src/http/ngx_http_upstream.c:1578: error: Integer Overflow L2
  ([0, `r->main->count` + 8] - 1):unsigned32 by call to `ngx_http_upstream_finalize_request`.

src/http/ngx_http_upstream.c:1420:1: Parameter `r->main->count`
1418. 
1419. 
1420. static void
      ^
1421. ngx_http_upstream_process_header(ngx_http_request_t *r, ngx_http_upstream_t *u)
1422. {

src/http/ngx_http_upstream.c:1560:9: Call
1558.     }
1559. 
1560.     if (ngx_http_upstream_process_headers(r, u) != NGX_OK) {
              ^
1561.         return;
1562.     }

src/http/ngx_http_upstream.c:1753:1: Parameter `r->main->count`
  1751. 
  1752. 
  1753. static ngx_int_t
        ^
  1754. ngx_http_upstream_process_headers(ngx_http_request_t *r, ngx_http_upstream_t *u)
  1755. {

src/http/ngx_http_upstream.c:1578:9: Call
1576. 
1577.     if (u->input_filter_init(u->input_filter_ctx) == NGX_ERROR) {
1578.         ngx_http_upstream_finalize_request(r, u,
              ^
1579.                                            NGX_HTTP_INTERNAL_SERVER_ERROR);
1580.         return;

src/http/ngx_http_upstream.c:2846:1: Parameter `r->main->count`
  2844. 
  2845. 
  2846. static void
        ^
  2847. ngx_http_upstream_finalize_request(ngx_http_request_t *r,
  2848.     ngx_http_upstream_t *u, ngx_int_t rc)

src/http/ngx_http_upstream.c:2950:5: Call
  2948.     }
  2949. 
  2950.     ngx_http_finalize_request(r, rc);
            ^
  2951. }
  2952. 

src/http/ngx_http_request.c:1831:1: Parameter `r->main->count`
    1829. 
    1830. 
    1831. void
          ^
    1832. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
    1833. {

src/http/ngx_http_request.c:2001:9: Call
    1999.     }
    2000. 
    2001.     if (ngx_http_post_action(r) == NGX_OK) {
                  ^
    2002.         return;
    2003.     }

src/http/ngx_http_request.c:2809:1: <LHS trace>
2807. 
2808. 
2809. static ngx_int_t
      ^
2810. ngx_http_post_action(ngx_http_request_t *r)
2811. {

src/http/ngx_http_request.c:2809:1: Parameter `r->main->count`
      2807. 
      2808. 
      2809. static ngx_int_t
            ^
      2810. ngx_http_post_action(ngx_http_request_t *r)
      2811. {

src/http/ngx_http_request.c:2823:5: Binary operation: ([0, r->main->count + 8] - 1):unsigned32 by call to `ngx_http_upstream_finalize_request` 
      2821.                    "post action: \"%V\"", &clcf->post_action);
      2822. 
      2823.     r->main->count--;
                ^
      2824. 
      2825.     r->http_version = NGX_HTTP_VERSION_9;

