src/http/modules/ngx_http_fastcgi_module.c:2038: error: Buffer Overrun L3
  Offset: [-10, +oo] Size: 2048 by call to `ngx_log_error_core`.

src/http/modules/ngx_http_fastcgi_module.c:2025:21: Assignment
2023.                     f->pos += f->length;
2024.                     f->length = 0;
2025.                     f->state = ngx_http_fastcgi_st_padding;
                          ^
2026. 
2027.                 } else {

src/http/modules/ngx_http_fastcgi_module.c:2038:17: Call
2036.                 }
2037. 
2038.                 ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                      ^
2039.                               "FastCGI sent in stderr: \"%*s\"",
2040.                               m + 1 - msg, msg);

src/core/ngx_log.c:78:1: Global `err_levels.len`
  76. #if (NGX_HAVE_VARIADIC_MACROS)
  77. 
  78. void
      ^
  79. ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
  80.     const char *fmt, ...)

src/core/ngx_log.c:167:5: Assignment
  165.     }
  166. 
  167.     msg -= (7 + err_levels[level].len + 3);
           ^
  168. 
  169.     (void) ngx_sprintf(msg, "nginx: [%V] ", &err_levels[level]);

src/core/ngx_log.c:169:12: Call
  167.     msg -= (7 + err_levels[level].len + 3);
  168. 
  169.     (void) ngx_sprintf(msg, "nginx: [%V] ", &err_levels[level]);
                  ^
  170. 
  171.     (void) ngx_write_console(ngx_stderr, msg, p - msg);

src/core/ngx_string.c:102:1: Parameter `*buf`
    100. 
    101. 
    102. u_char * ngx_cdecl
         ^
    103. ngx_sprintf(u_char *buf, const char *fmt, ...)
    104. {

src/core/ngx_string.c:109:9: Call
    107. 
    108.     va_start(args, fmt);
    109.     p = ngx_vslprintf(buf, (void *) -1, fmt, args);
                 ^
    110.     va_end(args);
    111. 

src/core/ngx_string.c:144:1: <Length trace>
142. 
143. 
144. u_char *
     ^
145. ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
146. {

src/core/ngx_string.c:144:1: Parameter `*buf`
      142. 
      143. 
      144. u_char *
           ^
      145. ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
      146. {

src/core/ngx_string.c:363:21: Array access: Offset: [-10, +oo] Size: 2048 by call to `ngx_log_error_core` 
      361. 
      362.                 if (f < 0) {
      363.                     *buf++ = '-';
                               ^
      364.                     f = -f;
      365.                 }

