src/http/modules/ngx_http_limit_req_module.c:807: error: Integer Overflow L2
  ([0, +oo] - 3):unsigned64.

src/http/modules/ngx_http_limit_req_module.c:755:9: <LHS trace>
753.     ccv.complex_value = &ctx->key;
754. 
755.     if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
             ^
756.         return NGX_CONF_ERROR;
757.     }

src/http/modules/ngx_http_limit_req_module.c:755:9: Call
753.     ccv.complex_value = &ctx->key;
754. 
755.     if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
             ^
756.         return NGX_CONF_ERROR;
757.     }

src/http/ngx_http_script.c:107:1: Parameter `ccv->value->len`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/modules/ngx_http_limit_req_module.c:802:13: Assignment
800.         if (ngx_strncmp(value[i].data, "rate=", 5) == 0) {
801. 
802.             len = value[i].len;
                 ^
803.             p = value[i].data + len - 3;
804. 

src/http/modules/ngx_http_limit_req_module.c:807:17: Binary operation: ([0, +oo] - 3):unsigned64
805.             if (ngx_strncmp(p, "r/s", 3) == 0) {
806.                 scale = 1;
807.                 len -= 3;
                     ^
808. 
809.             } else if (ngx_strncmp(p, "r/m", 3) == 0) {