static ngx_int_t
ngx_http_post_action(ngx_http_request_t *r)
{
    ngx_http_core_loc_conf_t  *clcf;
    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
    if (clcf->post_action.data == NULL) {
        return NGX_DECLINED;
    }
    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                   "post action: \"%V\"", &clcf->post_action);
    r->main->count--;
    r->http_version = NGX_HTTP_VERSION_9;
    r->header_only = 1;
    r->post_action = 1;
    r->read_event_handler = ngx_http_block_reading;
    if (clcf->post_action.data[0] == '/') {
        ngx_http_internal_redirect(r, &clcf->post_action, NULL);
    } else {
        ngx_http_named_location(r, &clcf->post_action);
    }
    return NGX_OK;
}
['static void\nngx_http_upstream_process_header(ngx_http_request_t *r, ngx_http_upstream_t *u)\n{\n    ssize_t            n;\n    ngx_int_t          rc;\n    ngx_connection_t  *c;\n    c = u->peer.connection;\n    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http upstream process header");\n    c->log->action = "reading response header from upstream";\n    if (c->read->timedout) {\n        ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_TIMEOUT);\n        return;\n    }\n    if (!u->request_sent && ngx_http_upstream_test_connect(c) != NGX_OK) {\n        ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR);\n        return;\n    }\n    if (u->buffer.start == NULL) {\n        u->buffer.start = ngx_palloc(r->pool, u->conf->buffer_size);\n        if (u->buffer.start == NULL) {\n            ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return;\n        }\n        u->buffer.pos = u->buffer.start;\n        u->buffer.last = u->buffer.start;\n        u->buffer.end = u->buffer.start + u->conf->buffer_size;\n        u->buffer.temporary = 1;\n        u->buffer.tag = u->output.tag;\n        if (ngx_list_init(&u->headers_in.headers, r->pool, 8,\n                          sizeof(ngx_table_elt_t))\n            != NGX_OK)\n        {\n            ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return;\n        }\n#if (NGX_HTTP_CACHE)\n        if (r->cache) {\n            u->buffer.pos += r->cache->header_start;\n            u->buffer.last = u->buffer.pos;\n        }\n#endif\n    }\n    for ( ;; ) {\n        n = c->recv(c, u->buffer.last, u->buffer.end - u->buffer.last);\n        if (n == NGX_AGAIN) {\n#if 0\n            ngx_add_timer(rev, u->read_timeout);\n#endif\n            if (ngx_handle_read_event(c->read, 0) != NGX_OK) {\n                ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n                return;\n            }\n            return;\n        }\n        if (n == 0) {\n            ngx_log_error(NGX_LOG_ERR, c->log, 0,\n                          "upstream prematurely closed connection");\n        }\n        if (n == NGX_ERROR || n == 0) {\n            ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_ERROR);\n            return;\n        }\n        u->buffer.last += n;\n#if 0\n        u->valid_header_in = 0;\n        u->peer.cached = 0;\n#endif\n        rc = u->process_header(r);\n        if (rc == NGX_AGAIN) {\n            if (u->buffer.pos == u->buffer.end) {\n                ngx_log_error(NGX_LOG_ERR, c->log, 0,\n                              "upstream sent too big header");\n                ngx_http_upstream_next(r, u,\n                                       NGX_HTTP_UPSTREAM_FT_INVALID_HEADER);\n                return;\n            }\n            continue;\n        }\n        break;\n    }\n    if (rc == NGX_HTTP_UPSTREAM_INVALID_HEADER) {\n        ngx_http_upstream_next(r, u, NGX_HTTP_UPSTREAM_FT_INVALID_HEADER);\n        return;\n    }\n    if (rc == NGX_ERROR) {\n        ngx_http_upstream_finalize_request(r, u,\n                                           NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    if (u->headers_in.status_n >= NGX_HTTP_BAD_REQUEST) {\n        if (r->subrequest_in_memory) {\n            u->buffer.last = u->buffer.pos;\n        }\n        if (ngx_http_upstream_test_next(r, u) == NGX_OK) {\n            return;\n        }\n        if (ngx_http_upstream_intercept_errors(r, u) == NGX_OK) {\n            return;\n        }\n    }\n    if (ngx_http_upstream_process_headers(r, u) != NGX_OK) {\n        