src/http/ngx_http_request.c:470: error: Buffer Overrun L3
  Offset: 10 (⇐ 6 + 4) Size: [0, +oo] by call to `ngx_proxy_protocol_read`.

src/http/ngx_http_request.c:402:5: Assignment
400.     cscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_core_module);
401. 
402.     size = cscf->client_header_buffer_size;
         ^
403. 
404.     b = c->buffer;

src/http/ngx_http_request.c:407:13: Call
405. 
406.     if (b == NULL) {
407.         b = ngx_create_temp_buf(c->pool, size);
                 ^
408.         if (b == NULL) {
409.             ngx_http_close_connection(c);

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:126:16: Call
    124. {
    125.     if (size <= pool->max) {
    126.         return ngx_palloc_small(pool, size, 1);
                        ^
    127.     }
    128. 

src/core/ngx_palloc.c:153:9: Assignment
      151. 
      152.     do {
      153.         m = p->d.last;
                   ^
      154. 
      155.         if (align) {

src/core/ngx_palloc.c:162:13: Assignment
      160.             p->d.last = m + size;
      161. 
      162.             return m;
                       ^
      163.         }
      164. 

src/core/ngx_palloc.c:126:9: Assignment
    124. {
    125.     if (size <= pool->max) {
    126.         return ngx_palloc_small(pool, size, 1);
                 ^
    127.     }
    128. 

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:38:5: Assignment
  36.      */
  37. 
  38.     b->pos = b->start;
          ^
  39.     b->last = b->start;
  40.     b->end = b->last + size;

src/http/ngx_http_request.c:470:13: Call
468.         hc->proxy_protocol = 0;
469. 
470.         p = ngx_proxy_protocol_read(c, b->pos, b->last);
                 ^
471. 
472.         if (p == NULL) {

src/core/ngx_proxy_protocol.c:12:1: <Length trace>
10. 
11. 
12. u_char *
    ^
13. ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)
14. {

src/core/ngx_proxy_protocol.c:12:1: Parameter `*buf`
  10. 
  11. 
  12. u_char *
      ^
  13. ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)
  14. {

src/core/ngx_proxy_protocol.c:18:5: Assignment
  16.     u_char  ch, *p, *addr;
  17. 
  18.     p = buf;
          ^
  19.     len = last - buf;
  20. 

src/core/ngx_proxy_protocol.c:25:5: Assignment
  23.     }
  24. 
  25.     p += 6;
          ^
  26.     len -= 6;
  27. 

src/core/ngx_proxy_protocol.c:36:44: Array access: Offset: 10 (⇐ 6 + 4) Size: [0, +oo] by call to `ngx_proxy_protocol_read` 
  34. 
  35.     if (len < 5 || ngx_strncmp(p, "TCP", 3) != 0
  36.         || (p[3] != '4' && p[3] != '6') || p[4] != ' ')
                                                 ^
  37.     {
  38.         goto invalid;

