src/http/modules/ngx_http_autoindex_module.c:872: error: Buffer Overrun L3
  Offset added: 31 Size: [0, +oo].

src/http/modules/ngx_http_autoindex_module.c:850:5: <Length trace>
848.     static u_char  tail[] = "</list>" CRLF;
849. 
850.     len = sizeof(head) - 1 + sizeof(tail) - 1;
         ^
851. 
852.     entry = entries->elts;

src/http/modules/ngx_http_autoindex_module.c:850:5: Assignment
848.     static u_char  tail[] = "</list>" CRLF;
849. 
850.     len = sizeof(head) - 1 + sizeof(tail) - 1;
         ^
851. 
852.     entry = entries->elts;

src/http/modules/ngx_http_autoindex_module.c:867:9: Call
865.     }
866. 
867.     b = ngx_create_temp_buf(r->pool, len);
             ^
868.     if (b == NULL) {
869.         return NULL;

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:126:16: Call
    124. {
    125.     if (size <= pool->max) {
    126.         return ngx_palloc_small(pool, size, 1);
                        ^
    127.     }
    128. 

src/core/ngx_palloc.c:153:9: Assignment
      151. 
      152.     do {
      153.         m = p->d.last;
                   ^
      154. 
      155.         if (align) {

src/core/ngx_palloc.c:162:13: Assignment
      160.             p->d.last = m + size;
      161. 
      162.             return m;
                       ^
      163.         }
      164. 

src/core/ngx_palloc.c:126:9: Assignment
    124. {
    125.     if (size <= pool->max) {
    126.         return ngx_palloc_small(pool, size, 1);
                 ^
    127.     }
    128. 

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:39:5: Assignment
  37. 
  38.     b->pos = b->start;
  39.     b->last = b->start;
          ^
  40.     b->end = b->last + size;
  41.     b->temporary = 1;

src/http/modules/ngx_http_autoindex_module.c:872:15: Array access: Offset added: 31 Size: [0, +oo]
870.     }
871. 
872.     b->last = ngx_cpymem(b->last, head, sizeof(head) - 1);
                   ^
873. 
874.     for (i = 0; i < entries->nelts; i++) {

