int     lld_update_items(zbx_uint64_t hostid, zbx_uint64_t lld_ruleid, const zbx_vector_ptr_t *lld_rows, char **error,
                int lifetime, int lastcheck)
{
        const char              *__function_name = "lld_update_items";

        zbx_vector_ptr_t        applications, application_prototypes, items, item_prototypes, item_dependencies;
        zbx_hashset_t           applications_index, items_index, items_applications;
        int                     ret = SUCCEED, host_record_is_locked = 0;

        zabbix_log(LOG_LEVEL_DEBUG, "In %s()", __function_name);

        zbx_vector_ptr_create(&item_prototypes);

        lld_item_prototypes_get(lld_ruleid, &item_prototypes);

        if (0 == item_prototypes.values_num)
                goto out;

        zbx_vector_ptr_create(&application_prototypes);

        lld_application_prototypes_get(lld_ruleid, &application_prototypes);

        zbx_vector_ptr_create(&applications);
        zbx_hashset_create(&applications_index, application_prototypes.values_num * lld_rows->values_num,
                        lld_application_index_hash_func, lld_application_index_compare_func);

        zbx_vector_ptr_create(&items);
        zbx_hashset_create(&items_index, item_prototypes.values_num * lld_rows->values_num, lld_item_index_hash_func,
                        lld_item_index_compare_func);

        zbx_hashset_create(&items_applications, 100, lld_item_application_hash_func, lld_item_application_compare_func);

        lld_applications_get(lld_ruleid, &applications);
        lld_applications_make(&application_prototypes, lld_rows, &applications, &applications_index);
        lld_applications_validate(hostid, lld_ruleid, &applications, &applications_index, error);

        lld_item_application_prototypes_get(&item_prototypes, &application_prototypes);

        lld_items_get(&item_prototypes, &items);
        lld_items_make(&item_prototypes, lld_rows, &items, &items_index, error);   <---- It goes here.
...	

static void     lld_items_make(const zbx_vector_ptr_t *item_prototypes, const zbx_vector_ptr_t *lld_rows,
                zbx_vector_ptr_t *items, zbx_hashset_t *items_index, char **error)
{
        const char                      *__function_name = "lld_items_make";
        int                             i, j, index;
        zbx_lld_item_prototype_t        *item_prototype;
        zbx_lld_item_t                  *item;
        zbx_lld_row_t                   *lld_row;
        zbx_lld_item_index_t            *item_index, item_index_local;
        char                            *buffer = NULL;

        zabbix_log(LOG_LEVEL_DEBUG, "In %s()", __function_name);

        /* create the items index */
        for (i = 0; i < item_prototypes->values_num; i++)
        {
                item_prototype = (zbx_lld_item_prototype_t *)item_prototypes->values[i];

                for (j = 0; j < lld_rows->values_num; j++)
                        zbx_vector_ptr_append(&item_prototype->lld_rows, lld_rows->values[j]);
        }

        /* Iterate in reverse order because usually the items are created in the same order as     */
        /* incoming lld rows. Iterating in reverse optimizes lld_row removal from item prototypes. */
        for (i = items->values_num - 1; i >= 0; i--)
        {
                item = (zbx_lld_item_t *)items->values[i];

                if (FAIL == (index = zbx_vector_ptr_bsearch(item_prototypes, &item->parent_itemid,
                                ZBX_DEFAULT_UINT64_PTR_COMPARE_FUNC)))
                {
                        THIS_SHOULD_NEVER_HAPPEN;
                        continue;
                }

                item_prototype = (zbx_lld_item_prototype_t *)item_prototypes->values[index];

                for (j = item_prototype->lld_rows.values_num - 1; j >= 0; j--)
                {
                        lld_row = (zbx_lld_row_t *)item_prototype->lld_rows.values[j];

                        buffer = zbx_strdup(buffer, item->key_proto);

                        if (SUCCEED != substitute_key_macros(&buffer, NULL, NULL, &lld_row->jp_row, MACRO_TYPE_ITEM_KEY,
                                        NULL, 0))
                        {
                                continue;
                        }

                        if (0 == strcmp(item->key, buffer))
                        {
                                item_index_local.parent_itemid = item->parent_itemid;
                                item_index_local.lld_row = lld_row;
                                item_index_local.item = item;
                                zbx_hashset_insert(items_index, &item_index_local, sizeof(item_index_local));

                                zbx_vector_ptr_remove_noorder(&item_prototype->lld_rows, j);
                                break;
                        }
                }
        }

        zbx_free(buffer);