u_char *
ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
{
    u_char                *p, zero;
    int                    d;
    double                 f;
    size_t                 len, slen;
    int64_t                i64;
    uint64_t               ui64, frac;
    ngx_msec_t             ms;
    ngx_uint_t             width, sign, hex, max_width, frac_width, scale, n;
    ngx_str_t             *v;
    ngx_variable_value_t  *vv;
    while (*fmt && buf < last) {
        if (*fmt == '%') {
            i64 = 0;
            ui64 = 0;
            zero = (u_char) ((*++fmt == '0') ? '0' : ' ');
            width = 0;
            sign = 1;
            hex = 0;
            max_width = 0;
            frac_width = 0;
            slen = (size_t) -1;
            while (*fmt >= '0' && *fmt <= '9') {
                width = width * 10 + *fmt++ - '0';
            }
            for ( ;; ) {
                switch (*fmt) {
                case 'u':
                    sign = 0;
                    fmt++;
                    continue;
                case 'm':
                    max_width = 1;
                    fmt++;
                    continue;
                case 'X':
                    hex = 2;
                    sign = 0;
                    fmt++;
                    continue;
                case 'x':
                    hex = 1;
                    sign = 0;
                    fmt++;
                    continue;
                case '.':
                    fmt++;
                    while (*fmt >= '0' && *fmt <= '9') {
                        frac_width = frac_width * 10 + *fmt++ - '0';
                    }
                    break;
                case '*':
                    slen = va_arg(args, size_t);
                    fmt++;
                    continue;
                default:
                    break;
                }
                break;
            }
            switch (*fmt) {
            case 'V':
                v = va_arg(args, ngx_str_t *);
                len = ngx_min(((size_t) (last - buf)), v->len);
                buf = ngx_cpymem(buf, v->data, len);
                fmt++;
                continue;
            case 'v':
                vv = va_arg(args, ngx_variable_value_t *);
                len = ngx_min(((size_t) (last - buf)), vv->len);
                buf = ngx_cpymem(buf, vv->data, len);
                fmt++;
                continue;
            case 's':
                p = va_arg(args, u_char *);
                if (slen == (size_t) -1) {
                    while (*p && buf < last) {
                        *buf++ = *p++;
                    }
                } else {
                    len = ngx_min(((size_t) (last - buf)), slen);
                    buf = ngx_cpymem(buf, p, len);
                }
                fmt++;
                continue;
            case 'O':
                i64 = (int64_t) va_arg(args, off_t);
                sign = 1;
                break;
            case 'P':
                i64 = (int64_t) va_arg(args, ngx_pid_t);
                sign = 1;
                break;
            case 'T':
                i64 = (int64_t) va_arg(args, time_t);
                sign = 1;
                break;
            case 'M':
                ms = (ngx_msec_t) va_arg(args, ngx_msec_t);
                if ((ngx_msec_int_t) ms == -1) {
                    sign = 1;
                    i64 = -1;
                } else {
                    sign = 0;
                    ui64 = (uint64_t) ms;
                }
                break;
            case 'z':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ssize_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, size_t);
                }
                break;
            case 'i':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ngx_int_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, ngx_uint_t);
                }
                if (max_width) {
                    width = NGX_INT_T_LEN;
                }
                break;
            case 'd':
                if (sign) {
                    i64 = (int64_t) va_arg(args, int);
                } else {
                    ui64 = (uint64_t) va_arg(args, u_int);
                }
                break;
            case 'l':
                if (sign) {
                    i64 = (int64_t) va_arg(args, long);
                } else {
                    ui64 = (uint64_t) va_arg(args, u_long);
                }
                break;
            case 'D':
                if (sign) {
                    i64 = (int64_t) va_arg(args, int32_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, uint32_t);
                }
                break;
            case 'L':
                if (sign) {
                    i64 = va_arg(args, int64_t);
                } else {
                    ui64 = va_arg(args, uint64_t);
                }
                break;
            case 'A':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ngx_atomic_int_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, ngx_atomic_uint_t);
                }
                if (max_width) {
                    width = NGX_ATOMIC_T_LEN;
                }
                break;
