src/http/modules/ngx_http_limit_req_module.c:797: error: Integer Overflow L2
  ([-3, +oo] - 5):unsigned64.

src/http/modules/ngx_http_limit_req_module.c:809:13: <LHS trace>
807.         if (value[i].data[0] == '$') {
808. 
809.             value[i].len--;
                 ^
810.             value[i].data++;
811. 

src/http/modules/ngx_http_limit_req_module.c:809:13: Assignment
807.         if (value[i].data[0] == '$') {
808. 
809.             value[i].len--;
                 ^
810.             value[i].data++;
811. 

src/http/modules/ngx_http_limit_req_module.c:817:26: Call
815.             }
816. 
817.             ctx->index = ngx_http_get_variable_index(cf, &value[i]);
                              ^
818.             if (ctx->index == NGX_ERROR) {
819.                 return NGX_CONF_ERROR;

src/http/ngx_http_variables.c:420:1: Parameter `name->len`
  418. 
  419. 
  420. ngx_int_t
       ^
  421. ngx_http_get_variable_index(ngx_conf_t *cf, ngx_str_t *name)
  422. {

src/http/modules/ngx_http_limit_req_module.c:785:13: Assignment
783.         if (ngx_strncmp(value[i].data, "rate=", 5) == 0) {
784. 
785.             len = value[i].len;
                 ^
786.             p = value[i].data + len - 3;
787. 

src/http/modules/ngx_http_limit_req_module.c:797:20: Binary operation: ([-3, +oo] - 5):unsigned64
795.             }
796. 
797.             rate = ngx_atoi(value[i].data + 5, len - 5);
                        ^
798.             if (rate <= 0) {
799.                 ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,

