src/http/modules/ngx_http_try_files_module.c:212: error: Integer Overflow L2
  ([0, `r->uri.len`] - 1):unsigned64 by call to `ngx_http_finalize_request`.

src/http/modules/ngx_http_try_files_module.c:78:1: Parameter `r->uri.len`
76. 
77. 
78. static ngx_int_t
    ^
79. ngx_http_try_files_handler(ngx_http_request_t *r)
80. {

src/http/modules/ngx_http_try_files_module.c:212:13: Call
210.             }
211. 
212.             ngx_http_finalize_request(r, NGX_DONE);
                 ^
213.             return NGX_DONE;
214.         }

src/http/ngx_http_request.c:2300:1: Parameter `r->uri.len`
  2298. 
  2299. 
  2300. void
        ^
  2301. ngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
  2302. {

src/http/ngx_http_request.c:2368:38: Call
  2366.         c->write->handler = ngx_http_request_handler;
  2367. 
  2368.         ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));
                                             ^
  2369.         return;
  2370.     }

src/http/ngx_http_special_response.c:415:1: Parameter `r->uri.len`
    413. 
    414. 
    415. ngx_int_t
         ^
    416. ngx_http_special_response_handler(ngx_http_request_t *r, ngx_int_t error)
    417. {

src/http/ngx_http_special_response.c:466:24: Call
    464.         for (i = 0; i < clcf->error_pages->nelts; i++) {
    465.             if (err_page[i].status == error) {
    466.                 return ngx_http_send_error_page(r, &err_page[i]);
                                ^
    467.             }
    468.         }

src/http/ngx_http_special_response.c:583:1: Parameter `r->uri.len`
      581. 
      582. 
      583. static ngx_int_t
           ^
      584. ngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)
      585. {

src/http/ngx_http_special_response.c:619:16: Call
      617.         }
      618. 
      619.         return ngx_http_internal_redirect(r, &uri, &args);
                          ^
      620.     }
      621. 

src/http/ngx_http_core_module.c:2377:1: Parameter `r->uri.len`
        2375. 
        2376. 
        2377. ngx_int_t
              ^
        2378. ngx_http_internal_redirect(ngx_http_request_t *r,
        2379.     ngx_str_t *uri, ngx_str_t *args)

src/http/ngx_http_core_module.c:2407:5: Call
        2405.                    "internal redirect: \"%V?%V\"", uri, &r->args);
        2406. 
        2407.     ngx_http_set_exten(r);
                  ^
        2408. 
        2409.     /* clear the modules contexts */

src/http/ngx_http_core_module.c:1550:1: <LHS trace>
1548. 
1549. 
1550. void
      ^
1551. ngx_http_set_exten(ngx_http_request_t *r)
1552. {

src/http/ngx_http_core_module.c:1550:1: Parameter `r->uri.len`
          1548. 
          1549. 
          1550. void
                ^
          1551. ngx_http_set_exten(ngx_http_request_t *r)
          1552. {

src/http/ngx_http_core_module.c:1557:10: Binary operation: ([0, r->uri.len] - 1):unsigned64 by call to `ngx_http_finalize_request` 
          1555.     ngx_str_null(&r->exten);
          1556. 
          1557.     for (i = r->uri.len - 1; i > 1; i--) {
                         ^
          1558.         if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {
          1559. 

