src/http/ngx_http_upstream.c:5044: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

src/http/ngx_http_upstream.c:5024:9: <Length trace>
5022.     }
5023. 
5024.     p = ngx_pnalloc(r->pool, len);
              ^
5025.     if (p == NULL) {
5026.         return NGX_ERROR;

src/http/ngx_http_upstream.c:5024:9: Call
5022.     }
5023. 
5024.     p = ngx_pnalloc(r->pool, len);
              ^
5025.     if (p == NULL) {
5026.         return NGX_ERROR;

src/core/ngx_palloc.c:140:12: Call
  138.     }
  139. 
  140.     return ngx_palloc_large(pool, size);
                  ^
  141. }
  142. 

src/core/ngx_palloc.c:216:9: Call
    214.     ngx_pool_large_t  *large;
    215. 
    216.     p = ngx_alloc(size, pool->log);
                 ^
    217.     if (p == NULL) {
    218.         return NULL;

src/os/unix/ngx_alloc.c:17:1: Parameter `log->next->disk_full_time`
      15. 
      16. 
      17. void *
          ^
      18. ngx_alloc(size_t size, ngx_log_t *log)
      19. {

src/http/ngx_http_upstream.c:5035:13: Assignment
5033.     for ( ;; ) {
5034.         if (state[i].peer) {
5035.             p = ngx_cpymem(p, state[i].peer->data, state[i].peer->len);
                  ^
5036.         }
5037. 

src/http/ngx_http_upstream.c:5043:14: Assignment
5041. 
5042.         if (state[i].peer) {
5043.             *p++ = ',';
                   ^
5044.             *p++ = ' ';
5045. 

src/http/ngx_http_upstream.c:5044:13: Array access: Offset: [1, +oo] Size: [0, +oo]
5042.         if (state[i].peer) {
5043.             *p++ = ',';
5044.             *p++ = ' ';
                  ^
5045. 
5046.         } else {

static ngx_int_t
ngx_http_upstream_addr_variable(ngx_http_request_t *r,
    ngx_http_variable_value_t *v, uintptr_t data)
{
    u_char                     *p;
    size_t                      len;
    ngx_uint_t                  i;
    ngx_http_upstream_state_t  *state;
    v->valid = 1;
    v->no_cacheable = 0;
    v->not_found = 0;
    if (r->upstream_states == NULL || r->upstream_states->nelts == 0) {
        v->not_found = 1;
        return NGX_OK;
    }
    len = 0;
    state = r->upstream_states->elts;
    for (i = 0; i < r->upstream_states->nelts; i++) {
        if (state[i].peer) {
            len += state[i].peer->len + 2;
        } else {
            len += 3;
        }
    }
    p = ngx_pnalloc(r->pool, len);
    if (p == NULL) {
        return NGX_ERROR;
    }
    v->data = p;
    i = 0;
    for ( ;; ) {
        if (state[i].peer) {
            p = ngx_cpymem(p, state[i].peer->data, state[i].peer->len);
        }
        if (++i == r->upstream_states->nelts) {
            break;
        }
        if (state[i].peer) {
            *p++ = ',';
            *p++ = ' ';
        } else {
            *p++ = ' ';
            *p++ = ':';
            *p++ = ' ';
            if (++i == r->upstream_states->nelts) {
                break;
            }
            continue;
        }
    }
    v->len = p - v->data;
    return NGX_OK;
}
["static ngx_int_t\nngx_http_upstream_addr_variable(ngx_http_request_t *r,\n    ngx_http_variable_value_t *v, uintptr_t data)\n{\n    u_char                     *p;\n    size_t                      len;\n    ngx_uint_t                  i;\n    ngx_http_upstream_state_t  *state;\n    v->valid = 1;\n    v->no_cacheable = 0;\n    v->not_found = 0;\n    if (r->upstream_states == NULL || r->upstream_states->nelts == 0) {\n        v->not_found = 1;\n        return NGX_OK;\n    }\n    len = 0;\n    state = r->upstream_states->elts;\n    for (i = 0; i < r->upstream_states->nelts; i++) {\n        if (state[i].peer) {\n            len += state[i].peer->len + 2;\n        } else {\n            len += 3;\n        }\n    }\n    p = ngx_pnalloc(r->pool, len);\n    if (p == NULL) {\n        return NGX_ERROR;\n    }\n    v->data = p;\n    i = 0;\n    for ( ;; ) {\n        if (state[i].peer) {\n            p = ngx_cpymem(p, state[i].peer->data, state[i].peer->len);\n        }\n        if (++i == r->upstream_states->nelts) {\n            break;\n        }\n        if (state[i].peer) {\n            *p++ = ',';\n            *p++ = ' ';\n        } else {\n            *p++ = ' ';\n            *p++ = ':';\n            *p++ = ' ';\n            if (++i == r->upstream_states->nelts) {\n                break;\n            }\n            continue;\n        }\n    }\n    v->len = p - v->data;\n    return NGX_OK;\n}", 'void *\nngx_pnalloc(ngx_pool_t *pool, size_t size)\n{\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 0);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'static void *\nngx_palloc_large(ngx_pool_t *pool, size_t size)\n{\n    void              *p;\n    ngx_uint_t         n;\n    ngx_pool_large_t  *large;\n    p = ngx_alloc(size, pool->log);\n    if (p == NULL) {\n        return NULL;\n    }\n    n = 0;\n    for (large = pool->large; large; large = large->next) {\n        if (large->alloc == NULL) {\n            large->alloc = p;\n            return p;\n        }\n        if (n++ > 3) {\n            break;\n        }\n    }\n    large = ngx_palloc_small(pool, sizeof(ngx_pool_large_t), 1);\n    if (large == NULL) {\n        ngx_free(p);\n        return NULL;\n    }\n    large->alloc = p;\n    large->next = pool->large;\n    pool->large = large;\n    return p;\n}', 'void *\nngx_alloc(size_t size, ngx_log_t *log)\n{\n    void  *p;\n    p = malloc(size);\n    if (p == NULL) {\n        ngx_log_error(NGX_LOG_EMERG, log, ngx_errno,\n                      "malloc(%uz) failed", size);\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_ALLOC, log, 0, "malloc: %p:%uz", p, size);\n    return p;\n}']