src/http/modules/ngx_http_log_module.c:1238: error: Integer Overflow L2
  ([0, +oo] - 5):unsigned64.

src/http/modules/ngx_http_log_module.c:1128:9: <LHS trace>
1126.     ngx_memzero(log, sizeof(ngx_http_log_t));
1127. 
1128.     n = ngx_http_script_variables_count(&value[1]);
              ^
1129. 
1130.     if (n == 0) {

src/http/modules/ngx_http_log_module.c:1128:9: Call
1126.     ngx_memzero(log, sizeof(ngx_http_log_t));
1127. 
1128.     n = ngx_http_script_variables_count(&value[1]);
              ^
1129. 
1130.     if (n == 0) {

src/http/ngx_http_script.c:317:1: Parameter `value->len`
  315. 
  316. 
  317. ngx_uint_t
       ^
  318. ngx_http_script_variables_count(ngx_str_t *value)
  319. {

src/http/modules/ngx_http_log_module.c:1131:21: Call
1129. 
1130.     if (n == 0) {
1131.         log->file = ngx_conf_open_file(cf->cycle, &value[1]);
                          ^
1132.         if (log->file == NULL) {
1133.             return NGX_CONF_ERROR;

src/core/ngx_conf_file.c:891:1: Parameter `name->len`
  889. 
  890. 
  891. ngx_open_file_t *
       ^
  892. ngx_conf_open_file(ngx_cycle_t *cycle, ngx_str_t *name)
  893. {

src/http/modules/ngx_http_log_module.c:1238:13: Binary operation: ([0, +oo] - 5):unsigned64
1236.             }
1237. 
1238.             s.len = value[i].len - 5;
                  ^
1239.             s.data = value[i].data + 5;
1240. 