            case 'f':
                f = va_arg(args, double);
                if (f < 0) {
                    *buf++ = '-';
                    f = -f;
                }
                ui64 = (int64_t) f;
                frac = 0;
                if (frac_width) {
                    scale = 1;
                    for (n = frac_width; n; n--) {
                        scale *= 10;
                    }
                    frac = (uint64_t) ((f - (double) ui64) * scale + 0.5);
                    if (frac == scale) {
                        ui64++;
                        frac = 0;
                    }
                }
                buf = ngx_sprintf_num(buf, last, ui64, zero, 0, width);
                if (frac_width) {
                    if (buf < last) {
                        *buf++ = '.';
                    }
                    buf = ngx_sprintf_num(buf, last, frac, '0', 0, frac_width);
                }
                fmt++;
                continue;
#if !(NGX_WIN32)
            case 'r':
                i64 = (int64_t) va_arg(args, rlim_t);
                sign = 1;
                break;
#endif
            case 'p':
                ui64 = (uintptr_t) va_arg(args, void *);
                hex = 2;
                sign = 0;
                zero = '0';
                width = NGX_PTR_SIZE * 2;
                break;
            case 'c':
                d = va_arg(args, int);
                *buf++ = (u_char) (d & 0xff);
                fmt++;
                continue;
            case 'Z':
                *buf++ = '\0';
                fmt++;
                continue;
            case 'N':
#if (NGX_WIN32)
                *buf++ = CR;
#endif
                *buf++ = LF;
                fmt++;
                continue;
            case '%':
                *buf++ = '%';
                fmt++;
                continue;
            default:
                *buf++ = *fmt++;
                continue;
            }
            if (sign) {
                if (i64 < 0) {
                    *buf++ = '-';
                    ui64 = (uint64_t) -i64;
                } else {
                    ui64 = (uint64_t) i64;
                }
            }
            buf = ngx_sprintf_num(buf, last, ui64, zero, hex, width);
            fmt++;
        } else {
            *buf++ = *fmt++;
        }
    }
    return buf;
}
['static ngx_int_t\nngx_http_fastcgi_non_buffered_filter(void *data, ssize_t bytes)\n{\n    u_char                  *m, *msg;\n    ngx_int_t                rc;\n    ngx_buf_t               *b, *buf;\n    ngx_chain_t             *cl, **ll;\n    ngx_http_request_t      *r;\n    ngx_http_upstream_t     *u;\n    ngx_http_fastcgi_ctx_t  *f;\n    r = data;\n    f = ngx_http_get_module_ctx(r, ngx_http_fastcgi_module);\n    u = r->upstream;\n    buf = &u->buffer;\n    buf->pos = buf->last;\n    buf->last += bytes;\n    for (cl = u->out_bufs, ll = &u->out_bufs; cl; cl = cl->next) {\n        ll = &cl->next;\n    }\n    f->pos = buf->pos;\n    f->last = buf->last;\n    for ( ;; ) {\n        if (f->state < ngx_http_fastcgi_st_data) {\n            rc = ngx_http_fastcgi_process_record(r, f);\n            if (rc == NGX_AGAIN) {\n                break;\n            }\n            if (rc == NGX_ERROR) {\n                return NGX_ERROR;\n            }\n            if (f->type == NGX_HTTP_FASTCGI_STDOUT && f->length == 0) {\n                f->state = ngx_http_fastcgi_st_padding;\n                ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                               "http fastcgi closed stdout");\n                continue;\n            }\n        }\n        if (f->state == ngx_http_fastcgi_st_padding) {\n            if (f->type == NGX_HTTP_FASTCGI_END_REQUEST) {\n                if (f->pos + f->padding < f->last) {\n                    u->length = 0;\n                    break;\n                }\n                if (f->pos + f->padding == f->last) {\n                    u->length = 0;\n                    u->keepalive = 1;\n                    break;\n                }\n                f->padding -= f->last - f->pos;\n                break;\n            }\n            if (f->pos + f->padding < f->last) {\n                f->state = ngx_http_fastcgi_st_version;\n                f->pos += f->padding;\n                continue;\n            }\n            if (f->pos + f->padding == f->last) {\n                f->state = ngx_http_fastcgi_st_version;\n                break;\n            }\n            f->padding -= f->last - f->pos;\n            break;\n        }\n        if (f->type == NGX_HTTP_FASTCGI_STDERR) {\n            if (f->length) {\n                if (f->pos == f->last) {\n                    break;\n                }\n                msg = f->pos;\n                if (f->pos + f->length <= f->last) {\n                    f->pos += f->length;\n                    f->length = 0;\n                    f->state = ngx_http_fastcgi_st_padding;\n                } else {\n                    f->length -= f->last - f->pos;\n                    f->pos = f->last;\n                }\n                for (m = f->pos - 1; msg < m; m--) {\n                    if (*m != LF && *m != CR && *m != \'.