u_char *
ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)
{
    size_t  len;
    u_char  ch, *p, *addr;
    p = buf;
    len = last - buf;
    if (len < 8 || ngx_strncmp(p, "PROXY ", 6) != 0) {
        goto invalid;
    }
    p += 6;
    len -= 6;
    if (len >= 7 && ngx_strncmp(p, "UNKNOWN", 7) == 0) {
        ngx_log_debug0(NGX_LOG_DEBUG_CORE, c->log, 0,
                       "PROXY protocol unknown protocol");
        p += 7;
        goto skip;
    }
    if (len < 5 || ngx_strncmp(p, "TCP", 3) != 0
        || (p[3] != '4' && p[3] != '6') || p[4] != ' ')
    {
        goto invalid;
    }
    p += 5;
    addr = p;
    for ( ;; ) {
        if (p == last) {
            goto invalid;
        }
        ch = *p++;
        if (ch == ' ') {
            break;
        }
        if (ch != ':' && ch != '.'
            && (ch < 'a' || ch > 'f')
            && (ch < 'A' || ch > 'F')
            && (ch < '0' || ch > '9'))
        {
            goto invalid;
        }
    }
    len = p - addr - 1;
    c->proxy_protocol_addr.data = ngx_pnalloc(c->pool, len);
    if (c->proxy_protocol_addr.data == NULL) {
        return NULL;
    }
    ngx_memcpy(c->proxy_protocol_addr.data, addr, len);
    c->proxy_protocol_addr.len = len;
    ngx_log_debug1(NGX_LOG_DEBUG_CORE, c->log, 0,
                   "PROXY protocol address: \"%V\"", &c->proxy_protocol_addr);
skip:
    for (   ; p < last - 1; p++) {
        if (p[0] == CR && p[1] == LF) {
            return p + 2;
        }
    }
invalid:
    ngx_log_error(NGX_LOG_ERR, c->log, 0,
                  "broken header: \"%*s\"", (size_t) (last - buf), buf);
    return NULL;
}
['static void\nngx_http_wait_request_handler(ngx_event_t *rev)\n{\n    u_char                    *p;\n    size_t                     size;\n    ssize_t                    n;\n    ngx_buf_t                 *b;\n    ngx_connection_t          *c;\n    ngx_http_connection_t     *hc;\n    ngx_http_core_srv_conf_t  *cscf;\n    c = rev->data;\n    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http wait request handler");\n    if (rev->timedout) {\n        ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");\n        ngx_http_close_connection(c);\n        return;\n    }\n    if (c->close) {\n        ngx_http_close_connection(c);\n        return;\n    }\n    hc = c->data;\n    cscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_core_module);\n    size = cscf->client_header_buffer_size;\n    b = c->buffer;\n    if (b == NULL) {\n        b = ngx_create_temp_buf(c->pool, size);\n        if (b == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        c->buffer = b;\n    } else if (b->start == NULL) {\n        b->start = ngx_palloc(c->pool, size);\n        if (b->start == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        b->pos = b->start;\n        b->last = b->start;\n        b->end = b->last + size;\n    }\n    n = c->recv(c, b->last, size);\n    if (n == NGX_AGAIN) {\n        if (!rev->timer_set) {\n            ngx_add_timer(rev, c->listening->post_accept_timeout);\n            ngx_reusable_connection(c, 1);\n        }\n        if (ngx_handle_read_event(rev, 0) != NGX_OK) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        if (ngx_pfree(c->pool, b->start) == NGX_OK) {\n            b->start = NULL;\n        }\n        return;\n    }\n    if (n == NGX_ERROR) {\n        ngx_http_close_connection(c);\n        return;\n    }\n    if (n == 0) {\n        ngx_log_error(NGX_LOG_INFO, c->log, 0,\n                      "client closed connection");\n        ngx_http_close_connection(c);\n        return;\n    }\n    b->last += n;\n    if (hc->proxy_protocol) {\n        hc->proxy_protocol = 0;\n        p = ngx_proxy_protocol_read(c, b->pos, b->last);\n        if (p == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        b->pos = p;\n        if (b->pos == b->last) {\n            c->log->action = "waiting for request";\n            b->pos = b->start;\n            b->last = b->start;\n            ngx_post_event(rev, &ngx_posted_events);\n            return;\n        }\n    }\n    c->log->action = "reading client request line";\n    ngx_reusable_connection(c, 0);\n    c->data = ngx_http_create_request(c);\n    if (c->data == NULL) {\n        ngx_http_close_connection(c);\n        return;\n    }\n    rev->handler = ngx_http_process_request_line;\n    ngx_http_process_request_line(rev);\n}', 'ngx_buf_t *\nngx_create_temp_buf(ngx_pool_t *pool, size_t size)\n{\n    ngx_buf_t *b;\n    b = ngx_calloc_buf(pool);\n    if (b == NULL) {\n        return NULL;\n    }\n    b->start = ngx_palloc(pool, size);\n    if (b->start == NULL) {\n        return NULL;\n    }\n    b->pos = b->start;\n    b->last = b->start;\n    b->end = b->last + size;\n    b->temporary = 1;\n    return b;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 1);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}', 'u_char *\nngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)\n{\n    size_t  len;\n    u_char  ch, *p, *addr;\n    p = buf;\n    len = last - buf;\n    if (len < 8 || ngx_strncmp(p, "PROXY ", 6) != 0) {\n        goto invalid;\n    }\n    p += 6;\n    len -= 6;\n    if (len >= 7 && ngx_strncmp(p, "UNKNOWN", 7) == 0) {\n        ngx_log_debug0(NGX_LOG_DEBUG_CORE, c->log, 0,\n                       "PROXY protocol unknown protocol");\n        p += 7;\n        goto skip;\n    }\n    if (len < 5 || ngx_strncmp(p, "TCP", 3) != 0\n        || (p[3] != \'4\' && p[3] != \'6\') || p[4] != \' \')\n    {\n        goto invalid;\n    }\n    p += 5;\n    addr = p;\n    for ( ;; ) {\n        if (p == last) {\n            goto invalid;\n        }\n        ch = *p++;\n        if (ch == \' \') {\n            break;\n        }\n        if (ch != \':\' && ch != \'.\'\n            && (ch < \'a\' || ch > \'f\')\n            && (ch < \'A\' || ch > \'F\')\n            && (ch < \'0\' || ch > \'9\'))\n        {\n            goto invalid;\n        }\n    }\n    len = p - addr - 1;\n    c->proxy_protocol_addr.data = ngx_pnalloc(c->pool, len);\n    if (c->proxy_protocol_addr.data == NULL) {\n        return NULL;\n    }\n    ngx_memcpy(c->proxy_protocol_addr.data, addr, len);\n    c->proxy_protocol_addr.len = len;\n    ngx_log_debug1(NGX_LOG_DEBUG_CORE, c->log, 0,\n                   "PROXY protocol address: \\"%V\\"", &c->proxy_protocol_addr);\nskip:\n    for (   ; p < last - 1; p++) {\n        if (p[0] == CR && p[1] == LF) {\n            return p + 2;\n        }\n    }\ninvalid:\n    ngx_log_error(NGX_LOG_ERR, c->log, 0,\n                  "broken header: \\"%*s\\"", (size_t) (last - buf), buf);\n    return NULL;\n}']