src/http/modules/ngx_http_fastcgi_module.c:1044: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, 65590].

src/http/modules/ngx_http_fastcgi_module.c:830:5: <Length trace>
828.     ngx_http_script_len_code_pt   lcode;
829. 
830.     len = 0;
         ^
831.     header_params = 0;
832.     ignored = NULL;

src/http/modules/ngx_http_fastcgi_module.c:830:5: Assignment
828.     ngx_http_script_len_code_pt   lcode;
829. 
830.     len = 0;
         ^
831.     header_params = 0;
832.     ignored = NULL;

src/http/modules/ngx_http_fastcgi_module.c:962:5: Assignment
960. 
961. 
962.     size = sizeof(ngx_http_fastcgi_header_t)
         ^
963.            + sizeof(ngx_http_fastcgi_begin_request_t)
964. 

src/http/modules/ngx_http_fastcgi_module.c:972:9: Call
970. 
971. 
972.     b = ngx_create_temp_buf(r->pool, size);
             ^
973.     if (b == NULL) {
974.         return NGX_ERROR;

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:126:16: Call
    124. {
    125.     if (size <= pool->max) {
    126.         return ngx_palloc_small(pool, size, 1);
                        ^
    127.     }
    128. 

src/core/ngx_palloc.c:153:9: Assignment
      151. 
      152.     do {
      153.         m = p->d.last;
                   ^
      154. 
      155.         if (align) {

src/core/ngx_palloc.c:162:13: Assignment
      160.             p->d.last = m + size;
      161. 
      162.             return m;
                       ^
      163.         }
      164. 

src/core/ngx_palloc.c:126:9: Assignment
    124. {
    125.     if (size <= pool->max) {
    126.         return ngx_palloc_small(pool, size, 1);
                 ^
    127.     }
    128. 

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:39:5: Assignment
  37. 
  38.     b->pos = b->start;
  39.     b->last = b->start;
          ^
  40.     b->end = b->last + size;
  41.     b->temporary = 1;

src/http/modules/ngx_http_fastcgi_module.c:1008:9: Assignment
1006. 
1007.         e.ip = params->values->elts;
1008.         e.pos = b->last;
              ^
1009.         e.request = r;
1010.         e.flushed = 1;

src/http/modules/ngx_http_fastcgi_module.c:1041:14: Assignment
1039.             }
1040. 
1041.             *e.pos++ = (u_char) key_len;
                   ^
1042. 
1043.             if (val_len > 127) {

src/http/modules/ngx_http_fastcgi_module.c:1044:17: Array access: Offset: [1, +oo] Size: [0, 65590]
1042. 
1043.             if (val_len > 127) {
1044.                 *e.pos++ = (u_char) (((val_len >> 24) & 0x7f) | 0x80);
                      ^
1045.                 *e.pos++ = (u_char) ((val_len >> 16) & 0xff);
1046.                 *e.pos++ = (u_char) ((val_len >> 8) & 0xff);

