src/core/ngx_crypt.c:220: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_decode_base64`.

src/core/ngx_crypt.c:213:11: Assignment
211.     encoded.len = ngx_strlen(encoded.data);
212. 
213.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
               ^
214. 
215.     decoded.data = ngx_pnalloc(pool, len);

src/core/ngx_crypt.c:213:5: Assignment
211.     encoded.len = ngx_strlen(encoded.data);
212. 
213.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
         ^
214. 
215.     decoded.data = ngx_pnalloc(pool, len);

src/core/ngx_crypt.c:215:20: Call
213.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
214. 
215.     decoded.data = ngx_pnalloc(pool, len);
                        ^
216.     if (decoded.data == NULL) {
217.         return NGX_ERROR;

src/core/ngx_palloc.c:137:16: Call
  135. {
  136.     if (size <= pool->max) {
  137.         return ngx_palloc_small(pool, size, 0);
                      ^
  138.     }
  139. 

src/core/ngx_palloc.c:153:9: Assignment
    151. 
    152.     do {
    153.         m = p->d.last;
                 ^
    154. 
    155.         if (align) {

src/core/ngx_palloc.c:162:13: Assignment
    160.             p->d.last = m + size;
    161. 
    162.             return m;
                     ^
    163.         }
    164. 

src/core/ngx_palloc.c:137:9: Assignment
  135. {
  136.     if (size <= pool->max) {
  137.         return ngx_palloc_small(pool, size, 0);
               ^
  138.     }
  139. 

src/core/ngx_crypt.c:215:5: Assignment
213.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
214. 
215.     decoded.data = ngx_pnalloc(pool, len);
         ^
216.     if (decoded.data == NULL) {
217.         return NGX_ERROR;

src/core/ngx_crypt.c:220:10: Call
218.     }
219. 
220.     rc = ngx_decode_base64(&decoded, &encoded);
              ^
221. 
222.     if (rc != NGX_OK || decoded.len < 20) {

src/core/ngx_string.c:1185:1: Parameter `*dst->data`
  1183. 
  1184. 
  1185. ngx_int_t
        ^
  1186. ngx_decode_base64(ngx_str_t *dst, ngx_str_t *src)
  1187. {

src/core/ngx_string.c:1208:12: Call
  1206.     };
  1207. 
  1208.     return ngx_decode_base64_internal(dst, src, basis64);
                   ^
  1209. }
  1210. 

src/core/ngx_string.c:1239:1: <Length trace>
1237. 
1238. 
1239. static ngx_int_t
      ^
1240. ngx_decode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis)
1241. {

src/core/ngx_string.c:1239:1: Parameter `*dst->data`
    1237. 
    1238. 
    1239. static ngx_int_t
          ^
    1240. ngx_decode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis)
    1241. {

src/core/ngx_string.c:1260:5: Assignment
    1258. 
    1259.     s = src->data;
    1260.     d = dst->data;
              ^
    1261. 
    1262.     while (len > 3) {

src/core/ngx_string.c:1263:10: Assignment
    1261. 
    1262.     while (len > 3) {
    1263.         *d++ = (u_char) (basis[s[0]] << 2 | basis[s[1]] >> 4);
                   ^
    1264.         *d++ = (u_char) (basis[s[1]] << 4 | basis[s[2]] >> 2);
    1265.         *d++ = (u_char) (basis[s[2]] << 6 | basis[s[3]]);

src/core/ngx_string.c:1264:9: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_decode_base64` 
    1262.     while (len > 3) {
    1263.         *d++ = (u_char) (basis[s[0]] << 2 | basis[s[1]] >> 4);
    1264.         *d++ = (u_char) (basis[s[1]] << 4 | basis[s[2]] >> 2);
                  ^
    1265.         *d++ = (u_char) (basis[s[2]] << 6 | basis[s[3]]);
    1266. 

