server/protocol.c:967: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `read_request_line`.

server/protocol.c:962:14: Unknown value from: apr_brigade_create
960.     r->useragent_ip = conn->client_ip;
961. 
962.     tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
                  ^
963. 
964.     ap_run_pre_read_request(r, conn);

server/protocol.c:967:10: Call
965. 
966.     /* Get the request... */
967.     if (!read_request_line(r, tmp_bb)) {
              ^
968.         if (r->status == HTTP_REQUEST_URI_TOO_LARGE
969.             || r->status == HTTP_BAD_REQUEST) {

server/protocol.c:558:1: Parameter `r->server->limit_req_line`
  556. }
  557. 
  558. static int read_request_line(request_rec *r, apr_bucket_brigade *bb)
       ^
  559. {
  560.     const char *ll;

server/protocol.c:599:14: Call
  597.          */
  598.         r->the_request = NULL;
  599.         rv = ap_rgetline(&(r->the_request), (apr_size_t)(r->server->limit_req_line + 2),
                    ^
  600.                          &len, r, 0, bb);
  601. 

server/protocol.c:212:1: <LHS trace>
210.  *        or a full buffer, that's considered an error.
211.  */
212. AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
     ^
213.                                           apr_size_t *read, request_rec *r,
214.                                           int fold, apr_bucket_brigade *bb)

server/protocol.c:212:1: Parameter `n`
    210.  *        or a full buffer, that's considered an error.
    211.  */
    212. AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
         ^
    213.                                           apr_size_t *read, request_rec *r,
    214.                                           int fold, apr_bucket_brigade *bb)

server/protocol.c:388:21: Binary operation: ([0, +oo] - 1):unsigned64 by call to `read_request_line` 
    386.                     *read = n;
    387.                     /* ensure this string is terminated */
    388.                     (*s)[n-1] = '\0';
                             ^
    389.                     return APR_ENOSPC;
    390.                 }

AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
                                          apr_size_t *read, request_rec *r,
                                          int fold, apr_bucket_brigade *bb)
{
    apr_status_t rv;
    apr_bucket *e;
    apr_size_t bytes_handled = 0, current_alloc = 0;
    char *pos, *last_char = *s;
    int do_alloc = (*s == NULL), saw_eos = 0;
    if (last_char)
        *last_char = '\0';
    for (;;) {
        apr_brigade_cleanup(bb);
        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_GETLINE,
                            APR_BLOCK_READ, 0);
        if (rv != APR_SUCCESS) {
            return rv;
        }
        if (APR_BRIGADE_EMPTY(bb)) {
            return APR_EGENERAL;
        }
        for (e = APR_BRIGADE_FIRST(bb);
             e != APR_BRIGADE_SENTINEL(bb);
             e = APR_BUCKET_NEXT(e))
        {
            const char *str;
            apr_size_t len;
            if (APR_BUCKET_IS_EOS(e)) {
                saw_eos = 1;
                break;
            }
            rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ);
            if (rv != APR_SUCCESS) {
                return rv;
            }
            if (len == 0) {
                continue;
            }
            if (n < bytes_handled + len) {
                *read = bytes_handled;
                if (*s) {
                    if (bytes_handled > 0) {
                        (*s)[bytes_handled-1] = '\0';
                    }
                    else {
                        (*s)[0] = '\0';
                    }
                }
                return APR_ENOSPC;
            }
            if (do_alloc) {
                if (!*s) {
                    current_alloc = len;
                    if (current_alloc < MIN_LINE_ALLOC) {
                        current_alloc = MIN_LINE_ALLOC;
                    }
                    *s = apr_palloc(r->pool, current_alloc);
                }
                else if (bytes_handled + len > current_alloc) {
                    apr_size_t new_size = current_alloc * 2;
                    char *new_buffer;
                    if (bytes_handled + len > new_size) {
                        new_size = (bytes_handled + len) * 2;
                    }
                    new_buffer = apr_palloc(r->pool, new_size);
