src/http/modules/ngx_http_limit_conn_module.c:203: error: Integer Overflow L2
  ([0, +oo] - [0, 15]):unsigned64 by call to `ngx_slab_alloc_locked`.

src/http/modules/ngx_http_limit_conn_module.c:203:20: Call
201.                 + len;
202. 
203.             node = ngx_slab_alloc_locked(shpool, n);
                        ^
204. 
205.             if (node == NULL) {

src/core/ngx_slab.c:155:1: <LHS trace>
153. 
154. 
155. void *
     ^
156. ngx_slab_alloc_locked(ngx_slab_pool_t *pool, size_t size)
157. {

src/core/ngx_slab.c:155:1: Global `ngx_pagesize_shift`
  153. 
  154. 
  155. void *
       ^
  156. ngx_slab_alloc_locked(ngx_slab_pool_t *pool, size_t size)
  157. {

src/core/ngx_slab.c:288:13: Binary operation: ([0, +oo] - [0, 15]):unsigned64 by call to `ngx_slab_alloc_locked` 
  286.         } else { /* shift > ngx_slab_exact_shift */
  287. 
  288.             n = ngx_pagesize_shift - (page->slab & NGX_SLAB_SHIFT_MASK);
                   ^
  289.             n = 1 << n;
  290.             n = ((uintptr_t) 1 << n) - 1;

void *
ngx_slab_alloc_locked(ngx_slab_pool_t *pool, size_t size)
{
    size_t            s;
    uintptr_t         p, n, m, mask, *bitmap;
    ngx_uint_t        i, slot, shift, map;
    ngx_slab_page_t  *page, *prev, *slots;
    if (size >= ngx_slab_max_size) {
        ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0,
                       "slab alloc: %uz", size);
        page = ngx_slab_alloc_pages(pool, (size + ngx_pagesize - 1)
                                          >> ngx_pagesize_shift);
        if (page) {
            p = (page - pool->pages) << ngx_pagesize_shift;
            p += (uintptr_t) pool->start;
        } else {
            p = 0;
        }
        goto done;
    }
    if (size > pool->min_size) {
        shift = 1;
        for (s = size - 1; s >>= 1; shift++) {   }
        slot = shift - pool->min_shift;
    } else {
        size = pool->min_size;
        shift = pool->min_shift;
        slot = 0;
    }
    ngx_log_debug2(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0,
                   "slab alloc: %uz slot: %ui", size, slot);
    slots = (ngx_slab_page_t *) ((u_char *) pool + sizeof(ngx_slab_pool_t));
    page = slots[slot].next;
    if (page->next != page) {
        if (shift < ngx_slab_exact_shift) {
            do {
                p = (page - pool->pages) << ngx_pagesize_shift;
                bitmap = (uintptr_t *) (pool->start + p);
                map = (1 << (ngx_pagesize_shift - shift))
                          / (sizeof(uintptr_t) * 8);
                for (n = 0; n < map; n++) {
                    if (bitmap[n] != NGX_SLAB_BUSY) {
                        for (m = 1, i = 0; m; m <<= 1, i++) {
                            if ((bitmap[n] & m)) {
                                continue;
                            }
                            bitmap[n] |= m;
                            i = ((n * sizeof(uintptr_t) * 8) << shift)
                                + (i << shift);
                            if (bitmap[n] == NGX_SLAB_BUSY) {
                                for (n = n + 1; n < map; n++) {
                                     if (bitmap[n] != NGX_SLAB_BUSY) {
                                         p = (uintptr_t) bitmap + i;
                                         goto done;
                                     }
                                }
                                prev = (ngx_slab_page_t *)
                                            (page->prev & ~NGX_SLAB_PAGE_MASK);
                                prev->next = page->next;
                                page->next->prev = page->prev;
                                page->next = NULL;
                                page->prev = NGX_SLAB_SMALL;
                            }
                            p = (uintptr_t) bitmap + i;
                            goto done;
                        }
                    }
                }
                page = page->next;
            } while (page);
        } else if (shift == ngx_slab_exact_shift) {
            do {
                if (page->slab != NGX_SLAB_BUSY) {
                    for (m = 1, i = 0; m; m <<= 1, i++) {
                        if ((page->slab & m)) {
                            continue;
                        }
                        page->slab |= m;
                        if (page->slab == NGX_SLAB_BUSY) {
                            prev = (ngx_slab_page_t *)
                                            (page->prev & ~NGX_SLAB_PAGE_MASK);
                            prev->next = page->next;
                            page->next->prev = page->prev;
                            page->next = NULL;