static ngx_int_t
ngx_decode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis)
{
    size_t          len;
    u_char         *d, *s;
    for (len = 0; len < src->len; len++) {
        if (src->data[len] == '=') {
            break;
        }
        if (basis[src->data[len]] == 77) {
            return NGX_ERROR;
        }
    }
    if (len % 4 == 1) {
        return NGX_ERROR;
    }
    s = src->data;
    d = dst->data;
    while (len > 3) {
        *d++ = (u_char) (basis[s[0]] << 2 | basis[s[1]] >> 4);
        *d++ = (u_char) (basis[s[1]] << 4 | basis[s[2]] >> 2);
        *d++ = (u_char) (basis[s[2]] << 6 | basis[s[3]]);
        s += 4;
        len -= 4;
    }
    if (len > 1) {
        *d++ = (u_char) (basis[s[0]] << 2 | basis[s[1]] >> 4);
    }
    if (len > 2) {
        *d++ = (u_char) (basis[s[1]] << 4 | basis[s[2]] >> 2);
    }
    dst->len = d - dst->data;
    return NGX_OK;
}
['static ngx_int_t\nngx_crypt_ssha(ngx_pool_t *pool, u_char *key, u_char *salt, u_char **encrypted)\n{\n    size_t       len;\n    ngx_int_t    rc;\n    ngx_str_t    encoded, decoded;\n    ngx_sha1_t   sha1;\n    encoded.data = salt + sizeof("{SSHA}") - 1;\n    encoded.len = ngx_strlen(encoded.data);\n    len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);\n    decoded.data = ngx_pnalloc(pool, len);\n    if (decoded.data == NULL) {\n        return NGX_ERROR;\n    }\n    rc = ngx_decode_base64(&decoded, &encoded);\n    if (rc != NGX_OK || decoded.len < 20) {\n        decoded.len = 20;\n    }\n    ngx_sha1_init(&sha1);\n    ngx_sha1_update(&sha1, key, ngx_strlen(key));\n    ngx_sha1_update(&sha1, decoded.data + 20, decoded.len - 20);\n    ngx_sha1_final(decoded.data, &sha1);\n    len = sizeof("{SSHA}") - 1 + ngx_base64_encoded_length(decoded.len) + 1;\n    *encrypted = ngx_pnalloc(pool, len);\n    if (*encrypted == NULL) {\n        return NGX_ERROR;\n    }\n    encoded.data = ngx_cpymem(*encrypted, "{SSHA}", sizeof("{SSHA}") - 1);\n    ngx_encode_base64(&encoded, &decoded);\n    encoded.data[encoded.len] = \'\\0\';\n    return NGX_OK;\n}', 'void *\nngx_pnalloc(ngx_pool_t *pool, size_t size)\n{\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 0);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}', 'ngx_int_t\nngx_decode_base64(ngx_str_t *dst, ngx_str_t *src)\n{\n    static u_char   basis64[] = {\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 62, 77, 77, 77, 63,\n        52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 77, 77, 77, 77, 77, 77,\n        77,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,\n        15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 77, 77, 77, 77, 77,\n        77, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,\n        41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77,\n        77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77, 77\n    };\n    return ngx_decode_base64_internal(dst, src, basis64);\n}', "static ngx_int_t\nngx_decode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis)\n{\n    size_t          len;\n    u_char         *d, *s;\n    for (len = 0; len < src->len; len++) {\n        if (src->data[len] == '=') {\n            break;\n        }\n        if (basis[src->data[len]] == 77) {\n            return NGX_ERROR;\n        }\n    }\n    if (len % 4 == 1) {\n        return NGX_ERROR;\n    }\n    s = src->data;\n    d = dst->data;\n    while (len > 3) {\n        *d++ = (u_char) (basis[s[0]] << 2 | basis[s[1]] >> 4);\n        *d++ = (u_char) (basis[s[1]] << 4 | basis[s[2]] >> 2);\n        *d++ = (u_char) (basis[s[2]] << 6 | basis[s[3]]);\n        s += 4;\n        len -= 4;\n    }\n    if (len > 1) {\n        *d++ = (u_char) (basis[s[0]] << 2 | basis[s[1]] >> 4);\n    }\n    if (len > 2) {\n        *d++ = (u_char) (basis[s[1]] << 4 | basis[s[2]] >> 2);\n    }\n    dst->len = d - dst->data;\n    return NGX_OK;\n}"]