static ngx_int_t
ngx_http_fastcgi_create_request(ngx_http_request_t *r)
{
    off_t                         file_pos;
    u_char                        ch, *pos, *lowcase_key;
    size_t                        size, len, key_len, val_len, padding,
                                  allocated;
    ngx_uint_t                    i, n, next, hash, skip_empty, header_params;
    ngx_buf_t                    *b;
    ngx_chain_t                  *cl, *body;
    ngx_list_part_t              *part;
    ngx_table_elt_t              *header, **ignored;
    ngx_http_upstream_t          *u;
    ngx_http_script_code_pt       code;
    ngx_http_script_engine_t      e, le;
    ngx_http_fastcgi_header_t    *h;
    ngx_http_fastcgi_params_t    *params;
    ngx_http_fastcgi_loc_conf_t  *flcf;
    ngx_http_script_len_code_pt   lcode;
    len = 0;
    header_params = 0;
    ignored = NULL;
    u = r->upstream;
    flcf = ngx_http_get_module_loc_conf(r, ngx_http_fastcgi_module);
#if (NGX_HTTP_CACHE)
    params = u->cacheable ? &flcf->params_cache : &flcf->params;
#else
    params = &flcf->params;
#endif
    if (params->lengths) {
        ngx_memzero(&le, sizeof(ngx_http_script_engine_t));
        ngx_http_script_flush_no_cacheable_variables(r, params->flushes);
        le.flushed = 1;
        le.ip = params->lengths->elts;
        le.request = r;
        while (*(uintptr_t *) le.ip) {
            lcode = *(ngx_http_script_len_code_pt *) le.ip;
            key_len = lcode(&le);
            lcode = *(ngx_http_script_len_code_pt *) le.ip;
            skip_empty = lcode(&le);
            for (val_len = 0; *(uintptr_t *) le.ip; val_len += lcode(&le)) {
                lcode = *(ngx_http_script_len_code_pt *) le.ip;
            }
            le.ip += sizeof(uintptr_t);
            if (skip_empty && val_len == 0) {
                continue;
            }
            len += 1 + key_len + ((val_len > 127) ? 4 : 1) + val_len;
        }
    }
    if (flcf->upstream.pass_request_headers) {
        allocated = 0;
        lowcase_key = NULL;
        if (params->number) {
            n = 0;
            part = &r->headers_in.headers.part;
            while (part) {
                n += part->nelts;
                part = part->next;
            }
            ignored = ngx_palloc(r->pool, n * sizeof(void *));
            if (ignored == NULL) {
                return NGX_ERROR;
            }
        }
        part = &r->headers_in.headers.part;
        header = part->elts;
        for (i = 0;  ; i++) {
            if (i >= part->nelts) {
                if (part->next == NULL) {
                    break;
                }
                part = part->next;
                header = part->elts;
                i = 0;
            }
            if (params->number) {
                if (allocated < header[i].key.len) {
                    allocated = header[i].key.len + 16;
                    lowcase_key = ngx_pnalloc(r->pool, allocated);
                    if (lowcase_key == NULL) {
                        return NGX_ERROR;
                    }
                }
                hash = 0;
                for (n = 0; n < header[i].key.len; n++) {
                    ch = header[i].key.data[n];
                    if (ch >= 'A' && ch <= 'Z') {
                        ch |= 0x20;
                    } else if (ch == '-') {
                        ch = '_';
                    }
                    hash = ngx_hash(hash, ch);
                    lowcase_key[n] = ch;
                }
                if (ngx_hash_find(&params->hash, hash, lowcase_key, n)) {
                    ignored[header_params++] = &header[i];
                    continue;
                }
                n += sizeof("HTTP_") - 1;
            } else {
                n = sizeof("HTTP_") - 1 + header[i].key.len;
            }
            len += ((n > 127) ? 4 : 1) + ((header[i].value.len > 127) ? 4 : 1)
                + n + header[i].value.len;
        }
    }
    if (len > 65535) {
        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
                      "fastcgi request record is too big: %uz", len);
        return NGX_ERROR;
    }
    padding = 8 - len % 8;
    padding = (padding == 8) ? 0 : padding;
    size = sizeof(ngx_http_fastcgi_header_t)
           + sizeof(ngx_http_fastcgi_begin_request_t)
           + sizeof(ngx_http_fastcgi_header_t)
           + len + padding
           + sizeof(ngx_http_fastcgi_header_t)
           + sizeof(ngx_http_fastcgi_header_t);
    b = ngx_create_temp_buf(r->pool, size);
    if (b == NULL) {
        return NGX_ERROR;
    }