                    memcpy(new_buffer, *s, bytes_handled);
                    current_alloc = new_size;
                    *s = new_buffer;
                }
            }
            pos = *s + bytes_handled;
            memcpy(pos, str, len);
            last_char = pos + len - 1;
            bytes_handled += len;
        }
        if (last_char && (*last_char == APR_ASCII_LF)) {
            break;
        }
    }
    if (last_char > *s && last_char[-1] == APR_ASCII_CR) {
        last_char--;
    }
    *last_char = '\0';
    bytes_handled = last_char - *s;
    if (fold && bytes_handled && !saw_eos) {
        for (;;) {
            const char *str;
            apr_size_t len;
            char c;
            apr_brigade_cleanup(bb);
            rv = ap_get_brigade(r->input_filters, bb, AP_MODE_SPECULATIVE,
                                APR_BLOCK_READ, 1);
            if (rv != APR_SUCCESS) {
                return rv;
            }
            if (APR_BRIGADE_EMPTY(bb)) {
                break;
            }
            e = APR_BRIGADE_FIRST(bb);
            if (APR_BUCKET_IS_EOS(e)) {
                break;
            }
            rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ);
            if (rv != APR_SUCCESS) {
                apr_brigade_cleanup(bb);
                return rv;
            }
            c = *str;
            if (c == APR_ASCII_BLANK || c == APR_ASCII_TAB) {
                if (bytes_handled >= n) {
                    *read = n;
                    (*s)[n-1] = '\0';
                    return APR_ENOSPC;
                }
                else {
                    apr_size_t next_size, next_len;
                    char *tmp;
                    if (do_alloc) {
                        tmp = NULL;
                    } else {
                        tmp = last_char;
                    }
                    next_size = n - bytes_handled;
                    rv = ap_rgetline_core(&tmp, next_size,
                                          &next_len, r, 0, bb);
                    if (rv != APR_SUCCESS) {
                        return rv;
                    }
                    if (do_alloc && next_len > 0) {
                        char *new_buffer;
                        apr_size_t new_size = bytes_handled + next_len + 1;
                        new_buffer = apr_palloc(r->pool, new_size);
                        memcpy(new_buffer, *s, bytes_handled);
                        memcpy(new_buffer + bytes_handled, tmp, next_len + 1);
                        *s = new_buffer;
                    }
                    last_char += next_len;
                    bytes_handled += next_len;
                }
            }
            else {
                break;
            }
        }
    }
    *read = bytes_handled;
    if (strlen(*s) < bytes_handled) {
        return APR_EINVAL;
    }
    return APR_SUCCESS;
}
['request_rec *ap_read_request(conn_rec *conn)\n{\n    request_rec *r;\n    apr_pool_t *p;\n    const char *expect;\n    int access_status;\n    apr_bucket_brigade *tmp_bb;\n    apr_socket_t *csd;\n    apr_interval_time_t cur_timeout;\n    apr_pool_create(&p, conn->pool);\n    apr_pool_tag(p, "request");\n    r = apr_pcalloc(p, sizeof(request_rec));\n    AP_READ_REQUEST_ENTRY((intptr_t)r, (uintptr_t)conn);\n    r->pool            = p;\n    r->connection      = conn;\n    r->server          = conn->base_server;\n    r->user            = NULL;\n    r->ap_auth_type    = NULL;\n    r->allowed_methods = ap_make_method_list(p, 2);\n    r->headers_in      = apr_table_make(r->pool, 25);\n    r->subprocess_env  = apr_table_make(r->pool, 25);\n    r->headers_out     = apr_table_make(r->pool, 12);\n    r->err_headers_out = apr_table_make(r->pool, 5);\n    r->notes           = apr_table_make(r->pool, 5);\n    r->request_config  = ap_create_request_config(r->pool);\n    r->proto_output_filters = conn->output_filters;\n    r->output_filters  = r->proto_output_filters;\n    r->proto_input_filters = conn->input_filters;\n    r->input_filters   = r->proto_input_filters;\n    ap_run_create_request(r);\n    r->per_dir_config  = r->server->lookup_defaults;\n    r->sent_bodyct     = 0;\n    r->read_length     = 0;\n    r->read_body       = REQUEST_NO_BODY;\n    r->status          = HTTP_OK;\n    r->the_request     = NULL;\n    r->used_path_info = AP_REQ_DEFAULT_PATH_INFO;\n    r->useragent_addr = conn->client_addr;\n    