void
ngx_http_set_exten(ngx_http_request_t *r)
{
    ngx_int_t  i;
    ngx_str_null(&r->exten);
    for (i = r->uri.len - 1; i > 1; i--) {
        if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {
            r->exten.len = r->uri.len - i - 1;
            r->exten.data = &r->uri.data[i + 1];
            return;
        } else if (r->uri.data[i] == '/') {
            return;
        }
    }
    return;
}
['static ngx_int_t\nngx_http_try_files_handler(ngx_http_request_t *r)\n{\n    size_t                          len, root, alias, reserve, allocated;\n    u_char                         *p, *name;\n    ngx_str_t                       path, args;\n    ngx_uint_t                      test_dir;\n    ngx_http_try_file_t            *tf;\n    ngx_open_file_info_t            of;\n    ngx_http_script_code_pt         code;\n    ngx_http_script_engine_t        e;\n    ngx_http_core_loc_conf_t       *clcf;\n    ngx_http_script_len_code_pt     lcode;\n    ngx_http_try_files_loc_conf_t  *tlcf;\n    tlcf = ngx_http_get_module_loc_conf(r, ngx_http_try_files_module);\n    if (tlcf->try_files == NULL) {\n        return NGX_DECLINED;\n    }\n    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "try files handler");\n    allocated = 0;\n    root = 0;\n    name = NULL;\n    path.data = NULL;\n    tf = tlcf->try_files;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    alias = clcf->alias;\n    for ( ;; ) {\n        if (tf->lengths) {\n            ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n            e.ip = tf->lengths->elts;\n            e.request = r;\n            len = 1;\n            while (*(uintptr_t *) e.ip) {\n                lcode = *(ngx_http_script_len_code_pt *) e.ip;\n                len += lcode(&e);\n            }\n        } else {\n            len = tf->name.len;\n        }\n        if (!alias) {\n            reserve = len > r->uri.len ? len - r->uri.len : 0;\n        } else if (alias == NGX_MAX_SIZE_T_VALUE) {\n            reserve = len;\n        } else {\n            reserve = len > r->uri.len - alias ? len - (r->uri.len - alias) : 0;\n        }\n        if (reserve > allocated || !allocated) {\n            allocated = reserve + 16;\n            if (ngx_http_map_uri_to_path(r, &path, &root, allocated) == NULL) {\n                return NGX_HTTP_INTERNAL_SERVER_ERROR;\n            }\n            name = path.data + root;\n        }\n        if (tf->values == NULL) {\n            ngx_memcpy(name, tf->name.data, tf->name.len);\n            path.len = (name + tf->name.len - 1) - path.data;\n        } else {\n            e.ip = tf->values->elts;\n            e.pos = name;\n            e.flushed = 1;\n            while (*(uintptr_t *) e.ip) {\n                code = *(ngx_http_script_code_pt *) e.ip;\n                code((ngx_http_script_engine_t *) &e);\n            }\n            path.len = e.pos - path.data;\n            *e.pos = \'\\0\';\n            if (alias && alias != NGX_MAX_SIZE_T_VALUE\n                && ngx_strncmp(name, r->uri.data, alias) == 0)\n            {\n                ngx_memmove(name, name + alias, len - alias);\n                path.len -= alias;\n            }\n        }\n        test_dir = tf->test_dir;\n        tf++;\n        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "trying to use %s: \\"%s\\" \\"%s\\"",\n                       test_dir ? "dir" : "file", name, path.data);\n        if (tf->lengths == NULL && tf->name.len == 0) {\n            if (tf->code) {\n                return tf->code;\n            }\n            path.len -= root;\n            path.data += root;\n            if (path.data[0] == \'@\') {\n                (void) ngx_http_named_location(r, &path);\n            } else {\n                ngx_http_split_args(r, &path, &args);\n                (void) ngx_http_internal_redirect(r, &path, &args);\n            }\n            ngx_http_finalize_request(r, NGX_DONE);\n            return NGX_DONE;\n        }\n        ngx_memzero(&of, sizeof(ngx_open_file_info_t));\n        of.read_ahead = clcf->read_ahead;\n        of.directio = clcf->directio;\n        of.valid = clcf->open_file_cache_valid;\n        of.min_uses = clcf->open_file_cache_min_uses;\n        of.test_only = 1;\n        of.errors = clcf->open_file_cache_errors;\n        