src/core/ngx_crypt.c:85: error: Integer Overflow L2
  ([1, 16] - [1, 16]):unsigned64 by call to `ngx_md5_update`.

src/core/ngx_crypt.c:85:37: Assignment
83. 
84.     for (n = keylen; n > 0; n -= 16) {
85.         ngx_md5_update(&md5, final, n > 16 ? 16 : n);
                                        ^
86.     }
87. 

src/core/ngx_crypt.c:85:9: Call
83. 
84.     for (n = keylen; n > 0; n -= 16) {
85.         ngx_md5_update(&md5, final, n > 16 ? 16 : n);
            ^
86.     }
87. 

src/core/ngx_md5.c:30:1: <LHS trace>
28. 
29. 
30. void
    ^
31. ngx_md5_update(ngx_md5_t *ctx, const void *data, size_t size)
32. {

src/core/ngx_md5.c:30:1: Parameter `size`
  28. 
  29. 
  30. void
      ^
  31. ngx_md5_update(ngx_md5_t *ctx, const void *data, size_t size)
  32. {

src/core/ngx_md5.c:30:1: <RHS trace>
28. 
29. 
30. void
    ^
31. ngx_md5_update(ngx_md5_t *ctx, const void *data, size_t size)
32. {

src/core/ngx_md5.c:30:1: Parameter `size`
  28. 
  29. 
  30. void
      ^
  31. ngx_md5_update(ngx_md5_t *ctx, const void *data, size_t size)
  32. {

src/core/ngx_md5.c:48:9: Binary operation: ([1, 16] - [1, 16]):unsigned64 by call to `ngx_md5_update` 
  46.         ngx_memcpy(&ctx->buffer[used], data, free);
  47.         data = (u_char *) data + free;
  48.         size -= free;
              ^
  49.         (void) ngx_md5_body(ctx, ctx->buffer, 64);
  50.     }

void
ngx_md5_update(ngx_md5_t *ctx, const void *data, size_t size)
{
    size_t  used, free;
    used = (size_t) (ctx->bytes & 0x3f);
    ctx->bytes += size;
    if (used) {
        free = 64 - used;
        if (size < free) {
            ngx_memcpy(&ctx->buffer[used], data, size);
            return;
        }
        ngx_memcpy(&ctx->buffer[used], data, free);
        data = (u_char *) data + free;
        size -= free;
        (void) ngx_md5_body(ctx, ctx->buffer, 64);
    }
    if (size >= 64) {
        data = ngx_md5_body(ctx, data, size & ~(size_t) 0x3f);
        size &= 0x3f;
    }
    ngx_memcpy(ctx->buffer, data, size);
}
['static ngx_int_t\nngx_crypt_apr1(ngx_pool_t *pool, u_char *key, u_char *salt, u_char **encrypted)\n{\n    ngx_int_t          n;\n    ngx_uint_t         i;\n    u_char            *p, *last, final[16];\n    size_t             saltlen, keylen;\n    ngx_md5_t          md5, ctx1;\n    keylen = ngx_strlen(key);\n    salt += sizeof("$apr1$") - 1;\n    last = salt + 8;\n    for (p = salt; *p && *p != \'$\' && p < last; p++) {   }\n    saltlen = p - salt;\n    ngx_md5_init(&md5);\n    ngx_md5_update(&md5, key, keylen);\n    ngx_md5_update(&md5, (u_char *) "$apr1$", sizeof("$apr1$") - 1);\n    ngx_md5_update(&md5, salt, saltlen);\n    ngx_md5_init(&ctx1);\n    ngx_md5_update(&ctx1, key, keylen);\n    ngx_md5_update(&ctx1, salt, saltlen);\n    ngx_md5_update(&ctx1, key, keylen);\n    ngx_md5_final(final, &ctx1);\n    for (n = keylen; n > 0; n -= 16) {\n        ngx_md5_update(&md5, final, n > 16 ? 16 : n);\n    }\n    ngx_memzero(final, sizeof(final));\n    for (i = keylen; i; i >>= 1) {\n        if (i & 1) {\n            ngx_md5_update(&md5, final, 1);\n        } else {\n            ngx_md5_update(&md5, key, 1);\n        }\n    }\n    ngx_md5_final(final, &md5);\n    for (i = 0; i < 1000; i++) {\n        ngx_md5_init(&ctx1);\n        if (i & 1) {\n            ngx_md5_update(&ctx1, key, keylen);\n        } else {\n            ngx_md5_update(&ctx1, final, 16);\n        }\n        if (i % 3) {\n            ngx_md5_update(&ctx1, salt, saltlen);\n        }\n        if (i % 7) {\n            ngx_md5_update(&ctx1, key, keylen);\n        }\n        if (i & 1) {\n            ngx_md5_update(&ctx1, final, 16);\n        } else {\n            ngx_md5_update(&ctx1, key, keylen);\n        }\n        ngx_md5_final(final, &ctx1);\n    }\n    *encrypted = ngx_pnalloc(pool, sizeof("$apr1$") - 1 + saltlen + 1 + 22 + 1);\n    if (*encrypted == NULL) {\n        return NGX_ERROR;\n    }\n    p = ngx_cpymem(*encrypted, "$apr1$", sizeof("$apr1$") - 1);\n    p = ngx_copy(p, salt, saltlen);\n    *p++ = \'$\';\n    p = ngx_crypt_to64(p, (final[ 0]<<16) | (final[ 6]<<8) | final[12], 4);\n    p = ngx_crypt_to64(p, (final[ 1]<<16) | (final[ 7]<<8) | final[13], 4);\n    p = ngx_crypt_to64(p, (final[ 2]<<16) | (final[ 8]<<8) | final[14], 4);\n    p = ngx_crypt_to64(p, (final[ 3]<<16) | (final[ 9]<<8) | final[15], 4);\n    p = ngx_crypt_to64(p, (final[ 4]<<16) | (final[10]<<8) | final[ 5], 4);\n    p = ngx_crypt_to64(p, final[11], 2);\n    *p = \'\\0\';\n    return NGX_OK;\n}', 'void\nngx_md5_update(ngx_md5_t *ctx, const void *data, size_t size)\n{\n    size_t  used, free;\n    used = (size_t) (ctx->bytes & 0x3f);\n    ctx->bytes += size;\n    if (used) {\n        free = 64 - used;\n        if (size < free) {\n            ngx_memcpy(&ctx->buffer[used], data, size);\n            return;\n        }\n        ngx_memcpy(&ctx->buffer[used], data, free);\n        data = (u_char *) data + free;\n        size -= free;\n        (void) ngx_md5_body(ctx, ctx->buffer, 64);\n    }\n    if (size >= 64) {\n        data = ngx_md5_body(ctx, data, size & ~(size_t) 0x3f);\n        size &= 0x3f;\n    }\n    ngx_memcpy(ctx->buffer, data, size);\n}']