src/http/ngx_http_special_response.c:769: error: Buffer Overrun L3
  Offset added: 55 Size: [0, +oo].

src/http/ngx_http_special_response.c:729:5: <Length trace>
727.     ngx_chain_t   out;
728. 
729.     len = r->headers_out.location->value.len;
         ^
730.     location = r->headers_out.location->value.data;
731. 

src/http/ngx_http_special_response.c:729:5: Assignment
727.     ngx_chain_t   out;
728. 
729.     len = r->headers_out.location->value.len;
         ^
730.     location = r->headers_out.location->value.data;
731. 

src/http/ngx_http_special_response.c:734:5: Assignment
732.     escape = 2 * ngx_escape_uri(NULL, location, len, NGX_ESCAPE_REFRESH);
733. 
734.     size = sizeof(ngx_http_msie_refresh_head) - 1
         ^
735.            + escape + len
736.            + sizeof(ngx_http_msie_refresh_tail) - 1;

src/http/ngx_http_special_response.c:764:9: Call
762.     }
763. 
764.     b = ngx_create_temp_buf(r->pool, size);
             ^
765.     if (b == NULL) {
766.         return NGX_ERROR;

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:126:16: Call
    124. {
    125.     if (size <= pool->max) {
    126.         return ngx_palloc_small(pool, size, 1);
                        ^
    127.     }
    128. 

src/core/ngx_palloc.c:153:9: Assignment
      151. 
      152.     do {
      153.         m = p->d.last;
                   ^
      154. 
      155.         if (align) {

src/core/ngx_palloc.c:162:13: Assignment
      160.             p->d.last = m + size;
      161. 
      162.             return m;
                       ^
      163.         }
      164. 

src/core/ngx_palloc.c:126:9: Assignment
    124. {
    125.     if (size <= pool->max) {
    126.         return ngx_palloc_small(pool, size, 1);
                 ^
    127.     }
    128. 

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:38:5: Assignment
  36.      */
  37. 
  38.     b->pos = b->start;
          ^
  39.     b->last = b->start;
  40.     b->end = b->last + size;

src/http/ngx_http_special_response.c:769:9: Array access: Offset added: 55 Size: [0, +oo]
767.     }
768. 
769.     p = ngx_cpymem(b->pos, ngx_http_msie_refresh_head,
             ^
770.                    sizeof(ngx_http_msie_refresh_head) - 1);
771. 

static ngx_int_t
ngx_http_send_refresh(ngx_http_request_t *r)
{
    u_char       *p, *location;
    size_t        len, size;
    uintptr_t     escape;
    ngx_int_t     rc;
    ngx_buf_t    *b;
    ngx_chain_t   out;
    len = r->headers_out.location->value.len;
    location = r->headers_out.location->value.data;
    escape = 2 * ngx_escape_uri(NULL, location, len, NGX_ESCAPE_REFRESH);
    size = sizeof(ngx_http_msie_refresh_head) - 1
           + escape + len
           + sizeof(ngx_http_msie_refresh_tail) - 1;
    r->err_status = NGX_HTTP_OK;
    r->headers_out.content_type_len = sizeof("text/html") - 1;
    ngx_str_set(&r->headers_out.content_type, "text/html");
    r->headers_out.content_type_lowcase = NULL;
    r->headers_out.location->hash = 0;
    r->headers_out.location = NULL;
    r->headers_out.content_length_n = size;
    if (r->headers_out.content_length) {
        r->headers_out.content_length->hash = 0;
        r->headers_out.content_length = NULL;
    }
    ngx_http_clear_accept_ranges(r);
    ngx_http_clear_last_modified(r);
    ngx_http_clear_etag(r);
    rc = ngx_http_send_header(r);
    if (rc == NGX_ERROR || r->header_only) {
        return rc;
    }
    b = ngx_create_temp_buf(r->pool, size);
    if (b == NULL) {
        return NGX_ERROR;
    }
    p = ngx_cpymem(b->pos, ngx_http_msie_refresh_head,
                   sizeof(ngx_http_msie_refresh_head) - 1);
    if (escape == 0) {
        p = ngx_cpymem(p, location, len);
    } else {
        p = (u_char *) ngx_escape_uri(p, location, len, NGX_ESCAPE_REFRESH);
    }
    b->last = ngx_cpymem(p, ngx_http_msie_refresh_tail,
                         sizeof(ngx_http_msie_refresh_tail) - 1);
    b->last_buf = 1;
    b->last_in_chain = 1;
    out.buf = b;
    out.next = NULL;
    return ngx_http_output_filter(r, &out);
}
['static ngx_int_t\nngx_http_send_refresh(ngx_http_request_t *r)\n{\n    u_char       *p, *location;\n    size_t        len, size;\n    uintptr_t     escape;\n    ngx_int_t     rc;\n    ngx_buf_t    *b;\n    ngx_chain_t   out;\n    len = r->headers_out.location->value.len;\n    location = r->headers_out.location->value.data;\n    escape = 2 * ngx_escape_uri(NULL, location, len, NGX_ESCAPE_REFRESH);\n    size = sizeof(ngx_http_msie_refresh_head) - 1\n           + escape + len\n           + sizeof(ngx_http_msie_refresh_tail) - 1;\n    r->err_status = NGX_HTTP_OK;\n    r->headers_out.content_type_len = sizeof("text/html") - 1;\n    ngx_str_set(&r->headers_out.content_type, "text/html");\n    r->headers_out.content_type_lowcase = NULL;\n    r->headers_out.location->hash = 0;\n    r->headers_out.location = NULL;\n    r->headers_out.content_length_n = size;\n    if (r->headers_out.content_length) {\n        r->headers_out.content_length->hash = 0;\n        r->headers_out.content_length = NULL;\n    }\n    ngx_http_clear_accept_ranges(r);\n    ngx_http_clear_last_modified(r);\n    ngx_http_clear_etag(r);\n    rc = ngx_http_send_header(r);\n    if (rc == NGX_ERROR || r->header_only) {\n        return rc;\n    }\n    b = ngx_create_temp_buf(r->pool, size);\n    if (b == NULL) {\n        return NGX_ERROR;\n    }\n    p = ngx_cpymem(b->pos, ngx_http_msie_refresh_head,\n                   sizeof(ngx_http_msie_refresh_head) - 1);\n    if (escape == 0) {\n        p = ngx_cpymem(p, location, len);\n    } else {\n        p = (u_char *) ngx_escape_uri(p, location, len, NGX_ESCAPE_REFRESH);\n    }\n    b->last = ngx_cpymem(p, ngx_http_msie_refresh_tail,\n                         sizeof(ngx_http_msie_refresh_tail) - 1);\n    b->last_buf = 1;\n    b->last_in_chain = 1;\n    out.buf = b;\n    out.next = NULL;\n    return ngx_http_output_filter(r, &out);\n}', 'ngx_buf_t *\nngx_create_temp_buf(ngx_pool_t *pool, size_t size)\n{\n    ngx_buf_t *b;\n    b = ngx_calloc_buf(pool);\n    if (b == NULL) {\n        return NULL;\n    }\n    b->start = ngx_palloc(pool, size);\n    if (b->start == NULL) {\n        return NULL;\n    }\n    b->pos = b->start;\n    b->last = b->start;\n    b->end = b->last + size;\n    b->temporary = 1;\n    return b;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 1);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}']