\' && *m != \' \') {\n                        break;\n                    }\n                }\n                ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                              "FastCGI sent in stderr: \\"%*s\\"",\n                              m + 1 - msg, msg);\n            } else {\n                f->state = ngx_http_fastcgi_st_padding;\n            }\n            continue;\n        }\n        if (f->type == NGX_HTTP_FASTCGI_END_REQUEST) {\n            if (f->pos + f->length <= f->last) {\n                f->state = ngx_http_fastcgi_st_padding;\n                f->pos += f->length;\n                continue;\n            }\n            f->length -= f->last - f->pos;\n            break;\n        }\n        if (f->pos == f->last) {\n            break;\n        }\n        cl = ngx_chain_get_free_buf(r->pool, &u->free_bufs);\n        if (cl == NULL) {\n            return NGX_ERROR;\n        }\n        *ll = cl;\n        ll = &cl->next;\n        b = cl->buf;\n        b->flush = 1;\n        b->memory = 1;\n        b->pos = f->pos;\n        b->tag = u->output.tag;\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http fastcgi output buf %p", b->pos);\n        if (f->pos + f->length <= f->last) {\n            f->state = ngx_http_fastcgi_st_padding;\n            f->pos += f->length;\n            b->last = f->pos;\n            continue;\n        }\n        f->length -= f->last - f->pos;\n        b->last = f->last;\n        break;\n    }\n    if (r->subrequest_in_memory) {\n        cl = u->out_bufs;\n        if (cl) {\n            buf->pos = cl->buf->pos;\n        }\n        buf->last = buf->pos;\n        for (cl = u->out_bufs; cl; cl = cl->next) {\n            ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "http fastcgi in memory %p-%p %uz",\n                           cl->buf->pos, cl->buf->last, ngx_buf_size(cl->buf));\n            if (buf->last == cl->buf->pos) {\n                buf->last = cl->buf->last;\n                continue;\n            }\n            buf->last = ngx_movemem(buf->last, cl->buf->pos,\n                                    cl->buf->last - cl->buf->pos);\n            cl->buf->pos = buf->last - (cl->buf->last - cl->buf->pos);\n            cl->buf->last = buf->last;\n        }\n    }\n    return NGX_OK;\n}', 'void\nngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,\n    const char *fmt, ...)\n#else\nvoid\nngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,\n    const char *fmt, va_list args)\n#endif\n{\n#if (NGX_HAVE_VARIADIC_MACROS)\n    va_list      args;\n#endif\n    u_char      *p, *last, *msg;\n    u_char       errstr[NGX_MAX_ERROR_STR];\n    ngx_uint_t   wrote_stderr, debug_connection;\n    last = errstr + NGX_MAX_ERROR_STR;\n    ngx_memcpy(errstr, ngx_cached_err_log_time.data,\n               ngx_cached_err_log_time.len);\n    p = errstr + ngx_cached_err_log_time.len;\n    p = ngx_slprintf(p, last, " [%V] ", &err_levels[level]);\n    p = ngx_slprintf(p, last, "%P#" NGX_TID_T_FMT ": ",\n                    ngx_log_pid, ngx_log_tid);\n    if (log->connection) {\n        p = ngx_slprintf(p, last, "*%uA ", log->connection);\n    }\n    msg = p;\n#if (NGX_HAVE_VARIADIC_MACROS)\n    va_start(args, fmt);\n    p = ngx_vslprintf(p, last, fmt, args);\n    va_end(args);\n#else\n    p = ngx_vslprintf(p, last, fmt, args);\n#endif\n    if (err) {\n        p = ngx_log_errno(p, last, err);\n    }\n    if (level != NGX_LOG_DEBUG && log->handler) {\n        p = log->handler(log, p, last - p);\n    }\n    if (p > last - NGX_LINEFEED_SIZE) {\n        p = last - NGX_LINEFEED_SIZE;\n    }\n    ngx_linefeed(p);\n    wrote_stderr = 0;\n    debug_connection = (log->log_level & NGX_LOG_DEBUG_CONNECTION) != 0;\n    while (log) {\n        if (log->log_level < level && !debug_connection) {\n            break;\n        }\n        (void) ngx_write_fd(log->file->fd, errstr, p - errstr);\n        if (log->file->fd == ngx_stderr) {\n            wrote_stderr = 1;\n        }\n        log = log->next;\n    }\n    if (!ngx_use_stderr\n        || level > NGX_LOG_WARN\n        || wrote_stderr)\n    {\n        return;\n    }\n    msg -= (7 + err_levels[level].len + 3);\n    (void) ngx_sprintf(msg, "nginx: [%V] ", &err_levels[level]);\n    (void) ngx_write_console(ngx_stderr, msg, p - msg);\n}', 'u_char * ngx_cdecl\nngx_sprintf(u_char *buf, const char *fmt, ...)\n{\n    u_char   *p;\n    va_list   args;\n    va_start(args, fmt);\n    p = ngx_vslprintf(buf, (void *) -1, fmt, args);\n    va_end(args);\n    return p;\n}', "u_char *\nngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)\n{\n    u_char                *p, zero;\n    int                    d;\n    double                 f;\n    size_t                 len, slen;\n    int64_t                i64;\n    uint64_t               ui64, frac;\n    ngx_msec_t             ms;\n    ngx_uint_t             width, sign, hex, max_width, frac_width, scale, n;\n    ngx_str_t             *v;\n    ngx_variable_value_t  *vv;\n    while (*fmt && buf < last) {\n        if (*fmt == '%') {\n            i64 = 0;\n            ui64 = 0;\n            zero = (u_char) ((*++fmt == '0') ? '0' : ' ');\n            width = 0;\n            sign = 1;\n            hex = 0;\n            max_width = 