r->useragent_ip = conn->client_ip;\n    tmp_bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);\n    ap_run_pre_read_request(r, conn);\n    if (!read_request_line(r, tmp_bb)) {\n        if (r->status == HTTP_REQUEST_URI_TOO_LARGE\n            || r->status == HTTP_BAD_REQUEST) {\n            if (r->status == HTTP_REQUEST_URI_TOO_LARGE) {\n                ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00565)\n                              "request failed: URI too long (longer than %d)",\n                              r->server->limit_req_line);\n            }\n            else if (r->method == NULL) {\n                ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00566)\n                              "request failed: invalid characters in URI");\n            }\n            ap_send_error_response(r, 0);\n            ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r);\n            ap_run_log_transaction(r);\n            apr_brigade_destroy(tmp_bb);\n            goto traceout;\n        }\n        else if (r->status == HTTP_REQUEST_TIME_OUT) {\n            ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r);\n            if (!r->connection->keepalives) {\n                ap_run_log_transaction(r);\n            }\n            apr_brigade_destroy(tmp_bb);\n            goto traceout;\n        }\n        apr_brigade_destroy(tmp_bb);\n        r = NULL;\n        goto traceout;\n    }\n    csd = ap_get_conn_socket(conn);\n    apr_socket_timeout_get(csd, &cur_timeout);\n    if (cur_timeout != conn->base_server->timeout) {\n        apr_socket_timeout_set(csd, conn->base_server->timeout);\n        cur_timeout = conn->base_server->timeout;\n    }\n    if (!r->assbackwards) {\n        ap_get_mime_headers_core(r, tmp_bb);\n        if (r->status != HTTP_OK) {\n            ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00567)\n                          "request failed: error reading the headers");\n            ap_send_error_response(r, 0);\n            ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r);\n            ap_run_log_transaction(r);\n            apr_brigade_destroy(tmp_bb);\n            goto traceout;\n        }\n        if (apr_table_get(r->headers_in, "Transfer-Encoding")\n            && apr_table_get(r->headers_in, "Content-Length")) {\n            apr_table_unset(r->headers_in, "Content-Length");\n        }\n    }\n    else {\n        if (r->header_only) {\n            ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00568)\n                          "client sent invalid HTTP/0.9 request: HEAD %s",\n                          r->uri);\n            r->header_only = 0;\n            r->status = HTTP_BAD_REQUEST;\n            ap_send_error_response(r, 0);\n            ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r);\n            ap_run_log_transaction(r);\n            apr_brigade_destroy(tmp_bb);\n            goto traceout;\n        }\n    }\n    apr_brigade_destroy(tmp_bb);\n    ap_update_vhost_from_headers(r);\n    if (cur_timeout != r->server->timeout) {\n        apr_socket_timeout_set(csd, r->server->timeout);\n        cur_timeout = r->server->timeout;\n    }\n    r->per_dir_config = r->server->lookup_defaults;\n    if ((!r->hostname && (r->proto_num >= HTTP_VERSION(1, 1)))\n        || ((r->proto_num == HTTP_VERSION(1, 1))\n            && !apr_table_get(r->headers_in, "Host"))) {\n        r->status = HTTP_BAD_REQUEST;\n        ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00569)\n                      "client sent HTTP/1.1 request without hostname "\n                      "(see RFC2616 section 14.23): %s", r->uri);\n    }\n    ap_add_input_filter_handle(ap_http_input_filter_handle,\n                               NULL, r, r->connection);\n    if (r->status != HTTP_OK) {\n        ap_send_error_response(r, 0);\n        ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r);\n        ap_run_log_transaction(r);\n        goto traceout;\n    }\n    if ((access_status = ap_run_post_read_request(r))) {\n        ap_die(access_status, r);\n        ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r);\n        ap_run_log_transaction(r);\n        r = NULL;\n        goto traceout;\n    }\n    if (((expect = apr_table_get(r->headers_in, "Expect")) != NULL)\n        && (expect[0] != \'\\0\')) {\n        if (strcasecmp(expect, "100-continue") == 0) {\n            r->expecting_100 = 1;\n        }\n        else {\n            r->status = HTTP_EXPECTATION_FAILED;\n            ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00570)\n                          "client sent an unrecognized expectation value of "\n                          "Expect: %s", expect);\n            ap_send_error_response(r, 0);\n            ap_update_child_status(conn->sbh, SERVER_BUSY_LOG, r);\n            ap_run_log_transaction(r);\n            goto traceout;\n        }\n    }\n    AP_READ_REQUEST_SUCCESS((uintptr_t)r, (char *)r->method, (char *)r->uri, (char *)r->server->defn_name, r->status);\n    return r;\n    traceout:\n    AP_READ_REQUEST_FAILURE((uintptr_t)r);\n    return r;\n}', 'static int read_request_line(request_rec *r, apr_bucket_brigade *bb)\n{\n    const char *ll;\n    const char *uri;\n    const char *pro;\n#if 0\n    conn_rec *conn = r->connection;\n#endif\n    int major = 1, minor = 0;\n    char http[5];\n    apr_size_t len;\n    int num_blank_lines = 0;\n    int max_blank_lines = r->server->limit_req_fields;\n    if (max_blank_lines <= 0) {\n        max_blank_lines = DEFAULT_LIMIT_REQUEST_FIELDS;\n    }\n    do {\n        apr_status_t rv;\n        r->the_request = NULL;\n        rv = ap_rgetline(&(r->the_request), (apr_size_t)(r->server->limit_req_line + 2),\n                         &len, r, 0, bb);\n        if (rv != APR_SUCCESS) {\n            r->request_time = apr_time_now();\n            if (APR_STATUS_IS_ENOSPC(rv)) {\n                r->status    = HTTP_REQUEST_URI_TOO_LARGE;\n                r->proto_num = HTTP_VERSION(1,0);\n                r->protocol  = apr_pstrdup(r->pool, "HTTP/1.0");\n            }\n            else if (APR_STATUS_IS_TIMEUP(rv)) {\n                r->status = HTTP_REQUEST_TIME_OUT;\n            }\n            else if (APR_STATUS_IS_EINVAL(rv)) {\n                r->status = HTTP_BAD_REQUEST;\n            }\n            return 0;\n        }\n    } while ((len <= 0) && (++num_blank_lines < max_blank_lines));\n    if (APLOGrtrace5(r)) {\n        ap_log_rerror(APLOG_MARK, APLOG_TRACE5, 0, r,\n                      "Request received from client: %s",\n                      ap_escape_logitem(r->pool, r->the_request));\n    }\n    r->request_time = apr_time_now();\n    ll = r->the_request;\n    r->method = ap_getword_white(r->pool, &ll);\n#if 0\n    ap_update_connection_status(AP_CHILD_THREAD_FROM_ID(conn->id), "Method",\n                                r->method);\n#endif\n    uri = ap_getword_white(r->pool, &ll);\n    r->method_number = ap_method_number_of(r->method);\n    if (r->method_number == M_GET && r->method[0] == \'H\') {\n        r->header_only = 1;\n    }\n    ap_parse_uri(r, uri);\n    if (ll[0]) {\n        r->assbackwards = 0;\n        pro = ll;\n        len = strlen(ll);\n    } else {\n        r->assbackwards = 1;\n        pro = "HTTP/0.9";\n        len = 8;\n    }\n    r->protocol = apr_pstrmemdup(r->pool, pro, len);\n    if (len == 8\n        && pro[0] == \'H\' && pro[1] == \'T\' && pro[2] == \'T\' && pro[3] == \'P\'\n        && pro[4] == \'/\' && apr_isdigit(pro[5]) && pro[6] == \'.\'\n        && apr_isdigit(pro[7])) {\n        r->proto_num = HTTP_VERSION(pro[5] - \'0\', pro[7] - \'0\');\n    }\n    else if (3 == sscanf(r->protocol, "%4s/%u.%u", http, &major, &minor)\n             && (strcasecmp("http", http) == 0)\n             && (minor < HTTP_VERSION(1, 0)) )\n        r->proto_num = HTTP_VERSION(major, minor);\n    else\n        r->proto_num = HTTP_VERSION(1, 0);\n    return 1;\n}', "AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,\n                                          apr_size_t *read, request_rec *r,\n                                          int fold, apr_bucket_brigade *bb)\n{\n    apr_status_t rv;\n    apr_bucket *e;\n    apr_size_t bytes_handled = 0, current_alloc = 0;\n    char *pos, *last_char = *s;\n    int do_alloc = (*s == NULL), saw_eos = 0;\n    if (last_char)\n        *last_char = '\\0';\n    for (;;) {\n        apr_brigade_cleanup(bb);\n        rv = ap_get_brigade(r->input_filters, bb, AP_MODE_GETLINE,\n                            APR_BLOCK_READ, 0);\n        if (rv != APR_SUCCESS) {\n            return rv;\n        }\n        if (APR_BRIGADE_EMPTY(bb)) {\n            return APR_EGENERAL;\n        }\n        for (e = APR_BRIGADE_FIRST(bb);\n             e != APR_BRIGADE_SENTINEL(bb);\n             e = APR_BUCKET_NEXT(e))\n        {\n            const char *str;\n            