    cl = ngx_alloc_chain_link(r->pool);
    if (cl == NULL) {
        return NGX_ERROR;
    }
    cl->buf = b;
    ngx_http_fastcgi_request_start.br.flags =
        flcf->keep_conn ? NGX_HTTP_FASTCGI_KEEP_CONN : 0;
    ngx_memcpy(b->pos, &ngx_http_fastcgi_request_start,
               sizeof(ngx_http_fastcgi_request_start_t));
    h = (ngx_http_fastcgi_header_t *)
             (b->pos + sizeof(ngx_http_fastcgi_header_t)
                     + sizeof(ngx_http_fastcgi_begin_request_t));
    h->content_length_hi = (u_char) ((len >> 8) & 0xff);
    h->content_length_lo = (u_char) (len & 0xff);
    h->padding_length = (u_char) padding;
    h->reserved = 0;
    b->last = b->pos + sizeof(ngx_http_fastcgi_header_t)
                     + sizeof(ngx_http_fastcgi_begin_request_t)
                     + sizeof(ngx_http_fastcgi_header_t);
    if (params->lengths) {
        ngx_memzero(&e, sizeof(ngx_http_script_engine_t));
        e.ip = params->values->elts;
        e.pos = b->last;
        e.request = r;
        e.flushed = 1;
        le.ip = params->lengths->elts;
        while (*(uintptr_t *) le.ip) {
            lcode = *(ngx_http_script_len_code_pt *) le.ip;
            key_len = (u_char) lcode(&le);
            lcode = *(ngx_http_script_len_code_pt *) le.ip;
            skip_empty = lcode(&le);
            for (val_len = 0; *(uintptr_t *) le.ip; val_len += lcode(&le)) {
                lcode = *(ngx_http_script_len_code_pt *) le.ip;
            }
            le.ip += sizeof(uintptr_t);
            if (skip_empty && val_len == 0) {
                e.skip = 1;
                while (*(uintptr_t *) e.ip) {
                    code = *(ngx_http_script_code_pt *) e.ip;
                    code((ngx_http_script_engine_t *) &e);
                }
                e.ip += sizeof(uintptr_t);
                e.skip = 0;
                continue;
            }
            *e.pos++ = (u_char) key_len;
            if (val_len > 127) {
                *e.pos++ = (u_char) (((val_len >> 24) & 0x7f) | 0x80);
                *e.pos++ = (u_char) ((val_len >> 16) & 0xff);
                *e.pos++ = (u_char) ((val_len >> 8) & 0xff);
                *e.pos++ = (u_char) (val_len & 0xff);
            } else {
                *e.pos++ = (u_char) val_len;
            }
            while (*(uintptr_t *) e.ip) {
                code = *(ngx_http_script_code_pt *) e.ip;
                code((ngx_http_script_engine_t *) &e);
            }
            e.ip += sizeof(uintptr_t);
            ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                           "fastcgi param: \"%*s: %*s\"",
                           key_len, e.pos - (key_len + val_len),
                           val_len, e.pos - val_len);
        }
        b->last = e.pos;
    }
    if (flcf->upstream.pass_request_headers) {
        part = &r->headers_in.headers.part;
        header = part->elts;
        for (i = 0;  ; i++) {
            if (i >= part->nelts) {
                if (part->next == NULL) {
                    break;
                }
                part = part->next;
                header = part->elts;
                i = 0;
            }
            for (n = 0; n < header_params; n++) {
                if (&header[i] == ignored[n]) {
                    goto next;
                }
            }
            key_len = sizeof("HTTP_") - 1 + header[i].key.len;
            if (key_len > 127) {
                *b->last++ = (u_char) (((key_len >> 24) & 0x7f) | 0x80);
                *b->last++ = (u_char) ((key_len >> 16) & 0xff);
                *b->last++ = (u_char) ((key_len >> 8) & 0xff);
                *b->last++ = (u_char) (key_len & 0xff);
            } else {
                *b->last++ = (u_char) key_len;
            }
            val_len = header[i].value.len;
            if (val_len > 127) {
                *b->last++ = (u_char) (((val_len >> 24) & 0x7f) | 0x80);
                *b->last++ = (u_char) ((val_len >> 16) & 0xff);
                *b->last++ = (u_char) ((val_len >> 8) & 0xff);
                *b->last++ = (u_char) (val_len & 0xff);
            } else {
                *b->last++ = (u_char) val_len;
            }
            b->last = ngx_cpymem(b->last, "HTTP_", sizeof("HTTP_") - 1);
            for (n = 0; n < header[i].key.len; n++) {
                ch = header[i].key.data[n];
                if (ch >= 'a' && ch <= 'z') {
                    ch &= ~0x20;
                } else if (ch == '-') {
                    ch = '_';
                }
                *b->last++ = ch;
            }
            b->last = ngx_copy(b->last, header[i].value.data, val_len);
            ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                           "fastcgi param: \"%*s: %*s\"",
                           key_len, b->last - (key_len + val_len),
                           val_len, b->last - val_len);
        next:
            continue;
        }
    }
    if (padding) {
        ngx_memzero(b->last, padding);
        b->last += padding;
    }
    h = (ngx_http_fastcgi_header_t *) b->last;
    b->last += sizeof(ngx_http_fastcgi_header_t);
    h->version = 1;
    h->type = NGX_HTTP_FASTCGI_PARAMS;
    h->request_id_hi = 0;
    h->request_id_lo = 1;
    h->content_length_hi = 0;
    h->content_length_lo = 0;
    h->padding_length = 0;
    h->reserved = 0;
    if (r->request_body_no_buffering) {
        u->request_bufs = cl;
        u->output.output_filter = ngx_http_fastcgi_body_output_filter;
        u->output.filter_ctx = r;
    } else if (flcf->upstream.pass_request_body) {
        body = u->request_bufs;
        u->request_bufs = cl;
#if (NGX_SUPPRESS_WARN)
        file_pos = 0;
        pos = NULL;
#endif
        while (body) {
            if (body->buf->in_file) {
                file_pos = body->buf->file_pos;
            } else {
                pos = body->buf->pos;
            }
            next = 0;
            do {
                b = ngx_alloc_buf(r->pool);
                if (b == NULL) {
                    return NGX_ERROR;
                }
                ngx_memcpy(b, body->buf, sizeof(ngx_buf_t));
                if (body->buf->in_file) {
                    b->file_pos = file_pos;
                    file_pos += 32 * 1024;
                    if (file_pos >= body->buf->file_last) {
                        file_pos = body->buf->file_last;
                        next = 1;
                    }
                    b->file_last = file_pos;
                    len = (ngx_uint_t) (file_pos - b->file_pos);
                } else {
                    b->pos = pos;
                    b->start = pos;
                    pos += 32 * 1024;
                    if (pos >= body->buf->last) {
                        pos = body->buf->last;
                        next = 1;
                    }
                    b->last = pos;
                    len = (ngx_uint_t) (pos - b->pos);
                }
                padding = 8 - len % 8;
                padding = (padding == 8) ? 0 : padding;
                h = (ngx_http_fastcgi_header_t *) cl->buf->last;
                cl->buf->last += sizeof(ngx_http_fastcgi_header_t);
                h->version = 1;
                h->type = NGX_HTTP_FASTCGI_STDIN;
                h->request_id_hi = 0;
                h->request_id_lo = 1;
                h->content_length_hi = (u_char) ((len >> 8) & 0xff);
                h->content_length_lo = (u_char) (len & 0xff);
                h->padding_length = (u_char) padding;
                h->reserved = 0;
                cl->next = ngx_alloc_chain_link(r->pool);
                if (cl->next == NULL) {
                    return NGX_ERROR;
                }
                cl = cl->next;
                cl->buf = b;
                b = ngx_create_temp_buf(r->pool,
                                        sizeof(ngx_http_fastcgi_header_t)
                                        + padding);
                if (b == NULL) {
                    return NGX_ERROR;
                }
                if (padding) {
                    ngx_memzero(b->last, padding);
                    b->last += padding;
                }
                cl->next = ngx_alloc_chain_link(r->pool);
                if (cl->next == NULL) {
                    return NGX_ERROR;
                }
                cl = cl->next;
                cl->buf = b;
            } while (!next);
            body = body->next;
        }
    } else {
        u->request_bufs = cl;
    }
    if (!r->request_body_no_buffering) {
        h = (ngx_http_fastcgi_header_t *) cl->buf->last;
        cl->buf->last += sizeof(ngx_http_fastcgi_header_t);
        h->version = 1;
        h->type = NGX_HTTP_FASTCGI_STDIN;
        h->request_id_hi = 0;
        h->request_id_lo = 1;
        h->content_length_hi = 0;
        h->content_length_lo = 0;
        h->padding_length = 0;
        h->reserved = 0;
    }
    cl->next = NULL;
    return NGX_OK;
}