of.events = clcf->open_file_cache_events;\n        if (ngx_http_set_disable_symlinks(r, clcf, &path, &of) != NGX_OK) {\n            return NGX_HTTP_INTERNAL_SERVER_ERROR;\n        }\n        if (ngx_open_cached_file(clcf->open_file_cache, &path, &of, r->pool)\n            != NGX_OK)\n        {\n            if (of.err == 0) {\n                return NGX_HTTP_INTERNAL_SERVER_ERROR;\n            }\n            if (of.err != NGX_ENOENT\n                && of.err != NGX_ENOTDIR\n                && of.err != NGX_ENAMETOOLONG)\n            {\n                ngx_log_error(NGX_LOG_CRIT, r->connection->log, of.err,\n                              "%s \\"%s\\" failed", of.failed, path.data);\n            }\n            continue;\n        }\n        if (of.is_dir != test_dir) {\n            continue;\n        }\n        path.len -= root;\n        path.data += root;\n        if (!alias) {\n            r->uri = path;\n        } else if (alias == NGX_MAX_SIZE_T_VALUE) {\n            if (!test_dir) {\n                r->uri = path;\n                r->add_uri_to_alias = 1;\n            }\n        } else {\n            name = r->uri.data;\n            r->uri.len = alias + path.len;\n            r->uri.data = ngx_pnalloc(r->pool, r->uri.len);\n            if (r->uri.data == NULL) {\n                r->uri.len = 0;\n                return NGX_HTTP_INTERNAL_SERVER_ERROR;\n            }\n            p = ngx_copy(r->uri.data, name, alias);\n            ngx_memcpy(p, path.data, path.len);\n        }\n        ngx_http_set_exten(r);\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "try file uri: \\"%V\\"", &r->uri);\n        return NGX_DECLINED;\n    }\n}', 'void\nngx_http_finalize_request(ngx_http_request_t *r, ngx_int_t rc)\n{\n    ngx_connection_t          *c;\n    ngx_http_request_t        *pr;\n    ngx_http_core_loc_conf_t  *clcf;\n    c = r->connection;\n    ngx_log_debug5(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                   "http finalize request: %i, \\"%V?%V\\" a:%d, c:%d",\n                   rc, &r->uri, &r->args, r == c->data, r->main->count);\n    if (rc == NGX_DONE) {\n        ngx_http_finalize_connection(r);\n        return;\n    }\n    if (rc == NGX_OK && r->filter_finalize) {\n        c->error = 1;\n    }\n    if (rc == NGX_DECLINED) {\n        r->content_handler = NULL;\n        r->write_event_handler = ngx_http_core_run_phases;\n        ngx_http_core_run_phases(r);\n        return;\n    }\n    if (r != r->main && r->post_subrequest) {\n        rc = r->post_subrequest->handler(r, r->post_subrequest->data, rc);\n    }\n    if (rc == NGX_ERROR\n        || rc == NGX_HTTP_REQUEST_TIME_OUT\n        || rc == NGX_HTTP_CLIENT_CLOSED_REQUEST\n        || c->error)\n    {\n        if (ngx_http_post_action(r) == NGX_OK) {\n            return;\n        }\n        ngx_http_terminate_request(r, rc);\n        return;\n    }\n    if (rc >= NGX_HTTP_SPECIAL_RESPONSE\n        || rc == NGX_HTTP_CREATED\n        || rc == NGX_HTTP_NO_CONTENT)\n    {\n        if (rc == NGX_HTTP_CLOSE) {\n            ngx_http_terminate_request(r, rc);\n            return;\n        }\n        if (r == r->main) {\n            if (c->read->timer_set) {\n                ngx_del_timer(c->read);\n            }\n            if (c->write->timer_set) {\n                ngx_del_timer(c->write);\n            }\n        }\n        c->read->handler = ngx_http_request_handler;\n        c->write->handler = ngx_http_request_handler;\n        ngx_http_finalize_request(r, ngx_http_special_response_handler(r, rc));\n        return;\n    }\n    if (r != r->main) {\n        clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n        if (r->background) {\n            if (!r->logged) {\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            ngx_http_finalize_connection(r);\n            return;\n        }\n        if (r->buffered || r->postponed) {\n            if (ngx_http_set_write_handler(r) != NGX_OK) {\n                ngx_http_terminate_request(r, 0);\n            }\n            return;\n        }\n        pr = r->parent;\n        if (r == c->data) {\n            r->main->count--;\n            if (!r->logged) {\n                if (clcf->log_subrequest) {\n                    ngx_http_log_request(r);\n                }\n                r->logged = 1;\n            } else {\n                ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                              "subrequest: \\"%V?