
                   ^
  562. 
  563.             goto done;

void
ngx_slab_free_locked(ngx_slab_pool_t *pool, void *p)
{
    size_t            size;
    uintptr_t         slab, m, *bitmap;
    ngx_uint_t        i, n, type, slot, shift, map;
    ngx_slab_page_t  *slots, *page;
    ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0, "slab free: %p", p);
    if ((u_char *) p < pool->start || (u_char *) p > pool->end) {
        ngx_slab_error(pool, NGX_LOG_ALERT, "ngx_slab_free(): outside of pool");
        goto fail;
    }
    n = ((u_char *) p - pool->start) >> ngx_pagesize_shift;
    page = &pool->pages[n];
    slab = page->slab;
    type = ngx_slab_page_type(page);
    switch (type) {
    case NGX_SLAB_SMALL:
        shift = slab & NGX_SLAB_SHIFT_MASK;
        size = 1 << shift;
        if ((uintptr_t) p & (size - 1)) {
            goto wrong_chunk;
        }
        n = ((uintptr_t) p & (ngx_pagesize - 1)) >> shift;
        m = (uintptr_t) 1 << (n % (sizeof(uintptr_t) * 8));
        n /= sizeof(uintptr_t) * 8;
        bitmap = (uintptr_t *)
                             ((uintptr_t) p & ~((uintptr_t) ngx_pagesize - 1));
        if (bitmap[n] & m) {
            slot = shift - pool->min_shift;
            if (page->next == NULL) {
                slots = ngx_slab_slots(pool);
                page->next = slots[slot].next;
                slots[slot].next = page;
                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_SMALL;
                page->next->prev = (uintptr_t) page | NGX_SLAB_SMALL;
            }
            bitmap[n] &= ~m;
            n = (ngx_pagesize >> shift) / ((1 << shift) * 8);
            if (n == 0) {
                n = 1;
            }
            if (bitmap[0] & ~(((uintptr_t) 1 << n) - 1)) {
                goto done;
            }
            map = (ngx_pagesize >> shift) / (sizeof(uintptr_t) * 8);
            for (i = 1; i < map; i++) {
                if (bitmap[i]) {
                    goto done;
                }
            }
            ngx_slab_free_pages(pool, page, 1);
            pool->stats[slot].total -= (ngx_pagesize >> shift) - n;
            goto done;
        }
        goto chunk_already_free;
    case NGX_SLAB_EXACT:
        m = (uintptr_t) 1 <<
                (((uintptr_t) p & (ngx_pagesize - 1)) >> ngx_slab_exact_shift);
        size = ngx_slab_exact_size;
        if ((uintptr_t) p & (size - 1)) {
            goto wrong_chunk;
        }
        if (slab & m) {
            slot = ngx_slab_exact_shift - pool->min_shift;
            if (slab == NGX_SLAB_BUSY) {
                slots = ngx_slab_slots(pool);
                page->next = slots[slot].next;
                slots[slot].next = page;
                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_EXACT;
                page->next->prev = (uintptr_t) page | NGX_SLAB_EXACT;
            }
            page->slab &= ~m;
            if (page->slab) {
                goto done;
            }
            ngx_slab_free_pages(pool, page, 1);
            pool->stats[slot].total -= sizeof(uintptr_t) * 8;
            goto done;
        }
        goto chunk_already_free;
    case NGX_SLAB_BIG:
        shift = slab & NGX_SLAB_SHIFT_MASK;
        size = 1 << shift;
        if ((uintptr_t) p & (size - 1)) {
            goto wrong_chunk;
        }
        m = (uintptr_t) 1 << ((((uintptr_t) p & (ngx_pagesize - 1)) >> shift)
                              + NGX_SLAB_MAP_SHIFT);
        if (slab & m) {
            slot = shift - pool->min_shift;
            if (page->next == NULL) {
                slots = ngx_slab_slots(pool);
                page->next = slots[slot].next;
                slots[slot].next = page;
                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_BIG;
                page->next->prev = (uintptr_t) page | NGX_SLAB_BIG;
            }
            page->slab &= ~m;
            if (page->slab & NGX_SLAB_MAP_MASK) {
                goto done;
            }
            ngx_slab_free_pages(pool, page, 1);
            pool->stats[slot].total -= ngx_pagesize >> shift;