static char *
ngx_http_log_set_log(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    ngx_http_log_loc_conf_t *llcf = conf;
    ssize_t                     size;
    ngx_int_t                   gzip;
    ngx_uint_t                  i, n;
    ngx_msec_t                  flush;
    ngx_str_t                  *value, name, s;
    ngx_http_log_t             *log;
    ngx_http_log_buf_t         *buffer;
    ngx_http_log_fmt_t         *fmt;
    ngx_http_log_main_conf_t   *lmcf;
    ngx_http_script_compile_t   sc;
    value = cf->args->elts;
    if (ngx_strcmp(value[1].data, "off") == 0) {
        llcf->off = 1;
        if (cf->args->nelts == 2) {
            return NGX_CONF_OK;
        }
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "invalid parameter \"%V\"", &value[2]);
        return NGX_CONF_ERROR;
    }
    if (llcf->logs == NULL) {
        llcf->logs = ngx_array_create(cf->pool, 2, sizeof(ngx_http_log_t));
        if (llcf->logs == NULL) {
            return NGX_CONF_ERROR;
        }
    }
    lmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_log_module);
    log = ngx_array_push(llcf->logs);
    if (log == NULL) {
        return NGX_CONF_ERROR;
    }
    ngx_memzero(log, sizeof(ngx_http_log_t));
    n = ngx_http_script_variables_count(&value[1]);
    if (n == 0) {
        log->file = ngx_conf_open_file(cf->cycle, &value[1]);
        if (log->file == NULL) {
            return NGX_CONF_ERROR;
        }
    } else {
        if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {
            return NGX_CONF_ERROR;
        }
        log->script = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_script_t));
        if (log->script == NULL) {
            return NGX_CONF_ERROR;
        }
        ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));
        sc.cf = cf;
        sc.source = &value[1];
        sc.lengths = &log->script->lengths;
        sc.values = &log->script->values;
        sc.variables = n;
        sc.complete_lengths = 1;
        sc.complete_values = 1;
        if (ngx_http_script_compile(&sc) != NGX_OK) {
            return NGX_CONF_ERROR;
        }
    }
    if (cf->args->nelts >= 3) {
        name = value[2];
        if (ngx_strcmp(name.data, "combined") == 0) {
            lmcf->combined_used = 1;
        }
    } else {
        ngx_str_set(&name, "combined");
        lmcf->combined_used = 1;
    }
    fmt = lmcf->formats.elts;
    for (i = 0; i < lmcf->formats.nelts; i++) {
        if (fmt[i].name.len == name.len
            && ngx_strcasecmp(fmt[i].name.data, name.data) == 0)
        {
            log->format = &fmt[i];
            break;
        }
    }
    if (log->format == NULL) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "unknown log format \"%V\"", &name);
        return NGX_CONF_ERROR;
    }
    size = 0;
    flush = 0;
    gzip = 0;
    for (i = 3; i < cf->args->nelts; i++) {
        if (ngx_strncmp(value[i].data, "buffer=", 7) == 0) {
            s.len = value[i].len - 7;
            s.data = value[i].data + 7;
            size = ngx_parse_size(&s);
            if (size == NGX_ERROR || size == 0) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid buffer size \"%V\"", &s);
                return NGX_CONF_ERROR;
            }
            continue;
        }
        if (ngx_strncmp(value[i].data, "flush=", 6) == 0) {
            s.len = value[i].len - 6;
            s.data = value[i].data + 6;
            flush = ngx_parse_time(&s, 0);
            if (flush == (ngx_msec_t) NGX_ERROR || flush == 0) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid flush time \"%V\"", &s);
                return NGX_CONF_ERROR;
            }
            continue;
        }
        if (ngx_strncmp(value[i].data, "gzip", 4) == 0
            && (value[i].len == 4 || value[i].data[4] == '='))
        {
#if (NGX_ZLIB)
            if (size == 0) {
                size = 64 * 1024;
            }
            if (value[i].len == 4) {
                gzip = Z_BEST_SPEED;
                continue;
            }
            s.len = value[i].len - 5;
            s.data = value[i].data + 5;
            gzip = ngx_atoi(s.data, s.len);
            if (gzip < 1 || gzip > 9) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid compression level \"%V\"", &s);
                return NGX_CONF_ERROR;
            }
            continue;
#else
            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                               "nginx was built without zlib support");
            return NGX_CONF_ERROR;
#endif
        }
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "invalid parameter \"%V\"", &value[i]);
        return NGX_CONF_ERROR;
    }
    if (flush && size == 0) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "no buffer is defined for access_log \"%V\"",
                           &value[1]);
        return NGX_CONF_ERROR;
    }
    if (size) {
        if (log->script) {
            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                               "buffered logs cannot have variables in name");
            return NGX_CONF_ERROR;
        }
        if (log->file->data) {
            buffer = log->file->data;
            if (buffer->last - buffer->start != size
                || buffer->flush != flush
                || buffer->gzip != gzip)
            {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "access_log \"%V\" already defined "
                                   "with conflicting parameters",
                                   &value[1]);
                return NGX_CONF_ERROR;
            }
            return NGX_CONF_OK;
        }
        buffer = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_buf_t));
        if (buffer == NULL) {
            return NGX_CONF_ERROR;
        }
        buffer->start = ngx_pnalloc(cf->pool, size);
        if (buffer->start == NULL) {
            return NGX_CONF_ERROR;
        }
        buffer->pos = buffer->start;
        buffer->last = buffer->start + size;
        if (flush) {
            buffer->event = ngx_pcalloc(cf->pool, sizeof(ngx_event_t));
            if (buffer->event == NULL) {
                return NGX_CONF_ERROR;
            }
            buffer->event->data = log->file;
            buffer->event->handler = ngx_http_log_flush_handler;
            buffer->event->log = &cf->cycle->new_log;
            buffer->flush = flush;
        }
        buffer->gzip = gzip;
        log->file->flush = ngx_http_log_flush;
        log->file->data = buffer;
    }
    return NGX_CONF_OK;
}