apr_size_t len;\n            if (APR_BUCKET_IS_EOS(e)) {\n                saw_eos = 1;\n                break;\n            }\n            rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ);\n            if (rv != APR_SUCCESS) {\n                return rv;\n            }\n            if (len == 0) {\n                continue;\n            }\n            if (n < bytes_handled + len) {\n                *read = bytes_handled;\n                if (*s) {\n                    if (bytes_handled > 0) {\n                        (*s)[bytes_handled-1] = '\\0';\n                    }\n                    else {\n                        (*s)[0] = '\\0';\n                    }\n                }\n                return APR_ENOSPC;\n            }\n            if (do_alloc) {\n                if (!*s) {\n                    current_alloc = len;\n                    if (current_alloc < MIN_LINE_ALLOC) {\n                        current_alloc = MIN_LINE_ALLOC;\n                    }\n                    *s = apr_palloc(r->pool, current_alloc);\n                }\n                else if (bytes_handled + len > current_alloc) {\n                    apr_size_t new_size = current_alloc * 2;\n                    char *new_buffer;\n                    if (bytes_handled + len > new_size) {\n                        new_size = (bytes_handled + len) * 2;\n                    }\n                    new_buffer = apr_palloc(r->pool, new_size);\n                    memcpy(new_buffer, *s, bytes_handled);\n                    current_alloc = new_size;\n                    *s = new_buffer;\n                }\n            }\n            pos = *s + bytes_handled;\n            memcpy(pos, str, len);\n            last_char = pos + len - 1;\n            bytes_handled += len;\n        }\n        if (last_char && (*last_char == APR_ASCII_LF)) {\n            break;\n        }\n    }\n    if (last_char > *s && last_char[-1] == APR_ASCII_CR) {\n        last_char--;\n    }\n    *last_char = '\\0';\n    bytes_handled = last_char - *s;\n    if (fold && bytes_handled && !saw_eos) {\n        for (;;) {\n            const char *str;\n            apr_size_t len;\n            char c;\n            apr_brigade_cleanup(bb);\n            rv = ap_get_brigade(r->input_filters, bb, AP_MODE_SPECULATIVE,\n                                APR_BLOCK_READ, 1);\n            if (rv != APR_SUCCESS) {\n                return rv;\n            }\n            if (APR_BRIGADE_EMPTY(bb)) {\n                break;\n            }\n            e = APR_BRIGADE_FIRST(bb);\n            if (APR_BUCKET_IS_EOS(e)) {\n                break;\n            }\n            rv = apr_bucket_read(e, &str, &len, APR_BLOCK_READ);\n            if (rv != APR_SUCCESS) {\n                apr_brigade_cleanup(bb);\n                return rv;\n            }\n            c = *str;\n            if (c == APR_ASCII_BLANK || c == APR_ASCII_TAB) {\n                if (bytes_handled >= n) {\n                    *read = n;\n                    (*s)[n-1] = '\\0';\n                    return APR_ENOSPC;\n                }\n                else {\n                    apr_size_t next_size, next_len;\n                    char *tmp;\n                    if (do_alloc) {\n                        tmp = NULL;\n                    } else {\n                        tmp = last_char;\n                    }\n                    next_size = n - bytes_handled;\n                    rv = ap_rgetline_core(&tmp, next_size,\n                                          &next_len, r, 0, bb);\n                    if (rv != APR_SUCCESS) {\n                        return rv;\n                    }\n                    if (do_alloc && next_len > 0) {\n                        char *new_buffer;\n                        apr_size_t new_size = bytes_handled + next_len + 1;\n                        new_buffer = apr_palloc(r->pool, new_size);\n                        memcpy(new_buffer, *s, bytes_handled);\n                        memcpy(new_buffer + bytes_handled, tmp, next_len + 1);\n                        *s = new_buffer;\n                    }\n                    last_char += next_len;\n                    bytes_handled += next_len;\n                }\n            }\n            else {\n                break;\n            }\n        }\n    }\n    *read = bytes_handled;\n    if (strlen(*s) < bytes_handled) {\n        return APR_EINVAL;\n    }\n    return APR_SUCCESS;\n}"]