Call be a cynic, but isn't this why people should use parser generators instead of handrolling this stuff?

I mean, would you want to audit this file? -> http://trac.nginx.org/nginx/browser/nginx/src/http/ngx_http_...