['static ngx_int_t\nngx_http_fastcgi_create_request(ngx_http_request_t *r)\n{\n    off_t                         file_pos;\n    u_char                        ch, *pos, *lowcase_key;\n    size_t                        size, len, key_len, val_len, padding,\n                                  allocated;\n    ngx_uint_t                    i, n, next, hash, skip_empty, header_params;\n    ngx_buf_t                    *b;\n    ngx_chain_t                  *cl, *body;\n    ngx_list_part_t              *part;\n    ngx_table_elt_t              *header, **ignored;\n    ngx_http_upstream_t          *u;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_engine_t      e, le;\n    ngx_http_fastcgi_header_t    *h;\n    ngx_http_fastcgi_params_t    *params;\n    ngx_http_fastcgi_loc_conf_t  *flcf;\n    ngx_http_script_len_code_pt   lcode;\n    len = 0;\n    header_params = 0;\n    ignored = NULL;\n    u = r->upstream;\n    flcf = ngx_http_get_module_loc_conf(r, ngx_http_fastcgi_module);\n#if (NGX_HTTP_CACHE)\n    params = u->cacheable ? &flcf->params_cache : &flcf->params;\n#else\n    params = &flcf->params;\n#endif\n    if (params->lengths) {\n        ngx_memzero(&le, sizeof(ngx_http_script_engine_t));\n        ngx_http_script_flush_no_cacheable_variables(r, params->flushes);\n        le.flushed = 1;\n        le.ip = params->lengths->elts;\n        le.request = r;\n        while (*(uintptr_t *) le.ip) {\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            key_len = lcode(&le);\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            skip_empty = lcode(&le);\n            for (val_len = 0; *(uintptr_t *) le.ip; val_len += lcode(&le)) {\n                lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            }\n            le.ip += sizeof(uintptr_t);\n            if (skip_empty && val_len == 0) {\n                continue;\n            }\n            len += 1 + key_len + ((val_len > 127) ? 4 : 1) + val_len;\n        }\n    }\n    if (flcf->upstream.pass_request_headers) {\n        allocated = 0;\n        lowcase_key = NULL;\n        if (params->number) {\n            n = 0;\n            part = &r->headers_in.headers.part;\n            while (part) {\n                n += part->nelts;\n                part = part->next;\n            }\n            ignored = ngx_palloc(r->pool, n * sizeof(void *));\n            if (ignored == NULL) {\n                return NGX_ERROR;\n            }\n        }\n        part = &r->headers_in.headers.part;\n        header = part->elts;\n        for (i = 0;  ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                header = part->elts;\n                i = 0;\n            }\n            if (params->number) {\n                if (allocated < header[i].key.len) {\n                    allocated = header[i].key.len + 16;\n                    lowcase_key = ngx_pnalloc(r->pool, allocated);\n                    if (lowcase_key == NULL) {\n                        return NGX_ERROR;\n                    }\n                }\n                hash = 0;\n                for (n = 0; n < header[i].key.len; n++) {\n                    ch = header[i].key.data[n];\n                    if (ch >= \'A\' && ch <= \'Z\') {\n                        ch |= 0x20;\n                    } else if (ch == \'-\') {\n                        ch = \'_\';\n                    }\n                    hash = ngx_hash(hash, ch);\n                    lowcase_key[n] = ch;\n                }\n                if (ngx_hash_find(&params->hash, hash, lowcase_key, n)) {\n                    ignored[header_params++] = &header[i];\n                    continue;\n                }\n                n += sizeof("HTTP_") - 1;\n            } else {\n                n = sizeof("HTTP_") - 1 + header[i].key.len;\n            }\n            len += ((n > 127) ? 4 : 1) + ((header[i].value.len > 127) ? 4 : 1)\n                + n + header[i].value.len;\n        }\n    }\n    if (len > 65535) {\n        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,\n                      "fastcgi request record is too big: %uz", len);\n        return NGX_ERROR;\n    }\n    padding = 8 - len % 8;\n    padding = (padding == 8) ? 