        /* update/create discovered items */
        for (i = 0; i < item_prototypes->values_num; i++)
        {
                item_prototype = (zbx_lld_item_prototype_t *)item_prototypes->values[i];
                item_index_local.parent_itemid = item_prototype->itemid;

                for (j = 0; j < lld_rows->values_num; j++)
                {
                        item_index_local.lld_row = (zbx_lld_row_t *)lld_rows->values[j];

                        if (NULL == (item_index = (zbx_lld_item_index_t *)zbx_hashset_search(items_index, &item_index_local)))
                        {
                                if (NULL != (item = lld_item_make(item_prototype, item_index_local.lld_row, error)))	       <---- It goes here.
...

static zbx_lld_item_t   *lld_item_make(const zbx_lld_item_prototype_t *item_prototype, const zbx_lld_row_t *lld_row,
                char **error)
{
        const char                      *__function_name = "lld_item_make";

        zbx_lld_item_t                  *item;
        const struct zbx_json_parse     *jp_row = (struct zbx_json_parse *)&lld_row->jp_row;
        char                            err[MAX_STRING_LEN];
        int                             ret;

        zabbix_log(LOG_LEVEL_DEBUG, "In %s()", __function_name);

        item = (zbx_lld_item_t *)zbx_malloc(NULL, sizeof(zbx_lld_item_t));

        item->itemid = 0;
        item->parent_itemid = item_prototype->itemid;
        item->lastcheck = 0;
        item->ts_delete = 0;
        item->type = item_prototype->type;
        item->key_proto = NULL;
        item->master_itemid = item_prototype->master_itemid;

        item->name = zbx_strdup(NULL, item_prototype->name);
        item->name_proto = NULL;
        substitute_lld_macros(&item->name, jp_row, ZBX_MACRO_ANY, NULL, 0);
        zbx_lrtrim(item->name, ZBX_WHITESPACE);

        item->key = zbx_strdup(NULL, item_prototype->key);
        item->key_orig = NULL;
        ret = substitute_key_macros(&item->key, NULL, NULL, jp_row, MACRO_TYPE_ITEM_KEY, err, sizeof(err));

        item->delay = zbx_strdup(NULL, item_prototype->delay);
        item->delay_orig = NULL;
        substitute_lld_macros(&item->delay, jp_row, ZBX_MACRO_ANY, NULL, 0);
        zbx_lrtrim(item->delay, ZBX_WHITESPACE);

        item->history = zbx_strdup(NULL, item_prototype->history);
        item->history_orig = NULL;
        substitute_lld_macros(&item->history, jp_row, ZBX_MACRO_ANY, NULL, 0);
        zbx_lrtrim(item->history, ZBX_WHITESPACE);

        item->trends = zbx_strdup(NULL, item_prototype->trends);
        item->trends_orig = NULL;
        substitute_lld_macros(&item->trends, jp_row, ZBX_MACRO_ANY, NULL, 0);
        zbx_lrtrim(item->trends, ZBX_WHITESPACE);

        item->units = zbx_strdup(NULL, item_prototype->units);
        item->units_orig = NULL;
        substitute_lld_macros(&item->units, jp_row, ZBX_MACRO_ANY, NULL, 0);
        zbx_lrtrim(item->units, ZBX_WHITESPACE);

        item->params = zbx_strdup(NULL, item_prototype->params);
        item->params_orig = NULL;

        if (ITEM_TYPE_CALCULATED == item_prototype->type)
        {
                if (SUCCEED == ret)
                        ret = substitute_formula_macros(&item->params, jp_row, err, sizeof(err));     <---- It goes here.
...

static int      substitute_formula_macros(char **data, const struct zbx_json_parse *jp_row,
                char *error, size_t max_error_len)
{
        const char      *__function_name = "substitute_formula_macros";

        char            *exp, *tmp, *e;
        size_t          exp_alloc = 128, exp_offset = 0, tmp_alloc = 128, tmp_offset = 0, f_pos, par_l, par_r;
        int             ret = FAIL;

        zabbix_log(LOG_LEVEL_DEBUG, "In %s()", __function_name);

        exp = (char *)zbx_malloc(NULL, exp_alloc);
        tmp = (char *)zbx_malloc(NULL, tmp_alloc);

        for (e = *data; SUCCEED == zbx_function_find(e, &f_pos, &par_l, &par_r, error, max_error_len); e += par_r + 1)
        {
                /* substitute LLD macros in the part of the string preceding function parameters */

                zbx_strncpy_alloc(&tmp, &tmp_alloc, &tmp_offset, e, par_l + 1);
                if (SUCCEED != substitute_lld_macros(&tmp, jp_row, ZBX_MACRO_NUMERIC, error, max_error_len))
                        goto out;

                tmp_offset = strlen(tmp);
                zbx_strncpy_alloc(&exp, &exp_alloc, &exp_offset, tmp, tmp_offset);

                if (++tmp_offset > tmp_alloc)
                        tmp_alloc = tmp_offset;

                tmp_offset = 0;

