src/http/ngx_http_upstream.c:2664: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `ngx_http_file_cache_free`.

src/http/ngx_http_upstream.c:2664:17: Call
2662. 
2663.             } else if (p->upstream_error) {
2664.                 ngx_http_file_cache_free(r->cache, u->pipe->temp_file);
                      ^
2665.             }
2666.         }

src/http/ngx_http_file_cache.c:907:1: <LHS trace>
905. 
906. 
907. void
     ^
908. ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
909. {

src/http/ngx_http_file_cache.c:907:1: Parameter `c->node->count`
  905. 
  906. 
  907. void
       ^
  908. ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
  909. {

src/http/ngx_http_file_cache.c:925:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ngx_http_file_cache_free` 
  923. 
  924.     fcn = c->node;
  925.     fcn->count--;
           ^
  926. 
  927.     if (c->updating) {

void
ngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)
{
    ngx_http_file_cache_t       *cache;
    ngx_http_file_cache_node_t  *fcn;
    if (c->updated) {
        return;
    }
    cache = c->file_cache;
    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,
                   "http file cache free, fd: %d", c->file.fd);
    ngx_shmtx_lock(&cache->shpool->mutex);
    fcn = c->node;
    fcn->count--;
    if (c->updating) {
        fcn->updating = 0;
    }
    if (c->error) {
        fcn->error = c->error;
        if (c->valid_sec) {
            fcn->valid_sec = c->valid_sec;
            fcn->valid_msec = c->valid_msec;
        }
    } else if (!fcn->exists && fcn->count == 0 && c->min_uses == 1) {
        ngx_queue_remove(&fcn->queue);
        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);
        ngx_slab_free_locked(cache->shpool, fcn);
        c->node = NULL;
    }
    ngx_shmtx_unlock(&cache->shpool->mutex);
    c->updated = 1;
    c->updating = 0;
    if (c->temp_file) {
        if (tf && tf->file.fd != NGX_INVALID_FILE) {
            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,
                           "http file cache incomplete: \"%s\"",
                           tf->file.name.data);
            if (ngx_delete_file(tf->file.name.data) == NGX_FILE_ERROR) {
                ngx_log_error(NGX_LOG_CRIT, c->file.log, ngx_errno,
                              ngx_delete_file_n " \"%s\" failed",
                              tf->file.name.data);
            }
        }
    }
}
['static void\nngx_http_upstream_process_request(ngx_http_request_t *r)\n{\n    ngx_uint_t            del;\n    ngx_temp_file_t      *tf;\n    ngx_event_pipe_t     *p;\n    ngx_http_upstream_t  *u;\n    u = r->upstream;\n    p = u->pipe;\n    if (u->peer.connection) {\n        if (u->store) {\n            del = p->upstream_error;\n            tf = u->pipe->temp_file;\n            if (p->upstream_eof || p->upstream_done) {\n                if (u->headers_in.status_n == NGX_HTTP_OK\n                    && (u->headers_in.content_length_n == -1\n                        || (u->headers_in.content_length_n == tf->offset)))\n                {\n                    ngx_http_upstream_store(r, u);\n                } else {\n                    del = 1;\n                }\n            }\n            if (del && tf->file.fd != NGX_INVALID_FILE) {\n                if (ngx_delete_file(tf->file.name.data) == NGX_FILE_ERROR) {\n                    ngx_log_error(NGX_LOG_CRIT, r->connection->log, ngx_errno,\n                                  ngx_delete_file_n " \\"%s\\" failed",\n                                  u->pipe->temp_file->file.name.data);\n                }\n            }\n        }\n#if (NGX_HTTP_CACHE)\n        if (u->cacheable) {\n            if (p->upstream_done) {\n                ngx_http_file_cache_update(r, u->pipe->temp_file);\n            } else if (p->upstream_eof) {\n                ngx_http_file_cache_update(r, u->pipe->temp_file);\n            } else if (p->upstream_error) {\n                ngx_http_file_cache_free(r->cache, u->pipe->temp_file);\n            }\n        }\n#endif\n        if (p->upstream_done || p->upstream_eof || p->upstream_error) {\n            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "http upstream exit: %p", p->out);\n#if 0\n            ngx_http_busy_unlock(u->conf->busy_lock, &u->busy_lock);\n#endif\n            ngx_http_upstream_finalize_request(r, u, 0);\n            return;\n        }\n    }\n    if (p->downstream_error) {\n        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http upstream downstream error");\n        if (!u->cacheable && !u->store && u->peer.connection) {\n            ngx_http_upstream_finalize_request(r, u, 0);\n        }\n    }\n}', 'void\nngx_http_file_cache_free(ngx_http_cache_t *c, ngx_temp_file_t *tf)\n{\n    ngx_http_file_cache_t       *cache;\n    ngx_http_file_cache_node_t  *fcn;\n    if (c->updated) {\n        return;\n    }\n    cache = c->file_cache;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,\n                   "http file cache free, fd: %d", c->file.fd);\n    ngx_shmtx_lock(&cache->shpool->mutex);\n    fcn = c->node;\n    fcn->count--;\n    if (c->updating) {\n        fcn->updating = 0;\n    }\n    if (c->error) {\n        fcn->error = c->error;\n        if (c->valid_sec) {\n            fcn->valid_sec = c->valid_sec;\n            fcn->valid_msec = c->valid_msec;\n        }\n    } else if (!fcn->exists && fcn->count == 0 && c->min_uses == 1) {\n        ngx_queue_remove(&fcn->queue);\n        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);\n        ngx_slab_free_locked(cache->shpool, fcn);\n        c->node = NULL;\n    }\n    ngx_shmtx_unlock(&cache->shpool->mutex);\n    c->updated = 1;\n    c->updating = 0;\n    if (c->temp_file) {\n        if (tf && tf->file.fd != NGX_INVALID_FILE) {\n            ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->file.log, 0,\n                           "http file cache incomplete: \\"%s\\"",\n                           tf->file.name.data);\n            if (ngx_delete_file(tf->file.name.data) == NGX_FILE_ERROR) {\n                ngx_log_error(NGX_LOG_CRIT, c->file.log, ngx_errno,\n                              ngx_delete_file_n " \\"%s\\" failed",\n                              tf->file.name.data);\n            }\n        }\n    }\n}']