0 : padding;\n    size = sizeof(ngx_http_fastcgi_header_t)\n           + sizeof(ngx_http_fastcgi_begin_request_t)\n           + sizeof(ngx_http_fastcgi_header_t)\n           + len + padding\n           + sizeof(ngx_http_fastcgi_header_t)\n           + sizeof(ngx_http_fastcgi_header_t);\n    b = ngx_create_temp_buf(r->pool, size);\n    if (b == NULL) {\n        return NGX_ERROR;\n    }\n    cl = ngx_alloc_chain_link(r->pool);\n    if (cl == NULL) {\n        return NGX_ERROR;\n    }\n    cl->buf = b;\n    ngx_http_fastcgi_request_start.br.flags =\n        flcf->keep_conn ? NGX_HTTP_FASTCGI_KEEP_CONN : 0;\n    ngx_memcpy(b->pos, &ngx_http_fastcgi_request_start,\n               sizeof(ngx_http_fastcgi_request_start_t));\n    h = (ngx_http_fastcgi_header_t *)\n             (b->pos + sizeof(ngx_http_fastcgi_header_t)\n                     + sizeof(ngx_http_fastcgi_begin_request_t));\n    h->content_length_hi = (u_char) ((len >> 8) & 0xff);\n    h->content_length_lo = (u_char) (len & 0xff);\n    h->padding_length = (u_char) padding;\n    h->reserved = 0;\n    b->last = b->pos + sizeof(ngx_http_fastcgi_header_t)\n                     + sizeof(ngx_http_fastcgi_begin_request_t)\n                     + sizeof(ngx_http_fastcgi_header_t);\n    if (params->lengths) {\n        ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n        e.ip = params->values->elts;\n        e.pos = b->last;\n        e.request = r;\n        e.flushed = 1;\n        le.ip = params->lengths->elts;\n        while (*(uintptr_t *) le.ip) {\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            key_len = (u_char) lcode(&le);\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            skip_empty = lcode(&le);\n            for (val_len = 0; *(uintptr_t *) le.ip; val_len += lcode(&le)) {\n                lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            }\n            le.ip += sizeof(uintptr_t);\n            if (skip_empty && val_len == 0) {\n                e.skip = 1;\n                while (*(uintptr_t *) e.ip) {\n                    code = *(ngx_http_script_code_pt *) e.ip;\n                    code((ngx_http_script_engine_t *) &e);\n                }\n                e.ip += sizeof(uintptr_t);\n                e.skip = 0;\n                continue;\n            }\n            *e.pos++ = (u_char) key_len;\n            if (val_len > 127) {\n                *e.pos++ = (u_char) (((val_len >> 24) & 0x7f) | 0x80);\n                *e.pos++ = (u_char) ((val_len >> 16) & 0xff);\n                *e.pos++ = (u_char) ((val_len >> 8) & 0xff);\n                *e.pos++ = (u_char) (val_len & 0xff);\n            } else {\n                *e.pos++ = (u_char) val_len;\n            }\n            while (*(uintptr_t *) e.ip) {\n                code = *(ngx_http_script_code_pt *) e.ip;\n                code((ngx_http_script_engine_t *) &e);\n            }\n            e.ip += sizeof(uintptr_t);\n            ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "fastcgi param: \\"%*s: %*s\\"",\n                           key_len, e.pos - (key_len + val_len),\n                           val_len, e.pos - val_len);\n        }\n        b->last = e.pos;\n    }\n    if (flcf->upstream.pass_request_headers) {\n        part = &r->headers_in.headers.part;\n        header = part->elts;\n        for (i = 0;  ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                header = part->elts;\n                i = 0;\n            }\n            for (n = 0; n < header_params; n++) {\n                if (&header[i] == ignored[n]) {\n                    goto next;\n                }\n            }\n            key_len = sizeof("HTTP_") - 1 + header[i].key.len;\n            if (key_len > 127) {\n                *b->last++ = (u_char) (((key_len >> 24) & 0x7f) | 0x80);\n                *b->last++ = (u_char) ((key_len >> 16) & 0xff);\n                *b->last++ = (u_char) ((key_len >> 8) & 0xff);\n                *b->last++ = (u_char) (key_len & 0xff);\n            } else {\n                *b->last++ = (u_char) key_len;\n            }\n            val_len = header[i].value.len;\n            if (val_len > 127) {\n                *b->last++ = (u_char) (((val_len >> 24) & 0x7f) | 0x80);\n                *b->last++ = (u_char) ((val_len >> 16) & 0xff);\n                *b->last++ = (u_char) ((val_len >> 8) & 0xff);\n                *b->last++ = (u_char) (val_len & 0xff);\n            } else {\n                *b->last++ = (u_char) val_len;\n            }\n            b->last = ngx_cpymem(b->last, "HTTP_", sizeof("HTTP_") - 1);\n            for (n = 0; n < header[i].key.len; n++) {\n                ch = header[i].key.data[n];\n                if (ch >= \'a\' && ch <= \'z\') {\n                    ch &= ~0x20;\n                } else if (ch == \'-\') {\n                    ch = \'_\';\n                }\n                *b->last++ = ch;\n            }\n            b->last = ngx_copy(b->last, header[i].value.data, val_len);\n            ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "fastcgi param: \\"%*s: %*s\\"",\n                           key_len, b->last - (key_len + val_len),\n                           val_len, b->last - val_len);\n        next:\n            continue;\n        }\n    }\n    if (padding) {\n        