            goto done;
        }
        goto chunk_already_free;
    case NGX_SLAB_PAGE:
        if ((uintptr_t) p & (ngx_pagesize - 1)) {
            goto wrong_chunk;
        }
        if (!(slab & NGX_SLAB_PAGE_START)) {
            ngx_slab_error(pool, NGX_LOG_ALERT,
                           "ngx_slab_free(): page is already free");
            goto fail;
        }
        if (slab == NGX_SLAB_PAGE_BUSY) {
            ngx_slab_error(pool, NGX_LOG_ALERT,
                           "ngx_slab_free(): pointer to wrong page");
            goto fail;
        }
        n = ((u_char *) p - pool->start) >> ngx_pagesize_shift;
        size = slab & ~NGX_SLAB_PAGE_START;
        ngx_slab_free_pages(pool, &pool->pages[n], size);
        ngx_slab_junk(p, size << ngx_pagesize_shift);
        return;
    }
    return;
done:
    pool->stats[slot].used--;
    ngx_slab_junk(p, size);
    return;
wrong_chunk:
    ngx_slab_error(pool, NGX_LOG_ALERT,
                   "ngx_slab_free(): pointer to wrong chunk");
    goto fail;
chunk_already_free:
    ngx_slab_error(pool, NGX_LOG_ALERT,
                   "ngx_slab_free(): chunk is already free");
fail:
    return;
}
['static void\nngx_http_file_cache_delete(ngx_http_file_cache_t *cache, ngx_queue_t *q,\n    u_char *name)\n{\n    u_char                      *p;\n    size_t                       len;\n    ngx_path_t                  *path;\n    ngx_http_file_cache_node_t  *fcn;\n    fcn = ngx_queue_data(q, ngx_http_file_cache_node_t, queue);\n    if (fcn->exists) {\n        cache->sh->size -= fcn->fs_size;\n        path = cache->path;\n        p = name + path->name.len + 1 + path->len;\n        p = ngx_hex_dump(p, (u_char *) &fcn->node.key,\n                         sizeof(ngx_rbtree_key_t));\n        len = NGX_HTTP_CACHE_KEY_LEN - sizeof(ngx_rbtree_key_t);\n        p = ngx_hex_dump(p, fcn->key, len);\n        *p = \'\\0\';\n        fcn->count++;\n        fcn->deleting = 1;\n        ngx_shmtx_unlock(&cache->shpool->mutex);\n        len = path->name.len + 1 + path->len + 2 * NGX_HTTP_CACHE_KEY_LEN;\n        ngx_create_hashed_filename(path, name, len);\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,\n                       "http file cache expire: \\"%s\\"", name);\n        if (ngx_delete_file(name) == NGX_FILE_ERROR) {\n            ngx_log_error(NGX_LOG_CRIT, ngx_cycle->log, ngx_errno,\n                          ngx_delete_file_n " \\"%s\\" failed", name);\n        }\n        ngx_shmtx_lock(&cache->shpool->mutex);\n        fcn->count--;\n        fcn->deleting = 0;\n    }\n    if (fcn->count == 0) {\n        ngx_queue_remove(q);\n        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);\n        ngx_slab_free_locked(cache->shpool, fcn);\n        cache->sh->count--;\n    }\n}', 'void\nngx_slab_free_locked(ngx_slab_pool_t *pool, void *p)\n{\n    size_t            size;\n    uintptr_t         slab, m, *bitmap;\n    ngx_uint_t        i, n, type, slot, shift, map;\n    ngx_slab_page_t  *slots, *page;\n    ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0, "slab free: %p", p);\n    if ((u_char *) p < pool->start || (u_char *) p > pool->end) {\n        ngx_slab_error(pool, NGX_LOG_ALERT, "ngx_slab_free(): outside of pool");\n        goto fail;\n    }\n    n = ((u_char *) p - pool->start) >> ngx_pagesize_shift;\n    page = &pool->pages[n];\n    slab = page->slab;\n    type = ngx_slab_page_type(page);\n    switch (type) {\n    case NGX_SLAB_SMALL:\n        shift = slab & NGX_SLAB_SHIFT_MASK;\n        size = 1 << shift;\n        if ((uintptr_t) p & (size - 1)) {\n            goto wrong_chunk;\n        }\n        n = ((uintptr_t) p & (ngx_pagesize - 1)) >> shift;\n        m = (uintptr_t) 1 << (n % (sizeof(uintptr_t) * 8));\n        n /= sizeof(uintptr_t) * 8;\n        bitmap = (uintptr_t *)\n                             ((uintptr_t) p & ~((uintptr_t) ngx_pagesize - 1));\n        if (bitmap[n] & m) {\n            slot = shift - pool->min_shift;\n            if (page->next == NULL) {\n                slots = ngx_slab_slots(pool);\n                