static char *
ngx_http_limit_req_zone(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    u_char                    *p;
    size_t                     len;
    ssize_t                    size;
    ngx_str_t                 *value, name, s;
    ngx_int_t                  rate, scale;
    ngx_uint_t                 i;
    ngx_shm_zone_t            *shm_zone;
    ngx_http_limit_req_ctx_t  *ctx;
    value = cf->args->elts;
    ctx = NULL;
    size = 0;
    rate = 1;
    scale = 1;
    name.len = 0;
    for (i = 1; i < cf->args->nelts; i++) {
        if (ngx_strncmp(value[i].data, "zone=", 5) == 0) {
            name.data = value[i].data + 5;
            p = (u_char *) ngx_strchr(name.data, ':');
            if (p == NULL) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid zone size \"%V\"", &value[i]);
                return NGX_CONF_ERROR;
            }
            name.len = p - name.data;
            s.data = p + 1;
            s.len = value[i].data + value[i].len - s.data;
            size = ngx_parse_size(&s);
            if (size == NGX_ERROR) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid zone size \"%V\"", &value[i]);
                return NGX_CONF_ERROR;
            }
            if (size < (ssize_t) (8 * ngx_pagesize)) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "zone \"%V\" is too small", &value[i]);
                return NGX_CONF_ERROR;
            }
            continue;
        }
        if (ngx_strncmp(value[i].data, "rate=", 5) == 0) {
            len = value[i].len;
            p = value[i].data + len - 3;
            if (ngx_strncmp(p, "r/s", 3) == 0) {
                scale = 1;
                len -= 3;
            } else if (ngx_strncmp(p, "r/m", 3) == 0) {
                scale = 60;
                len -= 3;
            }
            rate = ngx_atoi(value[i].data + 5, len - 5);
            if (rate <= 0) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid rate \"%V\"", &value[i]);
                return NGX_CONF_ERROR;
            }
            continue;
        }
        if (value[i].data[0] == '$') {
            value[i].len--;
            value[i].data++;
            ctx = ngx_pcalloc(cf->pool, sizeof(ngx_http_limit_req_ctx_t));
            if (ctx == NULL) {
                return NGX_CONF_ERROR;
            }
            ctx->index = ngx_http_get_variable_index(cf, &value[i]);
            if (ctx->index == NGX_ERROR) {
                return NGX_CONF_ERROR;
            }
            ctx->var = value[i];
            continue;
        }
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "invalid parameter \"%V\"", &value[i]);
        return NGX_CONF_ERROR;
    }
    if (name.len == 0) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "\"%V\" must have \"zone\" parameter",
                           &cmd->name);
        return NGX_CONF_ERROR;
    }
    if (ctx == NULL) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "no variable is defined for %V \"%V\"",
                           &cmd->name, &name);
        return NGX_CONF_ERROR;
    }
    ctx->rate = rate * 1000 / scale;
    shm_zone = ngx_shared_memory_add(cf, &name, size,
                                     &ngx_http_limit_req_module);
    if (shm_zone == NULL) {
        return NGX_CONF_ERROR;
    }
    if (shm_zone->data) {
        ctx = shm_zone->data;
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "%V \"%V\" is already bound to variable \"%V\"",
                           &cmd->name, &name, &ctx->var);
        return NGX_CONF_ERROR;
    }
    shm_zone->init = ngx_http_limit_req_init_zone;
    shm_zone->data = ctx;
    return NGX_CONF_OK;
}
['static char *\nngx_http_limit_req_zone(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    u_char                    *p;\n    size_t                     len;\n    ssize_t                    size;\n    ngx_str_t                 *value, name, s;\n    ngx_int_t                  rate, scale;\n    ngx_uint_t                 i;\n    ngx_shm_zone_t            *shm_zone;\n    ngx_http_limit_req_ctx_t  *ctx;\n    value = cf->args->elts;\n    ctx = NULL;\n    size = 0;\n    rate = 1;\n    scale = 1;\n    name.len = 0;\n    for (i = 1; i < cf->args->nelts; i++) {\n        if (ngx_strncmp(value[i].data, "zone=", 5) == 0) {\n            name.data = value[i].data + 5;\n            p = (u_char *) ngx_strchr(name.data, \':\');\n            if (p == NULL) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid zone size \\"%V\\"", &value[i]);\n                return NGX_CONF_ERROR;\n            }\n            name.len = p - name.data;\n            s.data = p + 1;\n            s.len = value[i].data + value[i].len - s.data;\n            size = ngx_parse_size(&s);\n            if (size == NGX_ERROR) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid zone size \\"%V\\"", &value[i]);\n                return NGX_CONF_ERROR;\n            }\n            if (size < (ssize_t) (8 * ngx_pagesize)) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "zone \\"%V\\" is too small", &value[i]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "rate=", 5) == 0) {\n            len = value[i].len;\n            p = value[i].data + len - 3;\n            if (ngx_strncmp(p, "r/s", 3) == 0) {\n                scale = 1;\n                len -= 3;\n            } else if (ngx_strncmp(p, "r/m", 3) == 0) {\n                scale = 60;\n                len -= 3;\n            }\n            rate = ngx_atoi(value[i].data + 5, len - 5);\n            if (rate <= 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid rate \\"%V\\"", &value[i]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (value[i].data[0] == \'$\') {\n            value[i].len--;\n            value[i].data++;\n            ctx = ngx_pcalloc(cf->pool, sizeof(ngx_http_limit_req_ctx_t));\n            if (ctx == NULL) {\n                return NGX_CONF_ERROR;\n            }\n            ctx->index = ngx_http_get_variable_index(cf, &value[i]);\n            if (ctx->index == NGX_ERROR) {\n                return NGX_CONF_ERROR;\n            }\n            ctx->var = value[i];\n            continue;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[i]);\n        return NGX_CONF_ERROR;\n    }\n    if (name.len == 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "\\"%V\\" must have \\"zone\\" parameter",\n                           &cmd->name);\n        return NGX_CONF_ERROR;\n    }\n    if (ctx == NULL) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "no variable is defined for %V \\"%V\\"",\n                           &cmd->name, &name);\n        return NGX_CONF_ERROR;\n    }\n    ctx->rate = rate * 1000 / scale;\n    shm_zone = ngx_shared_memory_add(cf, &name, size,\n                                     &ngx_http_limit_req_module);\n    if (shm_zone == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    if (shm_zone->data) {\n        ctx = shm_zone->data;\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "%V \\"%V\\" is already bound to variable \\"%V\\"",\n                           &cmd->name, &name, &ctx->var);\n        return NGX_CONF_ERROR;\n    }\n    shm_zone->init = ngx_http_limit_req_init_zone;\n    shm_zone->data = ctx;\n    return NGX_CONF_OK;\n}', 'ngx_int_t\nngx_http_get_variable_index(ngx_conf_t *cf, ngx_str_t *name)\n{\n    ngx_uint_t                  i;\n    ngx_http_variable_t        *v;\n    ngx_http_core_main_conf_t  *cmcf;\n    if (name->len == 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid variable name \\"$\\"");\n        return NGX_ERROR;\n    }\n    cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);\n    v = cmcf->variables.elts;\n    if (v == NULL) {\n        if (ngx_array_init(&cmcf->variables, cf->pool, 4,\n                           sizeof(ngx_http_variable_t))\n            != NGX_OK)\n        {\n            return NGX_ERROR;\n        }\n    } else {\n        for (i = 0; i < cmcf->variables.nelts; i++) {\n            if (name->len != v[i].name.len\n                || ngx_strncasecmp(name->data, v[i].name.data, name->len) != 0)\n            {\n                continue;\n            }\n            return i;\n        }\n    }\n    v = ngx_array_push(&cmcf->variables);\n    if (v == NULL) {\n        return NGX_ERROR;\n    }\n    v->name.len = name->len;\n    v->name.data = ngx_pnalloc(cf->pool, name->len);\n    if (v->name.data == NULL) {\n        return NGX_ERROR;\n    }\n    ngx_strlow(v->name.data, name->data, name->len);\n    v->set_handler = NULL;\n    v->get_handler = NULL;\n    v->data = 0;\n    v->flags = 0;\n    v->index = cmcf->variables.nelts - 1;\n    return v->index;\n}']