%V\\" logged again",\n                              &r->uri, &r->args);\n            }\n            r->done = 1;\n            if (pr->postponed && pr->postponed->request == r) {\n                pr->postponed = pr->postponed->next;\n            }\n            c->data = pr;\n        } else {\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                           "http finalize non-active request: \\"%V?%V\\"",\n                           &r->uri, &r->args);\n            r->write_event_handler = ngx_http_request_finalizer;\n            if (r->waited) {\n                r->done = 1;\n            }\n        }\n        if (ngx_http_post_request(pr, NULL) != NGX_OK) {\n            r->main->count++;\n            ngx_http_terminate_request(r, 0);\n            return;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,\n                       "http wake parent request: \\"%V?%V\\"",\n                       &pr->uri, &pr->args);\n        return;\n    }\n    if (r->buffered || c->buffered || r->postponed) {\n        if (ngx_http_set_write_handler(r) != NGX_OK) {\n            ngx_http_terminate_request(r, 0);\n        }\n        return;\n    }\n    if (r != c->data) {\n        ngx_log_error(NGX_LOG_ALERT, c->log, 0,\n                      "http finalize non-active request: \\"%V?%V\\"",\n                      &r->uri, &r->args);\n        return;\n    }\n    r->done = 1;\n    r->read_event_handler = ngx_http_block_reading;\n    r->write_event_handler = ngx_http_request_empty_handler;\n    if (!r->post_action) {\n        r->request_complete = 1;\n    }\n    if (ngx_http_post_action(r) == NGX_OK) {\n        return;\n    }\n    if (c->read->timer_set) {\n        ngx_del_timer(c->read);\n    }\n    if (c->write->timer_set) {\n        c->write->delayed = 0;\n        ngx_del_timer(c->write);\n    }\n    if (c->read->eof) {\n        ngx_http_close_request(r, 0);\n        return;\n    }\n    ngx_http_finalize_connection(r);\n}', 'ngx_int_t\nngx_http_special_response_handler(ngx_http_request_t *r, ngx_int_t error)\n{\n    ngx_uint_t                 i, err;\n    ngx_http_err_page_t       *err_page;\n    ngx_http_core_loc_conf_t  *clcf;\n    ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http special response: %i, \\"%V?%V\\"",\n                   error, &r->uri, &r->args);\n    r->err_status = error;\n    if (r->keepalive) {\n        switch (error) {\n            case NGX_HTTP_BAD_REQUEST:\n            case NGX_HTTP_REQUEST_ENTITY_TOO_LARGE:\n            case NGX_HTTP_REQUEST_URI_TOO_LARGE:\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n            case NGX_HTTP_INTERNAL_SERVER_ERROR:\n            case NGX_HTTP_NOT_IMPLEMENTED:\n                r->keepalive = 0;\n        }\n    }\n    if (r->lingering_close) {\n        switch (error) {\n            case NGX_HTTP_BAD_REQUEST:\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n                r->lingering_close = 0;\n        }\n    }\n    r->headers_out.content_type.len = 0;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (!r->error_page && clcf->error_pages && r->uri_changes != 0) {\n        if (clcf->recursive_error_pages == 0) {\n            r->error_page = 1;\n        }\n        err_page = clcf->error_pages->elts;\n        for (i = 0; i < clcf->error_pages->nelts; i++) {\n            if (err_page[i].status == error) {\n                return ngx_http_send_error_page(r, &err_page[i]);\n            }\n        }\n    }\n    r->expect_tested = 1;\n    if (ngx_http_discard_request_body(r) != NGX_OK) {\n        r->keepalive = 0;\n    }\n    if (clcf->msie_refresh\n        && r->headers_in.msie\n        && (error == NGX_HTTP_MOVED_PERMANENTLY\n            || error == NGX_HTTP_MOVED_TEMPORARILY))\n    {\n        return ngx_http_send_refresh(r);\n    }\n    if (error == NGX_HTTP_CREATED) {\n        err = 0;\n    } else if (error == NGX_HTTP_NO_CONTENT) {\n        err = 0;\n    } else if (error >= NGX_HTTP_MOVED_PERMANENTLY\n               && error < NGX_HTTP_LAST_3XX)\n    {\n        err = error - NGX_HTTP_MOVED_PERMANENTLY + NGX_HTTP_OFF_3XX;\n    } else if (error >= NGX_HTTP_BAD_REQUEST\n               && error < NGX_HTTP_LAST_4XX)\n    {\n        err = error - NGX_HTTP_BAD_REQUEST + NGX_HTTP_OFF_4XX;\n    } else if (error >= NGX_HTTP_NGINX_CODES\n               && error < NGX_HTTP_LAST_5XX)\n    {\n        err = error - NGX_HTTP_NGINX_CODES + NGX_HTTP_OFF_5XX;\n        switch (error) {\n            case NGX_HTTP_TO_HTTPS:\n            case NGX_HTTPS_CERT_ERROR:\n            case NGX_HTTPS_NO_CERT:\n            case NGX_HTTP_REQUEST_HEADER_TOO_LARGE:\n                r->err_status = NGX_HTTP_BAD_REQUEST;\n        }\n    } else {\n        err = 0;\n    }\n    return ngx_http_send_special_response(r, clcf, err);\n}', 'static ngx_int_t\nngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)\n{\n    ngx_int_t                  overwrite;\n    ngx_str_t                  uri, args;\n    ngx_table_elt_t           *location;\n    ngx_http_core_loc_conf_t  *clcf;\n    overwrite = err_page->overwrite;\n    if (overwrite && overwrite != NGX_HTTP_OK) {\n        r->expect_tested = 1;\n    }\n    if (overwrite >= 0) {\n        r->err_status = overwrite;\n    }\n    if (ngx_http_complex_value(r, &err_page->value, &uri) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (uri.len && uri.data[0] == \'/\') {\n        if (err_page->value.lengths) {\n            ngx_http_split_args(r, &uri, &args);\n        } else {\n            args = err_page->args;\n        }\n        if (r->method != NGX_HTTP_HEAD) {\n            r->method = NGX_HTTP_GET;\n            r->method_name = ngx_http_core_get_method;\n        }\n        return ngx_http_internal_redirect(r, &uri, &args);\n    }\n    if (uri.len && uri.data[0] == \'@\') {\n        return ngx_http_named_location(r, &uri);\n    }\n    location = ngx_list_push(&r->headers_out.headers);\n    if (location == NULL) {\n        return NGX_ERROR;\n    }\n    if (overwrite != NGX_HTTP_MOVED_PERMANENTLY\n        && overwrite != NGX_HTTP_MOVED_TEMPORARILY\n        && overwrite != NGX_HTTP_SEE_OTHER\n        && overwrite != NGX_HTTP_TEMPORARY_REDIRECT\n        && overwrite != NGX_HTTP_PERMANENT_REDIRECT)\n    {\n        r->err_status = NGX_HTTP_MOVED_TEMPORARILY;\n    }\n    location->hash = 1;\n    ngx_str_set(&location->key, "Location");\n    location->value = uri;\n    ngx_http_clear_location(r);\n    r->headers_out.location = location;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->msie_refresh && r->headers_in.msie) {\n        return ngx_http_send_refresh(r);\n    }\n    return ngx_http_send_special_response(r, clcf, r->err_status\n                                                   - NGX_HTTP_MOVED_PERMANENTLY\n                                                   + NGX_HTTP_OFF_3XX);\n}', 'ngx_int_t\nngx_http_internal_redirect(ngx_http_request_t *r,\n    ngx_str_t *uri, ngx_str_t *args)\n{\n    ngx_http_core_srv_conf_t  *cscf;\n    r->uri_changes--;\n    if (r->uri_changes == 0) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "rewrite or internal redirection cycle "\n                      "while internally redirecting to \\"%V\\"", uri);\n        r->main->count++;\n        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);\n        return NGX_DONE;\n    }\n    r->uri = *uri;\n    if (args) {\n        r->args = *args;\n    } else {\n        ngx_str_null(&r->args);\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "internal redirect: \\"%V?%V\\"", uri, &r->args);\n    ngx_http_set_exten(r);\n    ngx_memzero(r->ctx, sizeof(void *) * ngx_http_max_module);\n    cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);\n    r->loc_conf = cscf->ctx->loc_conf;\n    ngx_http_update_location_config(r);\n#if (NGX_HTTP_CACHE)\n    r->cache = NULL;\n#endif\n    r->internal = 1;\n    r->valid_unparsed_uri = 0;\n    r->add_uri_to_alias = 0;\n    r->main->count++;\n    ngx_http_handler(r);\n    return NGX_DONE;\n}', "void\nngx_http_set_exten(ngx_http_request_t *r)\n{\n    ngx_int_t  i;\n    ngx_str_null(&r->exten);\n    for (i = r->uri.len - 1; i > 1; i--) {\n        if (r->uri.data[i] == '.' && r->uri.data[i - 1] != '/') {\n            r->exten.len = r->uri.len - i - 1;\n            r->exten.data = &r->uri.data[i + 1];\n            return;\n        } else if (r->uri.data[i] == '/') {\n            return;\n        }\n    }\n    return;\n}"]