return;\n    }\n    if (!r->subrequest_in_memory) {\n        ngx_http_upstream_send_response(r, u);\n        return;\n    }\n    if (u->input_filter == NULL) {\n        u->input_filter_init = ngx_http_upstream_non_buffered_filter_init;\n        u->input_filter = ngx_http_upstream_non_buffered_filter;\n        u->input_filter_ctx = r;\n    }\n    if (u->input_filter_init(u->input_filter_ctx) == NGX_ERROR) {\n        ngx_http_upstream_finalize_request(r, u,\n                                           NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return;\n    }\n    n = u->buffer.last - u->buffer.pos;\n    if (n) {\n        u->buffer.last -= n;\n        u->state->response_length += n;\n        if (u->input_filter(u->input_filter_ctx, n) == NGX_ERROR) {\n            ngx_http_upstream_finalize_request(r, u, NGX_ERROR);\n            return;\n        }\n        if (u->length == 0) {\n            ngx_http_upstream_finalize_request(r, u, 0);\n            return;\n        }\n    }\n    u->read_event_handler = ngx_http_upstream_process_body_in_memory;\n    ngx_http_upstream_process_body_in_memory(r, u);\n}', 'static ngx_int_t\nngx_http_upstream_process_headers(ngx_http_request_t *r, ngx_http_upstream_t *u)\n{\n    ngx_str_t                      *uri, args;\n    ngx_uint_t                      i, flags;\n    ngx_list_part_t                *part;\n    ngx_table_elt_t                *h;\n    ngx_http_upstream_header_t     *hh;\n    ngx_http_upstream_main_conf_t  *umcf;\n    umcf = ngx_http_get_module_main_conf(r, ngx_http_upstream_module);\n    if (u->headers_in.x_accel_redirect\n        && !(u->conf->ignore_headers & NGX_HTTP_UPSTREAM_IGN_XA_REDIRECT))\n    {\n        ngx_http_upstream_finalize_request(r, u, NGX_DECLINED);\n        part = &u->headers_in.headers.part;\n        h = part->elts;\n        for (i = 0;  ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                h = part->elts;\n                i = 0;\n            }\n            hh = ngx_hash_find(&umcf->headers_in_hash, h[i].hash,\n                               h[i].lowcase_key, h[i].key.len);\n            if (hh && hh->redirect) {\n                if (hh->copy_handler(r, &h[i], hh->conf) != NGX_OK) {\n                    ngx_http_finalize_request(r,\n                                              NGX_HTTP_INTERNAL_SERVER_ERROR);\n                    return NGX_DONE;\n                }\n            }\n        }\n        uri = &u->headers_in.x_accel_redirect->value;\n        args.len = 0;\n        args.data = NULL;\n        flags = 0;\n        if (ngx_http_parse_unsafe_uri(r, uri, &args, &flags) != NGX_OK) {\n            ngx_http_finalize_request(r, NGX_HTTP_NOT_FOUND);\n            return NGX_DONE;\n        }\n        if (flags & NGX_HTTP_ZERO_IN_URI) {\n            r->zero_in_uri = 1;\n        }\n        if (r->method != NGX_HTTP_HEAD) {\n            r->method = NGX_HTTP_GET;\n        }\n        r->valid_unparsed_uri = 0;\n        ngx_http_internal_redirect(r, uri, &args);\n        ngx_http_finalize_request(r, NGX_DONE);\n        return NGX_DONE;\n    }\n    part = &u->headers_in.headers.part;\n    h = part->elts;\n    for (i = 0;  ; i++) {\n        if (i >= part->nelts) {\n            if (part->next == NULL) {\n                break;\n            }\n            part = part->next;\n            h = part->elts;\n            i = 0;\n        }\n        if (ngx_hash_find(&u->conf->hide_headers_hash, h[i].hash,\n                          h[i].lowcase_key, h[i].key.len))\n        {\n            continue;\n        }\n        hh = ngx_hash_find(&umcf->headers_in_hash, h[i].hash,\n                           h[i].lowcase_key, h[i].key.len);\n        if (hh) {\n            if (hh->copy_handler(r, &h[i], hh->conf) != NGX_OK) {\n                ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n                return NGX_DONE;\n            }\n            continue;\n        }\n        if (ngx_http_upstream_copy_header_line(r, &h[i], 0) != NGX_OK) {\n            ngx_http_upstream_finalize_request(r, u,\n                                               NGX_HTTP_INTERNAL_SERVER_ERROR);\n            return NGX_DONE;\n        }\n    }\n    if (r->headers_out.server && r->headers_out.server->value.data == NULL) {\n        r->headers_out.server->hash = 0;\n    }\n    if (r->headers_out.date && r->headers_out.date->value.data == NULL) {\n        r->headers_out.date->hash = 0;\n    }\n    r->headers_out.status = u->headers_in.status_n;\n    r->headers_out.status_line = u->headers_in.status_line;\n    u->headers_in.content_length_n = r->headers_out.content_length_n;\n    if (r->headers_out.content_length_n != -1) {\n        u->length = (size_t) r->headers_out.content_length_n;\n    } else {\n        u->length = NGX_MAX_SIZE_T_VALUE;\n    }\n    return NGX_OK;\n}', 'static void\nngx_http_upstream_finalize_request(ngx_http_request_t *r,\n    ngx_http_upstream_t *u, ngx_int_t rc)\n{\n    ngx_time_t  *tp;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "finalize http upstream request: %i", rc);\n    if (u->cleanup) {\n        *u->cleanup = NULL;\n    }\n    if (u->state && u->state->response_sec) {\n        tp = ngx_timeofday();\n        u->state->response_sec = tp->sec - u->state->response_sec;\n        u->state->response_msec = tp->msec - u->state->response_msec;\n        if (u->pipe) {\n            u->state->response_length = u->pipe->read_length;\n        }\n    }\n    u->finalize_request(r, rc);\n    if (u->peer.free) {\n        u->peer.free(&u->peer, u->peer.data, 0);\n    }\n    if (u->peer.connection) {\n#if (NGX_HTTP_SSL)\n        if (u->peer.connection->ssl) {\n            u->peer.connection->ssl->no_wait_shutdown = 1;\n            (void) ngx_ssl_shutdown(u->peer.connection);\n        }\n#endif\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "close http upstream connection: %d",\n                       u->peer.connection->fd);\n        ngx_close_connection(u->peer.connection);\n    }\n    u->peer.connection = NULL;\n    if (u->pipe && u->pipe->temp_file) {\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream temp fd: %d",\n                       u->pipe->temp_file->file.fd);\n    }\n#if (NGX_HTTP_CACHE)\n    if (u->cacheable && r->cache) {\n        time_t  valid;\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream cache fd: %d",\n                       r->cache->file.fd);\n        if (rc == NGX_HTTP_BAD_GATEWAY || rc == NGX_HTTP_GATEWAY_TIME_OUT) {\n            valid = ngx_http_file_cache_valid(u->conf->cache_valid, rc);\n            if (valid) {\n                r->cache->valid_sec = ngx_time() + valid;\n                r->cache->error = rc;\n            }\n        }\n        ngx_http_file_cache_free(r, u->pipe->temp_file);\n    }\n#endif\n    if (u->header_sent\n        && (rc == NGX_ERROR || rc >= NGX_HTTP_SPECIAL_RESPONSE))\n    {\n        rc = 0;\n    }\n    if (rc == NGX_DECLINED) {\n        return;\n    }\n    r->connection->log->action = "sending to client";\n    if (rc == 0) {\n        rc = ngx_http_send_special(r, NGX_HTTP_LAST);\n    }\n    ngx_http_finalize_request(r, rc);\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %d, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n        return;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        if (r->main->blocked) {\n            r->write_event_handler = ngx_http_request_finalizer;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n#if (NGX_DEBUG)\n        if (r != c->data) {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n        }\n#endif\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            if (!r->logged) {\n                clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed || r->blocked) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'static ngx_int_t\nngx_http_post_action(ngx_http_request_t *r)\n{\n    ngx_http_core_loc_conf_t  *clcf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->post_action.data == NULL) {\n        return NGX_DECLINED;\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "post action: \\"%V\\"", &clcf->post_action);\n    r->main->count--;\n    r->http_version = NGX_HTTP_VERSION_9;\n    r->header_only = 1;\n    r->post_action = 1;\n    r->read_event_handler = ngx_http_block_reading;\n    if (clcf->post_action.data[0] == \'/\') {\n        ngx_http_internal_redirect(r, &clcf->post_action, NULL);\n    } else {\n        ngx_http_named_location(r, &clcf->post_action);\n    }\n    return NGX_OK;\n}']