                /* substitute LLD macros in function parameters */

                if (SUCCEED != substitute_function_lld_param(e + par_l + 1, par_r - (par_l + 1), 1,
                                &exp, &exp_alloc, &exp_offset, jp_row, error, max_error_len))
                {
                        goto out;
                }

                zbx_strcpy_alloc(&exp, &exp_alloc, &exp_offset, ")");
        }

        if (par_l > par_r)
                goto out;

        /* substitute LLD macros in the remaining part */

        zbx_strcpy_alloc(&tmp, &tmp_alloc, &tmp_offset, e);
        if (SUCCEED != substitute_lld_macros(&tmp, jp_row, ZBX_MACRO_NUMERIC, error, max_error_len))		<---- It goes here.
...

int     substitute_lld_macros(char **data, const struct zbx_json_parse *jp_row, int flags, char *error,
                size_t max_error_len)
{
        const char      *__function_name = "substitute_lld_macros";

        int             ret = SUCCEED, pos = 0;
        zbx_token_t     token;

        zabbix_log(LOG_LEVEL_DEBUG, "In %s() data:'%s'", __function_name, *data);

        while (SUCCEED == ret && SUCCEED == zbx_token_find(*data, pos, &token, ZBX_TOKEN_SEARCH_BASIC))
        {
                if (0 != (token.type & flags))
                {
                        switch (token.type)
                        {
                                case ZBX_TOKEN_LLD_MACRO:
                                case ZBX_TOKEN_LLD_FUNC_MACRO:
                                        ret = process_lld_macro_token(data, &token, flags, jp_row, error,
                                                        max_error_len);
                                        pos = token.loc.r;
                                        break;
                                case ZBX_TOKEN_USER_MACRO:
                                        process_user_macro_token(data, &token, jp_row);	    <---- It goes here.
...

static void     process_user_macro_token(char **data, zbx_token_t *token, const struct zbx_json_parse *jp_row)
{
        int                     force_quote;
        size_t                  context_r;
        char                    *context, *context_esc;
        zbx_token_user_macro_t  *macro = &token->data.user_macro;

        /* user macro without context, nothing to replace */
        if (0 == token->data.user_macro.context.l)
                return;

        force_quote = ('"' == (*data)[macro->context.l]);
        context = zbx_user_macro_unquote_context_dyn(*data + macro->context.l, macro->context.r - macro->context.l + 1);

        /* substitute_lld_macros() can't fail with ZBX_TOKEN_LLD_MACRO or ZBX_TOKEN_LLD_FUNC_MACRO flags set */
        substitute_lld_macros(&context, jp_row, ZBX_TOKEN_LLD_MACRO | ZBX_TOKEN_LLD_FUNC_MACRO, NULL, 0);

        context_esc = zbx_user_macro_quote_context_dyn(context, force_quote);

        context_r = macro->context.r;
        zbx_replace_string(data, macro->context.l, &context_r, context_esc);	<---- It goes here.
...

void    zbx_replace_string(char **data, size_t l, size_t *r, const char *value)
{
        size_t  sz_data, sz_block, sz_value;
        char    *src, *dst;

        sz_value = strlen(value);	<---- length of replacing string
        sz_block = *r - l + 1;		<---- length of block where replacement goes into

        if (sz_value != sz_block)	<---- Replacement block does not fit.
        {
                sz_data = *r + strlen(*data + *r);	<---- Calculate the new lenght after replacement.
                sz_data += sz_value - sz_block;

                if (sz_value > sz_block)	   <---- sz_value > sz_block
                        *data = (char *)zbx_realloc(*data, sz_data + 1);   <---- zbx_realloc() is called.
...
}

void    *zbx_realloc2(const char *filename, int line, void *old, size_t size)
{
        int     max_attempts;
        void    *ptr = NULL;

        for (
                max_attempts = 10, size = MAX(size, 1);
                0 < max_attempts && NULL == ptr;
                ptr = realloc(old, size), max_attempts--	<---- Crash in realloc() with "invalid next size: 0x0000000001345240".
        );
....