Hello,
"nginx" crashes in "ngx_http_limit_req_handler".
This does not happen, if "limit_req" is not nested.
We couldn't reproduce this issue in a testing environment.
Thanks a lot

_____Request_____

GET / HTTP/1.1
Host: hostname.com
X-REAL-IP: 123.123.12.123

_____Config_____ (simplified)

http {
# ipaddress + ipaddress/16 + ipaddress/24
map $http_x_real_ip $ipaddress {
default $remote_addr;
"~^\d+\.\d+\.\d+\.\d+$" $http_x_real_ip;
}
map $ipaddress $ipaddress_net {
default "";
"~^(?P<ip>\d+\.\d+)\.\d+\.\d+$" $ip;
}
map $ipaddress $ipaddress_host {
default "";
"~^(?P<ip>\d+\.\d+\.\d+)\.\d+$" $ip;
}

# limit requests
limit_req_log_level warn;
limit_req_zone $ipaddress zone=staticzone_ip:32m rate=100r/s;
limit_req zone=staticzone_ip burst=50;
limit_req_zone $ipaddress zone=dynamiczone_ip:32m rate=2r/s;
limit_req_zone $ipaddress zone=dynamiczone_ddos:32m rate=6r/m;
limit_req_zone $ipaddress_host zone=dynamiczone_host:32m rate=10r/s;
limit_req_zone $ipaddress_net zone=dynamiczone_net:32m rate=20r/s;

server {
location / {
limit_req zone=dynamiczone_ip burst=10;
limit_req zone=dynamiczone_ddos burst=1000 nodelay;
limit_req zone=dynamiczone_host burst=20;
limit_req zone=dynamiczone_net burst=40;

fastcgi_pass unix:/var/run/fastcgi.sock;
...
}
}
}

_____Backtrace_____

#0 0x000000000040b25d in ngx_vslprintf (buf=0x7fff4f9be1df "", last=0x7fff4f9be970 "0", fmt=0x48231b "v\"", args=0x7fff4f9be970) at src/core/ngx_string.c:245
p = 0x7fff4f9be192 "0: *1901681 the value of the \"ipaddress\" variable is more than 65535 bytes: \""
zero = 32 ' '
d = 0
f = 6.9058890903168798e-310
len = 1937
slen = 18446744073709551615
i64 = 0
ui64 = 0
frac = 0
ms = 140734529003968
width = 0
sign = 1
hex = 0
max_width = 0
frac_width = 0
scale = 18446744070750200624
n = 0
v = 0x1b958148
vv = 0x1b99a040

#1 0x000000000040535c in ngx_log_error_core (level=4, log=0x1b9f0e70, err=0, fmt=0x4822e0 "the value of the \"%V\" variable is more than 65535 bytes: \"%v\"") at src/core/ngx_log.c:120
args = {{gp_offset = 48, fp_offset = 48, overflow_arg_area = 0x7fff4f9bea70, reg_save_area = 0x7fff4f9be9a0}}
p = 0x7fff4f9be19e "the value of the \"ipaddress\" variable is more than 65535 bytes: \""
last = 0x7fff4f9be970 "0"
msg = 0x7fff4f9be19e "the value of the \"ipaddress\" variable is more than 65535 bytes: \""
errstr = "2012/08/07 16:17:42 [error] 30667#0: *1901681 the value of the \"ipaddress\" variable is more than 65535 bytes: \"\000\000\000\000\000\000\000\000\000>\001\000\006\000\000\000\000`\233\231\033\000\000\000\000\303)\000\000\000\000\000\000\341\346\233O\377\177\000\000he\233\033\000\000\000\000V\\\000\000\000\000\000\000\000\200\001\000\000\000\000\000pd\233\033\000\000\000\000p\312s\033\371*\000\000\000\000\000\000\000\000\000\000P\363\233O\377\177\000\000\020c\233\033\000\000\000\000"...

#2 0x000000000046d5d2 in ngx_http_limit_req_handler (r=0x1b99faa0) at src/http/modules/ngx_http_limit_req_module.c:192
len = 194343136
hash = 4294967295
rc = -5
n = 0
excess = 0
delay = 463076000
vv = 0x1b99a040
ctx = 0x1b958128
lrcf = 0x1b9594a0
limit = 0x1b959f00
limits = 0x1b959f00

#3 0x0000000000437b08 in ngx_http_core_generic_phase (r=0x1b99faa0, ph=0x1b968e58) at src/http/ngx_http_core_module.c:899
rc = -5

#4 0x0000000000437ab6 in ngx_http_core_run_phases (r=0x1b99faa0) at src/http/ngx_http_core_module.c:877
rc = -2
ph = 0x1b968df8
cmcf = 0x1b932278

#5 0x0000000000437a32 in ngx_http_handler (r=0x1b99faa0) at src/http/ngx_http_core_module.c:860
cmcf = 0x2af91c2ba0a8