['static char *\nngx_http_log_set_log(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_log_loc_conf_t *llcf = conf;\n    ssize_t                     size;\n    ngx_int_t                   gzip;\n    ngx_uint_t                  i, n;\n    ngx_msec_t                  flush;\n    ngx_str_t                  *value, name, s;\n    ngx_http_log_t             *log;\n    ngx_http_log_buf_t         *buffer;\n    ngx_http_log_fmt_t         *fmt;\n    ngx_http_log_main_conf_t   *lmcf;\n    ngx_http_script_compile_t   sc;\n    value = cf->args->elts;\n    if (ngx_strcmp(value[1].data, "off") == 0) {\n        llcf->off = 1;\n        if (cf->args->nelts == 2) {\n            return NGX_CONF_OK;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (llcf->logs == NULL) {\n        llcf->logs = ngx_array_create(cf->pool, 2, sizeof(ngx_http_log_t));\n        if (llcf->logs == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    lmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_log_module);\n    log = ngx_array_push(llcf->logs);\n    if (log == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    ngx_memzero(log, sizeof(ngx_http_log_t));\n    n = ngx_http_script_variables_count(&value[1]);\n    if (n == 0) {\n        log->file = ngx_conf_open_file(cf->cycle, &value[1]);\n        if (log->file == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    } else {\n        if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n        log->script = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_script_t));\n        if (log->script == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n        sc.cf = cf;\n        sc.source = &value[1];\n        sc.lengths = &log->script->lengths;\n        sc.values = &log->script->values;\n        sc.variables = n;\n        sc.complete_lengths = 1;\n        sc.complete_values = 1;\n        if (ngx_http_script_compile(&sc) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    if (cf->args->nelts >= 3) {\n        name = value[2];\n        if (ngx_strcmp(name.data, "combined") == 0) {\n            lmcf->combined_used = 1;\n        }\n    } else {\n        ngx_str_set(&name, "combined");\n        lmcf->combined_used = 1;\n    }\n    fmt = lmcf->formats.elts;\n    for (i = 0; i < lmcf->formats.nelts; i++) {\n        if (fmt[i].name.len == name.len\n            && ngx_strcasecmp(fmt[i].name.data, name.data) == 0)\n        {\n            log->format = &fmt[i];\n            break;\n        }\n    }\n    if (log->format == NULL) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "unknown log format \\"%V\\"", &name);\n        return NGX_CONF_ERROR;\n    }\n    size = 0;\n    flush = 0;\n    gzip = 0;\n    for (i = 3; i < cf->args->nelts; i++) {\n        if (ngx_strncmp(value[i].data, "buffer=", 7) == 0) {\n            s.len = value[i].len - 7;\n            s.data = value[i].data + 7;\n            size = ngx_parse_size(&s);\n            if (size == NGX_ERROR || size == 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid buffer size \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "flush=", 6) == 0) {\n            s.len = value[i].len - 6;\n            s.data = value[i].data + 6;\n            flush = ngx_parse_time(&s, 0);\n            if (flush == (ngx_msec_t) NGX_ERROR || flush == 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid flush time \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "gzip", 4) == 0\n            && (value[i].len == 4 || value[i].data[4] == \'=\'))\n        {\n#if (NGX_ZLIB)\n            if (size == 0) {\n                size = 64 * 1024;\n            }\n            if (value[i].len == 4) {\n                gzip = Z_BEST_SPEED;\n                continue;\n            }\n            s.len = value[i].len - 5;\n            s.data = value[i].data + 5;\n            gzip = ngx_atoi(s.data, s.len);\n            if (gzip < 1 || gzip > 9) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid compression level \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "nginx was built without zlib support");\n            return NGX_CONF_ERROR;\n#endif\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[i]);\n        return NGX_CONF_ERROR;\n    }\n    if (flush && size == 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "no buffer is defined for access_log \\"%V\\"",\n                           &value[1]);\n        return NGX_CONF_ERROR;\n    }\n    if (size) {\n        if (log->script) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "buffered logs cannot have variables in name");\n            return NGX_CONF_ERROR;\n        }\n        if (log->file->data) {\n            buffer = log->file->data;\n            if (buffer->last - buffer->start != size\n                || buffer->flush != flush\n                || buffer->gzip != gzip)\n            {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "access_log \\"%V\\" already defined "\n                                   "with conflicting parameters",\n                                   &value[1]);\n                return NGX_CONF_ERROR;\n            }\n            return NGX_CONF_OK;\n        }\n        buffer = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_buf_t));\n        if (buffer == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        buffer->start = ngx_pnalloc(cf->pool, size);\n        if (buffer->start == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        buffer->pos = buffer->start;\n        buffer->last = buffer->start + size;\n        if (flush) {\n            buffer->event = ngx_pcalloc(cf->pool, sizeof(ngx_event_t));\n            if (buffer->event == NULL) {\n                return NGX_CONF_ERROR;\n            }\n            buffer->event->data = log->file;\n            buffer->event->handler = ngx_http_log_flush_handler;\n            buffer->event->log = &cf->cycle->new_log;\n            buffer->flush = flush;\n        }\n        buffer->gzip = gzip;\n        log->file->flush = ngx_http_log_flush;\n        log->file->data = buffer;\n    }\n    return NGX_CONF_OK;\n}', "ngx_uint_t\nngx_http_script_variables_count(ngx_str_t *value)\n{\n    ngx_uint_t  i, n;\n    for (n = 0, i = 0; i < value->len; i++) {\n        if (value->data[i] == '$') {\n            n++;\n        }\n    }\n    return n;\n}", 'ngx_open_file_t *\nngx_conf_open_file(ngx_cycle_t *cycle, ngx_str_t *name)\n{\n    ngx_str_t         full;\n    ngx_uint_t        i;\n    ngx_list_part_t  *part;\n    ngx_open_file_t  *file;\n#if (NGX_SUPPRESS_WARN)\n    ngx_str_null(&full);\n#endif\n    if (name->len) {\n        full = *name;\n        if (ngx_conf_full_name(cycle, &full, 0) != NGX_OK) {\n            return NULL;\n        }\n        part = &cycle->open_files.part;\n        file = part->elts;\n        for (i = 0;   ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                file = part->elts;\n                i = 0;\n            }\n            if (full.len != file[i].name.len) {\n                continue;\n            }\n            if (ngx_strcmp(full.data, file[i].name.data) == 0) {\n                return &file[i];\n            }\n        }\n    }\n    file = ngx_list_push(&cycle->open_files);\n    if (file == NULL) {\n        return NULL;\n    }\n    if (name->len) {\n        file->fd = NGX_INVALID_FILE;\n        file->name = full;\n    } else {\n        file->fd = ngx_stderr;\n        file->name = *name;\n    }\n    file->flush = NULL;\n    return file;\n}']