static ngx_buf_t *
ngx_http_autoindex_xml(ngx_http_request_t *r, ngx_array_t *entries)
{
    size_t                          len;
    ngx_tm_t                        tm;
    ngx_buf_t                      *b;
    ngx_str_t                       type;
    ngx_uint_t                      i;
    ngx_http_autoindex_entry_t     *entry;
    static u_char  head[] = "<?xml version=\"1.0\"?>" CRLF "<list>" CRLF;
    static u_char  tail[] = "</list>" CRLF;
    len = sizeof(head) - 1 + sizeof(tail) - 1;
    entry = entries->elts;
    for (i = 0; i < entries->nelts; i++) {
        entry[i].escape = ngx_escape_html(NULL, entry[i].name.data,
                                          entry[i].name.len);
        len += sizeof("<directory></directory>" CRLF) - 1
            + entry[i].name.len + entry[i].escape
            + sizeof(" mtime=\"1986-12-31T10:00:00Z\"") - 1;
        if (entry[i].file) {
            len += sizeof(" size=\"\"") - 1 + NGX_OFF_T_LEN;
        }
    }
    b = ngx_create_temp_buf(r->pool, len);
    if (b == NULL) {
        return NULL;
    }
    b->last = ngx_cpymem(b->last, head, sizeof(head) - 1);
    for (i = 0; i < entries->nelts; i++) {
        *b->last++ = '<';
        if (entry[i].dir) {
            ngx_str_set(&type, "directory");
        } else if (entry[i].file) {
            ngx_str_set(&type, "file");
        } else {
            ngx_str_set(&type, "other");
        }
        b->last = ngx_cpymem(b->last, type.data, type.len);
        b->last = ngx_cpymem(b->last, " mtime=\"", sizeof(" mtime=\"") - 1);
        ngx_gmtime(entry[i].mtime, &tm);
        b->last = ngx_sprintf(b->last, "%4d-%02d-%02dT%02d:%02d:%02dZ",
                              tm.ngx_tm_year, tm.ngx_tm_mon,
                              tm.ngx_tm_mday, tm.ngx_tm_hour,
                              tm.ngx_tm_min, tm.ngx_tm_sec);
        if (entry[i].file) {
            b->last = ngx_cpymem(b->last, "\" size=\"",
                                 sizeof("\" size=\"") - 1);
            b->last = ngx_sprintf(b->last, "%O", entry[i].size);
        }
        *b->last++ = '"'; *b->last++ = '>';
        if (entry[i].escape) {
            b->last = (u_char *) ngx_escape_html(b->last, entry[i].name.data,
                                                 entry[i].name.len);
        } else {
            b->last = ngx_cpymem(b->last, entry[i].name.data,
                                 entry[i].name.len);
        }
        *b->last++ = '<'; *b->last++ = '/';
        b->last = ngx_cpymem(b->last, type.data, type.len);
        *b->last++ = '>';
        *b->last++ = CR; *b->last++ = LF;
    }
    b->last = ngx_cpymem(b->last, tail, sizeof(tail) - 1);
    return b;
}
['static ngx_buf_t *\nngx_http_autoindex_xml(ngx_http_request_t *r, ngx_array_t *entries)\n{\n    size_t                          len;\n    ngx_tm_t                        tm;\n    ngx_buf_t                      *b;\n    ngx_str_t                       type;\n    ngx_uint_t                      i;\n    ngx_http_autoindex_entry_t     *entry;\n    static u_char  head[] = "<?xml version=\\"1.0\\"?>" CRLF "<list>" CRLF;\n    static u_char  tail[] = "</list>" CRLF;\n    len = sizeof(head) - 1 + sizeof(tail) - 1;\n    entry = entries->elts;\n    for (i = 0; i < entries->nelts; i++) {\n        entry[i].escape = ngx_escape_html(NULL, entry[i].name.data,\n                                          entry[i].name.len);\n        len += sizeof("<directory></directory>" CRLF) - 1\n            + entry[i].name.len + entry[i].escape\n            + sizeof(" mtime=\\"1986-12-31T10:00:00Z\\"") - 1;\n        if (entry[i].file) {\n            len += sizeof(" size=\\"\\"") - 1 + NGX_OFF_T_LEN;\n        }\n    }\n    b = ngx_create_temp_buf(r->pool, len);\n    if (b == NULL) {\n        return NULL;\n    }\n    b->last = ngx_cpymem(b->last, head, sizeof(head) - 1);\n    for (i = 0; i < entries->nelts; i++) {\n        *b->last++ = \'<\';\n        if (entry[i].dir) {\n            ngx_str_set(&type, "directory");\n        } else if (entry[i].file) {\n            ngx_str_set(&type, "file");\n        } else {\n            ngx_str_set(&type, "other");\n        }\n        b->last = ngx_cpymem(b->last, type.data, type.len);\n        b->last = ngx_cpymem(b->last, " mtime=\\"", sizeof(" mtime=\\"") - 1);\n        ngx_gmtime(entry[i].mtime, &tm);\n        b->last = ngx_sprintf(b->last, "%4d-%02d-%02dT%02d:%02d:%02dZ",\n                              tm.ngx_tm_year, tm.ngx_tm_mon,\n                              tm.ngx_tm_mday, tm.ngx_tm_hour,\n                              tm.ngx_tm_min, tm.ngx_tm_sec);\n        if (entry[i].file) {\n            b->last = ngx_cpymem(b->last, "\\" size=\\"",\n                                 sizeof("\\" size=\\"") - 1);\n            b->last = ngx_sprintf(b->last, "%O", entry[i].size);\n        }\n        *b->last++ = \'"\'; *b->last++ = \'>\';\n        if (entry[i].escape) {\n            b->last = (u_char *) ngx_escape_html(b->last, entry[i].name.data,\n                                                 entry[i].name.len);\n        } else {\n            b->last = ngx_cpymem(b->last, entry[i].name.data,\n                                 entry[i].name.len);\n        }\n        *b->last++ = \'<\'; *b->last++ = \'/\';\n        b->last = ngx_cpymem(b->last, type.data, type.len);\n        *b->last++ = \'>\';\n        *b->last++ = CR; *b->last++ = LF;\n    }\n    b->last = ngx_cpymem(b->last, tail, sizeof(tail) - 1);\n    return b;\n}', 'ngx_buf_t *\nngx_create_temp_buf(ngx_pool_t *pool, size_t size)\n{\n    ngx_buf_t *b;\n    b = ngx_calloc_buf(pool);\n    if (b == NULL) {\n        return NULL;\n    }\n    b->start = ngx_palloc(pool, size);\n    if (b->start == NULL) {\n        return NULL;\n    }\n    b->pos = b->start;\n    b->last = b->start;\n    b->end = b->last + size;\n    b->temporary = 1;\n    return b;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 1);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}']