static char *
ngx_http_limit_req_zone(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
{
    u_char                            *p;
    size_t                             len;
    ssize_t                            size;
    ngx_str_t                         *value, name, s;
    ngx_int_t                          rate, scale;
    ngx_uint_t                         i;
    ngx_shm_zone_t                    *shm_zone;
    ngx_http_limit_req_ctx_t          *ctx;
    ngx_http_compile_complex_value_t   ccv;
    value = cf->args->elts;
    ctx = ngx_pcalloc(cf->pool, sizeof(ngx_http_limit_req_ctx_t));
    if (ctx == NULL) {
        return NGX_CONF_ERROR;
    }
    ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));
    ccv.cf = cf;
    ccv.value = &value[1];
    ccv.complex_value = &ctx->key;
    if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
        return NGX_CONF_ERROR;
    }
    size = 0;
    rate = 1;
    scale = 1;
    name.len = 0;
    for (i = 2; i < cf->args->nelts; i++) {
        if (ngx_strncmp(value[i].data, "zone=", 5) == 0) {
            name.data = value[i].data + 5;
            p = (u_char *) ngx_strchr(name.data, ':');
            if (p == NULL) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid zone size \"%V\"", &value[i]);
                return NGX_CONF_ERROR;
            }
            name.len = p - name.data;
            s.data = p + 1;
            s.len = value[i].data + value[i].len - s.data;
            size = ngx_parse_size(&s);
            if (size == NGX_ERROR) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid zone size \"%V\"", &value[i]);
                return NGX_CONF_ERROR;
            }
            if (size < (ssize_t) (8 * ngx_pagesize)) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "zone \"%V\" is too small", &value[i]);
                return NGX_CONF_ERROR;
            }
            continue;
        }
        if (ngx_strncmp(value[i].data, "rate=", 5) == 0) {
            len = value[i].len;
            p = value[i].data + len - 3;
            if (ngx_strncmp(p, "r/s", 3) == 0) {
                scale = 1;
                len -= 3;
            } else if (ngx_strncmp(p, "r/m", 3) == 0) {
                scale = 60;
                len -= 3;
            }
            rate = ngx_atoi(value[i].data + 5, len - 5);
            if (rate <= 0) {
                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                                   "invalid rate \"%V\"", &value[i]);
                return NGX_CONF_ERROR;
            }
            continue;
        }
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "invalid parameter \"%V\"", &value[i]);
        return NGX_CONF_ERROR;
    }
    if (name.len == 0) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "\"%V\" must have \"zone\" parameter",
                           &cmd->name);
        return NGX_CONF_ERROR;
    }
    ctx->rate = rate * 1000 / scale;
    shm_zone = ngx_shared_memory_add(cf, &name, size,
                                     &ngx_http_limit_req_module);
    if (shm_zone == NULL) {
        return NGX_CONF_ERROR;
    }
    if (shm_zone->data) {
        ctx = shm_zone->data;
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
                           "%V \"%V\" is already bound to key \"%V\"",
                           &cmd->name, &name, &ctx->key.value);
        return NGX_CONF_ERROR;
    }
    shm_zone->init = ngx_http_limit_req_init_zone;
    shm_zone->data = ctx;
    return NGX_CONF_OK;
}
['static char *\nngx_http_limit_req_zone(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    u_char                            *p;\n    size_t                             len;\n    ssize_t                            size;\n    ngx_str_t                         *value, name, s;\n    ngx_int_t                          rate, scale;\n    ngx_uint_t                         i;\n    ngx_shm_zone_t                    *shm_zone;\n    ngx_http_limit_req_ctx_t          *ctx;\n    ngx_http_compile_complex_value_t   ccv;\n    value = cf->args->elts;\n    ctx = ngx_pcalloc(cf->pool, sizeof(ngx_http_limit_req_ctx_t));\n    if (ctx == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));\n    ccv.cf = cf;\n    ccv.value = &value[1];\n    ccv.complex_value = &ctx->key;\n    if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {\n        return NGX_CONF_ERROR;\n    }\n    size = 0;\n    rate = 1;\n    scale = 1;\n    name.len = 0;\n    for (i = 2; i < cf->args->nelts; i++) {\n        if (ngx_strncmp(value[i].data, "zone=", 5) == 0) {\n            name.data = value[i].data + 5;\n            p = (u_char *) ngx_strchr(name.data, \':\');\n            if (p == NULL) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid zone size \\"%V\\"", &value[i]);\n                return NGX_CONF_ERROR;\n            }\n            name.len = p - name.data;\n            s.data = p + 1;\n            s.len = value[i].data + value[i].len - s.data;\n            size = ngx_parse_size(&s);\n            if (size == NGX_ERROR) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid zone size \\"%V\\"", &value[i]);\n                return NGX_CONF_ERROR;\n            }\n            if (size < (ssize_t) (8 * ngx_pagesize)) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "zone \\"%V\\" is too small", &value[i]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "rate=", 5) == 0) {\n            len = value[i].len;\n            p = value[i].data + len - 3;\n            if (ngx_strncmp(p, "r/s", 3) == 0) {\n                scale = 1;\n                len -= 3;\n            } else if (ngx_strncmp(p, "r/m", 3) == 0) {\n                scale = 60;\n                len -= 3;\n            }\n            rate = ngx_atoi(value[i].data + 5, len - 5);\n            if (rate <= 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid rate \\"%V\\"", &value[i]);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[i]);\n        return NGX_CONF_ERROR;\n    }\n    if (name.len == 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "\\"%V\\" must have \\"zone\\" parameter",\n                           &cmd->name);\n        return NGX_CONF_ERROR;\n    }\n    ctx->rate = rate * 1000 / scale;\n    shm_zone = ngx_shared_memory_add(cf, &name, size,\n                                     &ngx_http_limit_req_module);\n    if (shm_zone == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    if (shm_zone->data) {\n        ctx = shm_zone->data;\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "%V \\"%V\\" is already bound to key \\"%V\\"",\n                           &cmd->name, &name, &ctx->key.value);\n        return NGX_CONF_ERROR;\n    }\n    shm_zone->init = ngx_http_limit_req_init_zone;\n    shm_zone->data = ctx;\n    return NGX_CONF_OK;\n}', "ngx_int_t\nngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)\n{\n    ngx_str_t                  *v;\n    ngx_uint_t                  i, n, nv, nc;\n    ngx_array_t                 flushes, lengths, values, *pf, *pl, *pv;\n    ngx_http_script_compile_t   sc;\n    v = ccv->value;\n    nv = 0;\n    nc = 0;\n    for (i = 0; i < v->len; i++) {\n        if (v->data[i] == '$') {\n            if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {\n                nc++;\n            } else {\n                nv++;\n            }\n        }\n    }\n    if ((v->len == 0 || v->data[0] != '$')\n        && (ccv->conf_prefix || ccv->root_prefix))\n    {\n        if (ngx_conf_full_name(ccv->cf->cycle, v, ccv->conf_prefix) != NGX_OK) {\n            return NGX_ERROR;\n        }\n        ccv->conf_prefix = 0;\n        ccv->root_prefix = 0;\n    }\n    ccv->complex_value->value = *v;\n    ccv->complex_value->flushes = NULL;\n    ccv->complex_value->lengths = NULL;\n    ccv->complex_value->values = NULL;\n    if (nv == 0 && nc == 0) {\n        return NGX_OK;\n    }\n    n = nv + 1;\n    if (ngx_array_init(&flushes, ccv->cf->pool, n, sizeof(ngx_uint_t))\n        != NGX_OK)\n    {\n        return NGX_ERROR;\n    }\n    n = nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                  + sizeof(ngx_http_script_var_code_t))\n        + sizeof(uintptr_t);\n    if (ngx_array_init(&lengths, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    n = (nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                   + sizeof(ngx_http_script_var_code_t))\n                + sizeof(uintptr_t)\n                + v->len\n                + sizeof(uintptr_t) - 1)\n            & ~(sizeof(uintptr_t) - 1);\n    if (ngx_array_init(&values, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    pf = &flushes;\n    pl = &lengths;\n    pv = &values;\n    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n    sc.cf = ccv->cf;\n    sc.source = v;\n    sc.flushes = &pf;\n    sc.lengths = &pl;\n    sc.values = &pv;\n    sc.complete_lengths = 1;\n    sc.complete_values = 1;\n    sc.zero = ccv->zero;\n    sc.conf_prefix = ccv->conf_prefix;\n    sc.root_prefix = ccv->root_prefix;\n    if (ngx_http_script_compile(&sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (flushes.nelts) {\n        ccv->complex_value->flushes = flushes.elts;\n        ccv->complex_value->flushes[flushes.nelts] = (ngx_uint_t) -1;\n    }\n    ccv->complex_value->lengths = lengths.elts;\n    ccv->complex_value->values = values.elts;\n    return NGX_OK;\n}"]