                            page->prev = NGX_SLAB_EXACT;
                        }
                        p = (page - pool->pages) << ngx_pagesize_shift;
                        p += i << shift;
                        p += (uintptr_t) pool->start;
                        goto done;
                    }
                }
                page = page->next;
            } while (page);
        } else {
            n = ngx_pagesize_shift - (page->slab & NGX_SLAB_SHIFT_MASK);
            n = 1 << n;
            n = ((uintptr_t) 1 << n) - 1;
            mask = n << NGX_SLAB_MAP_SHIFT;
            do {
                if ((page->slab & NGX_SLAB_MAP_MASK) != mask) {
                    for (m = (uintptr_t) 1 << NGX_SLAB_MAP_SHIFT, i = 0;
                         m & mask;
                         m <<= 1, i++)
                    {
                        if ((page->slab & m)) {
                            continue;
                        }
                        page->slab |= m;
                        if ((page->slab & NGX_SLAB_MAP_MASK) == mask) {
                            prev = (ngx_slab_page_t *)
                                            (page->prev & ~NGX_SLAB_PAGE_MASK);
                            prev->next = page->next;
                            page->next->prev = page->prev;
                            page->next = NULL;
                            page->prev = NGX_SLAB_BIG;
                        }
                        p = (page - pool->pages) << ngx_pagesize_shift;
                        p += i << shift;
                        p += (uintptr_t) pool->start;
                        goto done;
                    }
                }
                page = page->next;
            } while (page);
        }
    }
    page = ngx_slab_alloc_pages(pool, 1);
    if (page) {
        if (shift < ngx_slab_exact_shift) {
            p = (page - pool->pages) << ngx_pagesize_shift;
            bitmap = (uintptr_t *) (pool->start + p);
            s = 1 << shift;
            n = (1 << (ngx_pagesize_shift - shift)) / 8 / s;
            if (n == 0) {
                n = 1;
            }
            bitmap[0] = (2 << n) - 1;
            map = (1 << (ngx_pagesize_shift - shift)) / (sizeof(uintptr_t) * 8);
            for (i = 1; i < map; i++) {
                bitmap[i] = 0;
            }
            page->slab = shift;
            page->next = &slots[slot];
            page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_SMALL;
            slots[slot].next = page;
            p = ((page - pool->pages) << ngx_pagesize_shift) + s * n;
            p += (uintptr_t) pool->start;
            goto done;
        } else if (shift == ngx_slab_exact_shift) {
            page->slab = 1;
            page->next = &slots[slot];
            page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_EXACT;
            slots[slot].next = page;
            p = (page - pool->pages) << ngx_pagesize_shift;
            p += (uintptr_t) pool->start;
            goto done;
        } else {
            page->slab = ((uintptr_t) 1 << NGX_SLAB_MAP_SHIFT) | shift;
            page->next = &slots[slot];
            page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_BIG;
            slots[slot].next = page;
            p = (page - pool->pages) << ngx_pagesize_shift;
            p += (uintptr_t) pool->start;
            goto done;
        }
    }
    p = 0;
done:
    ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0, "slab alloc: %p", p);
    return (void *) p;
}
['static ngx_int_t\nngx_http_limit_conn_handler(ngx_http_request_t *r)\n{\n    size_t                          len, n;\n    uint32_t                        hash;\n    ngx_uint_t                      i;\n    ngx_slab_pool_t                *shpool;\n    ngx_rbtree_node_t              *node;\n    ngx_pool_cleanup_t             *cln;\n    ngx_http_variable_value_t      *vv;\n    ngx_http_limit_conn_ctx_t      *ctx;\n    ngx_http_limit_conn_node_t     *lc;\n    ngx_http_limit_conn_conf_t     *lccf;\n    ngx_http_limit_conn_limit_t    *limits;\n    ngx_http_limit_conn_cleanup_t  *lccln;\n    if (r->main->limit_conn_set) {\n        return NGX_DECLINED;\n    }\n    r->main->limit_conn_set = 1;\n    lccf = ngx_http_get_module_loc_conf(r, ngx_http_limit_conn_module);\n    limits = lccf->limits.elts;\n    for (i = 0; i < lccf->limits.nelts; i++) {\n        ctx = limits[i].shm_zone->data;\n        vv = ngx_http_get_indexed_variable(r, ctx->index);\n        if (vv == NULL || vv->not_found) {\n            continue;\n        }\n        len = vv->len;\n        if (len == 0) {\n            continue;\n        }\n        if (len > 255) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "the value of the \\"%V\\" variable "\n                          "is more than 255 bytes: \\"%v\\"",\n                          &ctx->var, vv);\n            continue;\n        }\n        hash = ngx_crc32_short(vv->data, len);\n        shpool = (ngx_slab_pool_t *) limits[i].shm_zone->shm.addr;\n        ngx_shmtx_lock(&shpool->mutex);\n        node = ngx_http_limit_conn_lookup(ctx->rbtree, vv, hash);\n        if (node == NULL) {\n            n = offsetof(ngx_rbtree_node_t, color)\n                + offsetof(ngx_http_limit_conn_node_t, data)\n                + len;\n            node = ngx_slab_alloc_locked(shpool, n);\n            if (node == NULL) {\n                ngx_shmtx_unlock(&shpool->mutex);\n                ngx_http_limit_conn_cleanup_all(r->pool);\n                return NGX_HTTP_SERVICE_UNAVAILABLE;\n            }\n            lc = (ngx_http_limit_conn_node_t *) &node->color;\n            node->key = hash;\n            lc->len = (u_char) len;\n            lc->conn = 1;\n            ngx_memcpy(lc->data, vv->data, len);\n            ngx_rbtree_insert(ctx->rbtree, node);\n        } else {\n            lc = (ngx_http_limit_conn_node_t *) &node->color;\n            if ((ngx_uint_t) lc->conn >= limits[i].conn) {\n                ngx_shmtx_unlock(&shpool->mutex);\n                ngx_log_error(lccf->log_level, r->connection->log, 0,\n                              "limiting connections by zone \\"%V\\"",\n                              &limits[i].shm_zone->shm.name);\n                ngx_http_limit_conn_cleanup_all(r->pool);\n                return NGX_HTTP_SERVICE_UNAVAILABLE;\n            }\n            lc->conn++;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "limit zone: %08XD %d", node->key, lc->conn);\n        ngx_shmtx_unlock(&shpool->mutex);\n        cln = ngx_pool_cleanup_add(r->pool,\n                                   sizeof(ngx_http_limit_conn_cleanup_t));\n        if (cln == NULL) {\n            return NGX_HTTP_INTERNAL_SERVER_ERROR;\n        }\n        cln->handler = ngx_http_limit_conn_cleanup;\n        lccln = cln->data;\n        lccln->shm_zone = limits[i].shm_zone;\n        lccln->node = node;\n    }\n    return NGX_DECLINED;\n}', 'void *\nngx_slab_alloc_locked(ngx_slab_pool_t *pool, size_t size)\n{\n    size_t            s;\n    uintptr_t         p, n, m, mask, *bitmap;\n    ngx_uint_t        i, slot, shift, map;\n    ngx_slab_page_t  *page, *prev, *slots;\n    if (size >= ngx_slab_max_size) {\n        ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0,\n                       "slab alloc: %uz", size);\n        page = ngx_slab_alloc_pages(pool, (size + ngx_pagesize - 1)\n                                          >> ngx_pagesize_shift);\n        if (page) {\n            p = (page - pool->pages) << ngx_pagesize_shift;\n            p += (uintptr_t) pool->start;\n        } else {\n            p = 0;\n        }\n        goto done;\n    }\n    if (size > pool->min_size) {\n        shift = 1;\n        for (s = size - 1; s >>= 1; shift++) {   }\n        slot = shift - pool->min_shift;\n    } else {\n        size = pool->min_size;\n        shift = pool->min_shift;\n        slot = 0;\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0,\n                   "slab alloc: %uz slot: %ui", size, slot);\n    slots = (ngx_slab_page_t *) ((u_char *) pool + sizeof(ngx_slab_pool_t));\n    page = slots[slot].next;\n    if (page->next != page) {\n        if (shift < ngx_slab_exact_shift) {\n            do {\n                p = (page - pool->pages) << ngx_pagesize_shift;\n                bitmap = (uintptr_t *) (pool->start + p);\n                map = (1 << (ngx_pagesize_shift - shift))\n                          / (sizeof(uintptr_t) * 8);\n                for (n = 0; n < map; n++) {\n                    if (bitmap[n] != NGX_SLAB_BUSY) {\n                        for (m = 1, i = 0; m; m <<= 1, i++) {\n                            if ((bitmap[n] & m)) {\n                                continue;\n                            }\n                            bitmap[n] |= m;\n                            i = ((n * sizeof(uintptr_t) * 8) << shift)\n                                + (i << shift);\n                            if (bitmap[n] == NGX_SLAB_BUSY) {\n                                for (n = n + 1; n < map; n++) {\n                                     if (bitmap[n] != NGX_SLAB_BUSY) {\n                                         p = (uintptr_t) bitmap + i;\n                                         goto done;\n                                     }\n                                }\n                                prev = (ngx_slab_page_t *)\n                                            (page->prev & ~NGX_SLAB_PAGE_MASK);\n                                prev->next = page->next;\n                                page->next->prev = page->prev;\n                                page->next = NULL;\n                                page->prev = NGX_SLAB_SMALL;\n                            }\n                            p = (uintptr_t) bitmap + i;\n                            goto done;\n                        }\n                    }\n                }\n                page = page->next;\n            } while (page);\n        } else if (shift == ngx_slab_exact_shift) {\n            do {\n                if (page->slab != NGX_SLAB_BUSY) {\n                    for (m = 1, i = 0; m; m <<= 1, i++) {\n                        if ((page->slab & m)) {\n                            continue;\n                        }\n                        page->slab |= m;\n                        if (page->slab == NGX_SLAB_BUSY) {\n                            prev = (ngx_slab_page_t *)\n                                            (page->prev & ~NGX_SLAB_PAGE_MASK);\n                            prev->next = page->next;\n                            page->next->prev = page->prev;\n                            page->next = NULL;\n                            page->prev = NGX_SLAB_EXACT;\n                        }\n                        p = (page - pool->pages) << ngx_pagesize_shift;\n                        p += i << shift;\n                        p += (uintptr_t) pool->start;\n                        goto done;\n                    }\n                }\n                page = page->next;\n            } while (page);\n        } else {\n            n = ngx_pagesize_shift - (page->slab & NGX_SLAB_SHIFT_MASK);\n            n = 1 << n;\n            n = ((uintptr_t) 1 << n) - 1;\n            mask = n << NGX_SLAB_MAP_SHIFT;\n            do {\n                if ((page->slab & NGX_SLAB_MAP_MASK) != mask) {\n                    for (m = (uintptr_t) 1 << NGX_SLAB_MAP_SHIFT, i = 0;\n                         m & mask;\n                         m <<= 1, i++)\n                    {\n                        if ((page->slab & m)) {\n                            continue;\n                        }\n                        page->slab |= m;\n                        if ((page->slab & NGX_SLAB_MAP_MASK) == mask) {\n                            prev = (ngx_slab_page_t *)\n                                            (page->prev & ~NGX_SLAB_PAGE_MASK);\n                            prev->next = page->next;\n                            page->next->prev = page->prev;\n                            page->next = NULL;\n                            page->prev = NGX_SLAB_BIG;\n                        }\n                        p = (page - pool->pages) << ngx_pagesize_shift;\n                        p += i << shift;\n                        p += (uintptr_t) pool->start;\n                        goto done;\n                    }\n                }\n                page = page->next;\n            } while (page);\n        }\n    }\n    page = ngx_slab_alloc_pages(pool, 1);\n    if (page) {\n        if (shift < ngx_slab_exact_shift) {\n            p = (page - pool->pages) << ngx_pagesize_shift;\n            bitmap = (uintptr_t *) (pool->start + p);\n            s = 1 << shift;\n            n = (1 << (ngx_pagesize_shift - shift)) / 8 / s;\n            if (n == 0) {\n                n = 1;\n            }\n            bitmap[0] = (2 << n) - 1;\n            map = (1 << (ngx_pagesize_shift - shift)) / (sizeof(uintptr_t) * 8);\n            for (i = 1; i < map; i++) {\n                bitmap[i] = 0;\n            }\n            page->slab = shift;\n            page->next = &slots[slot];\n            page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_SMALL;\n            slots[slot].next = page;\n            p = ((page - pool->pages) << ngx_pagesize_shift) + s * n;\n            p += (uintptr_t) pool->start;\n            goto done;\n        } else if (shift == ngx_slab_exact_shift) {\n            page->slab = 1;\n            page->next = &slots[slot];\n            page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_EXACT;\n            slots[slot].next = page;\n            p = (page - pool->pages) << ngx_pagesize_shift;\n            p += (uintptr_t) pool->start;\n            goto done;\n        } else {\n            page->slab = ((uintptr_t) 1 << NGX_SLAB_MAP_SHIFT) | shift;\n            page->next = &slots[slot];\n            page->prev = (uintptr_t) &slots[slot] | NGX_SLAB_BIG;\n            slots[slot].next = page;\n            p = (page - pool->pages) << ngx_pagesize_shift;\n            p += (uintptr_t) pool->start;\n            goto done;\n        }\n    }\n    p = 0;\ndone:\n    ngx_log_debug1(NGX_LOG_DEBUG_ALLOC, ngx_cycle->log, 0, "slab alloc: %p", p);\n    return (void *) p;\n}']