#6 0x000000000044459c in ngx_http_process_request (r=0x1b99faa0) at src/http/ngx_http_request.c:1688
c = 0x2af91b73d258

#7 0x0000000000443259 in ngx_http_process_request_headers (rev=0x2af91c2ba0a8) at src/http/ngx_http_request.c:1132
p = 0x10 <Address 0x10 out of bounds>
len = 463051616
n = 43
rc = 0
rv = 140734529006688
h = 0x1b99a1c0
c = 0x2af91b73d258
hh = 0x0
r = 0x1b99faa0
cscf = 0x1b963668
cmcf = 0x1b932278

#8 0x0000000000442afe in ngx_http_process_request_line (rev=0x2af91c2ba0a8) at src/http/ngx_http_request.c:932
host = 0x1b999b60 "\211\245\231\033"
n = 58
rc = 0
rv = 368
c = 0x2af91b73d258
r = 0x1b99faa0
cscf = 0x1b99a020

#9 0x00000000004423b5 in ngx_http_init_request (rev=0x2af91c2ba0a8) at src/http/ngx_http_request.c:519
tp = 0x6975a0
i = 463074232
c = 0x2af91b73d258
r = 0x1b99faa0
sin = 0x7fff4f9bed70
port = 0x1b969230
addr = 0x1b969240
ctx = 0x1b9f0eb0
addr_conf = 0x1b969248
hc = 0x1b9f0ec8
cscf = 0x1b963668
clcf = 0x1b963700
cmcf = 0x1b932278

#10 0x00000000004328b2 in ngx_epoll_process_events (cycle=0x1b9316c0, timer=500, flags=1) at src/event/modules/ngx_epoll_module.c:679
events = 1
revents = 1
instance = 1
i = 0
level = 1335619040
err = 0
rev = 0x2af91c2ba0a8
wev = 0x428d62
queue = 0x0
c = 0x2af91b73d258

#11 0x0000000000425dc0 in ngx_process_events_and_timers (cycle=0x1b9316c0) at src/event/ngx_event.c:247
flags = 1
timer = 500
delta = 1344349062687

#12 0x0000000000430d04 in ngx_worker_process_cycle (cycle=0x1b9316c0, data=0x0) at src/os/unix/ngx_process_cycle.c:808
i = 140734529008464
c = 0x0

#13 0x000000000042dda1 in ngx_spawn_process (cycle=0x1b9316c0, proc=0x430bb0 <ngx_worker_process_cycle>, data=0x0, name=0x47d6c8 "worker process", respawn=-4) at src/os/unix/ngx_process.c:198
on = 1
pid = 0
s = 6

#14 0x000000000042ffd7 in ngx_start_worker_processes (cycle=0x1b9316c0, n=4, type=-4) at src/os/unix/ngx_process_cycle.c:365
i = 2
ch = {command = 1, pid = 30666, slot = 5, fd = 15}

#15 0x000000000042fbf7 in ngx_master_process_cycle (cycle=0x1b9316c0) at src/os/unix/ngx_process_cycle.c:250
title = 0x1b94e44b ""
p = 0x1b94e48d ""
size = 67
i = 3
n = 462608624
sigio = 0
set = {__val = {0 <repeats 16 times>}}
itv = {it_interval = {tv_sec = 0, tv_usec = 0}, it_value = {tv_sec = 8, tv_usec = 18}}
live = 1
delay = 0
ls = 0x4
ccf = 0x1b931ce8

#16 0x0000000000403280 in main (argc=3, argv=0x7fff4f9bf358) at src/core/nginx.c:410
i = 30
log = 0x697300
cycle = 0x1b92d6b0
init_cycle = {conf_ctx = 0x0, pool = 0x1b92c930, log = 0x697300, new_log = {log_level = 0, file = 0x0, connection = 0, handler = 0, data = 0x0, action = 0x0}, files = 0x0,
free_connections = 0x0, free_connection_n = 0, reusable_connections_queue = {prev = 0x0, next = 0x0}, listening = {elts = 0x1b92ce80, nelts = 1, size = 200, nalloc = 10,
pool = 0x1b92c930}, pathes = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, open_files = {last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0,
nalloc = 0, pool = 0x0}, shared_memory = {last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0}, connection_n = 0, files_n = 0,
connections = 0x0, read_events = 0x0, write_events = 0x0, old_cycle = 0x0, conf_file = {len = 20, data = 0x7fff4f9c0e91 ""}, conf_param = {len = 0, data = 0x0}, conf_prefix = {
len = 10, data = 0x7fff4f9c0e91 ""}, prefix = {len = 17, data = 0x47a67e "/usr/local/nginx/"}, lock_file = {len = 0, data = 0x0}, hostname = {len = 0, data = 0x0}}
ccf = 0x1b92ded8