page->next = slots[slot].next;\n                slots[slot].next = page;\n                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_SMALL;\n                page->next->prev = (uintptr_t) page | NGX_SLAB_SMALL;\n            }\n            bitmap[n] &= ~m;\n            n = (ngx_pagesize >> shift) / ((1 << shift) * 8);\n            if (n == 0) {\n                n = 1;\n            }\n            if (bitmap[0] & ~(((uintptr_t) 1 << n) - 1)) {\n                goto done;\n            }\n            map = (ngx_pagesize >> shift) / (sizeof(uintptr_t) * 8);\n            for (i = 1; i < map; i++) {\n                if (bitmap[i]) {\n                    goto done;\n                }\n            }\n            ngx_slab_free_pages(pool, page, 1);\n            pool->stats[slot].total -= (ngx_pagesize >> shift) - n;\n            goto done;\n        }\n        goto chunk_already_free;\n    case NGX_SLAB_EXACT:\n        m = (uintptr_t) 1 <<\n                (((uintptr_t) p & (ngx_pagesize - 1)) >> ngx_slab_exact_shift);\n        size = ngx_slab_exact_size;\n        if ((uintptr_t) p & (size - 1)) {\n            goto wrong_chunk;\n        }\n        if (slab & m) {\n            slot = ngx_slab_exact_shift - pool->min_shift;\n            if (slab == NGX_SLAB_BUSY) {\n                slots = ngx_slab_slots(pool);\n                page->next = slots[slot].next;\n                slots[slot].next = page;\n                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_EXACT;\n                page->next->prev = (uintptr_t) page | NGX_SLAB_EXACT;\n            }\n            page->slab &= ~m;\n            if (page->slab) {\n                goto done;\n            }\n            ngx_slab_free_pages(pool, page, 1);\n            pool->stats[slot].total -= sizeof(uintptr_t) * 8;\n            goto done;\n        }\n        goto chunk_already_free;\n    case NGX_SLAB_BIG:\n        shift = slab & NGX_SLAB_SHIFT_MASK;\n        size = 1 << shift;\n        if ((uintptr_t) p & (size - 1)) {\n            goto wrong_chunk;\n        }\n        m = (uintptr_t) 1 << ((((uintptr_t) p & (ngx_pagesize - 1)) >> shift)\n                              + NGX_SLAB_MAP_SHIFT);\n        if (slab & m) {\n            slot = shift - pool->min_shift;\n            if (page->next == NULL) {\n                slots = ngx_slab_slots(pool);\n                page->next = slots[slot].next;\n                slots[slot].next = page;\n                page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_BIG;\n                page->next->prev = (uintptr_t) page | NGX_SLAB_BIG;\n            }\n            page->slab &= ~m;\n            if (page->slab & NGX_SLAB_MAP_MASK) {\n                goto done;\n            }\n            ngx_slab_free_pages(pool, page, 1);\n            pool->stats[slot].total -= ngx_pagesize >> shift;\n            goto done;\n        }\n        goto chunk_already_free;\n    case NGX_SLAB_PAGE:\n        if ((uintptr_t) p & (ngx_pagesize - 1)) {\n            goto wrong_chunk;\n        }\n        if (!(slab & NGX_SLAB_PAGE_START)) {\n            ngx_slab_error(pool, NGX_LOG_ALERT,\n                           "ngx_slab_free(): page is already free");\n            goto fail;\n        }\n        if (slab == NGX_SLAB_PAGE_BUSY) {\n            ngx_slab_error(pool, NGX_LOG_ALERT,\n                           "ngx_slab_free(): pointer to wrong page");\n            goto fail;\n        }\n        n = ((u_char *) p - pool->start) >> ngx_pagesize_shift;\n        size = slab & ~NGX_SLAB_PAGE_START;\n        ngx_slab_free_pages(pool, &pool->pages[n], size);\n        ngx_slab_junk(p, size << ngx_pagesize_shift);\n        return;\n    }\n    return;\ndone:\n    pool->stats[slot].used--;\n    ngx_slab_junk(p, size);\n    return;\nwrong_chunk:\n    ngx_slab_error(pool, NGX_LOG_ALERT,\n                   "ngx_slab_free(): pointer to wrong chunk");\n    goto fail;\nchunk_already_free:\n    ngx_slab_error(pool, NGX_LOG_ALERT,\n                   "ngx_slab_free(): chunk is already free");\nfail:\n    return;\n}']