ngx_memzero(b->last, padding);\n        b->last += padding;\n    }\n    h = (ngx_http_fastcgi_header_t *) b->last;\n    b->last += sizeof(ngx_http_fastcgi_header_t);\n    h->version = 1;\n    h->type = NGX_HTTP_FASTCGI_PARAMS;\n    h->request_id_hi = 0;\n    h->request_id_lo = 1;\n    h->content_length_hi = 0;\n    h->content_length_lo = 0;\n    h->padding_length = 0;\n    h->reserved = 0;\n    if (r->request_body_no_buffering) {\n        u->request_bufs = cl;\n        u->output.output_filter = ngx_http_fastcgi_body_output_filter;\n        u->output.filter_ctx = r;\n    } else if (flcf->upstream.pass_request_body) {\n        body = u->request_bufs;\n        u->request_bufs = cl;\n#if (NGX_SUPPRESS_WARN)\n        file_pos = 0;\n        pos = NULL;\n#endif\n        while (body) {\n            if (body->buf->in_file) {\n                file_pos = body->buf->file_pos;\n            } else {\n                pos = body->buf->pos;\n            }\n            next = 0;\n            do {\n                b = ngx_alloc_buf(r->pool);\n                if (b == NULL) {\n                    return NGX_ERROR;\n                }\n                ngx_memcpy(b, body->buf, sizeof(ngx_buf_t));\n                if (body->buf->in_file) {\n                    b->file_pos = file_pos;\n                    file_pos += 32 * 1024;\n                    if (file_pos >= body->buf->file_last) {\n                        file_pos = body->buf->file_last;\n                        next = 1;\n                    }\n                    b->file_last = file_pos;\n                    len = (ngx_uint_t) (file_pos - b->file_pos);\n                } else {\n                    b->pos = pos;\n                    b->start = pos;\n                    pos += 32 * 1024;\n                    if (pos >= body->buf->last) {\n                        pos = body->buf->last;\n                        next = 1;\n                    }\n                    b->last = pos;\n                    len = (ngx_uint_t) (pos - b->pos);\n                }\n                padding = 8 - len % 8;\n                padding = (padding == 8) ? 0 : padding;\n                h = (ngx_http_fastcgi_header_t *) cl->buf->last;\n                cl->buf->last += sizeof(ngx_http_fastcgi_header_t);\n                h->version = 1;\n                h->type = NGX_HTTP_FASTCGI_STDIN;\n                h->request_id_hi = 0;\n                h->request_id_lo = 1;\n                h->content_length_hi = (u_char) ((len >> 8) & 0xff);\n                h->content_length_lo = (u_char) (len & 0xff);\n                h->padding_length = (u_char) padding;\n                h->reserved = 0;\n                cl->next = ngx_alloc_chain_link(r->pool);\n                if (cl->next == NULL) {\n                    return NGX_ERROR;\n                }\n                cl = cl->next;\n                cl->buf = b;\n                b = ngx_create_temp_buf(r->pool,\n                                        sizeof(ngx_http_fastcgi_header_t)\n                                        + padding);\n                if (b == NULL) {\n                    return NGX_ERROR;\n                }\n                if (padding) {\n                    ngx_memzero(b->last, padding);\n                    b->last += padding;\n                }\n                cl->next = ngx_alloc_chain_link(r->pool);\n                if (cl->next == NULL) {\n                    return NGX_ERROR;\n                }\n                cl = cl->next;\n                cl->buf = b;\n            } while (!next);\n            body = body->next;\n        }\n    } else {\n        u->request_bufs = cl;\n    }\n    if (!r->request_body_no_buffering) {\n        h = (ngx_http_fastcgi_header_t *) cl->buf->last;\n        cl->buf->last += sizeof(ngx_http_fastcgi_header_t);\n        h->version = 1;\n        h->type = NGX_HTTP_FASTCGI_STDIN;\n        h->request_id_hi = 0;\n        h->request_id_lo = 1;\n        h->content_length_hi = 0;\n        h->content_length_lo = 0;\n        h->padding_length = 0;\n        h->reserved = 0;\n    }\n    cl->next = NULL;\n    return NGX_OK;\n}', 'ngx_buf_t *\nngx_create_temp_buf(ngx_pool_t *pool, size_t size)\n{\n    ngx_buf_t *b;\n    b = ngx_calloc_buf(pool);\n    if (b == NULL) {\n        return NULL;\n    }\n    b->start = ngx_palloc(pool, size);\n    if (b->start == NULL) {\n        return NULL;\n    }\n    b->pos = b->start;\n    b->last = b->start;\n    b->end = b->last + size;\n    b->temporary = 1;\n    return b;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 1);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}']