0;\n            frac_width = 0;\n            slen = (size_t) -1;\n            while (*fmt >= '0' && *fmt <= '9') {\n                width = width * 10 + *fmt++ - '0';\n            }\n            for ( ;; ) {\n                switch (*fmt) {\n                case 'u':\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case 'm':\n                    max_width = 1;\n                    fmt++;\n                    continue;\n                case 'X':\n                    hex = 2;\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case 'x':\n                    hex = 1;\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case '.':\n                    fmt++;\n                    while (*fmt >= '0' && *fmt <= '9') {\n                        frac_width = frac_width * 10 + *fmt++ - '0';\n                    }\n                    break;\n                case '*':\n                    slen = va_arg(args, size_t);\n                    fmt++;\n                    continue;\n                default:\n                    break;\n                }\n                break;\n            }\n            switch (*fmt) {\n            case 'V':\n                v = va_arg(args, ngx_str_t *);\n                len = ngx_min(((size_t) (last - buf)), v->len);\n                buf = ngx_cpymem(buf, v->data, len);\n                fmt++;\n                continue;\n            case 'v':\n                vv = va_arg(args, ngx_variable_value_t *);\n                len = ngx_min(((size_t) (last - buf)), vv->len);\n                buf = ngx_cpymem(buf, vv->data, len);\n                fmt++;\n                continue;\n            case 's':\n                p = va_arg(args, u_char *);\n                if (slen == (size_t) -1) {\n                    while (*p && buf < last) {\n                        *buf++ = *p++;\n                    }\n                } else {\n                    len = ngx_min(((size_t) (last - buf)), slen);\n                    buf = ngx_cpymem(buf, p, len);\n                }\n                fmt++;\n                continue;\n            case 'O':\n                i64 = (int64_t) va_arg(args, off_t);\n                sign = 1;\n                break;\n            case 'P':\n                i64 = (int64_t) va_arg(args, ngx_pid_t);\n                sign = 1;\n                break;\n            case 'T':\n                i64 = (int64_t) va_arg(args, time_t);\n                sign = 1;\n                break;\n            case 'M':\n                ms = (ngx_msec_t) va_arg(args, ngx_msec_t);\n                if ((ngx_msec_int_t) ms == -1) {\n                    sign = 1;\n                    i64 = -1;\n                } else {\n                    sign = 0;\n                    ui64 = (uint64_t) ms;\n                }\n                break;\n            case 'z':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ssize_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, size_t);\n                }\n                break;\n            case 'i':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ngx_int_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, ngx_uint_t);\n                }\n                if (max_width) {\n                    width = NGX_INT_T_LEN;\n                }\n                break;\n            case 'd':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, int);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, u_int);\n                }\n                break;\n            case 'l':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, long);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, u_long);\n                }\n                break;\n            case 'D':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, int32_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, uint32_t);\n                }\n                break;\n            case 'L':\n                if (sign) {\n                    i64 = va_arg(args, int64_t);\n                } else {\n                    ui64 = va_arg(args, uint64_t);\n                }\n                break;\n            case 'A':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ngx_atomic_int_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, ngx_atomic_uint_t);\n                }\n                if (max_width) {\n                    width = NGX_ATOMIC_T_LEN;\n                }\n                break;\n            case 'f':\n                f = va_arg(args, double);\n                if (f < 0) {\n                    *buf++ = '-';\n                    f = -f;\n                }\n                ui64 = (int64_t) f;\n                frac = 0;\n                if (frac_width) {\n                    scale = 1;\n                    for (n = frac_width; n; n--) {\n                        scale *= 10;\n                    }\n                    frac = (uint64_t) ((f - (double) ui64) * scale + 0.5);\n                    if (frac == scale) {\n                        ui64++;\n                        frac = 0;\n                    }\n                }\n                buf = ngx_sprintf_num(buf, last, ui64, zero, 0, width);\n                if (frac_width) {\n                    if (buf < last) {\n                        *buf++ = '.';\n                    }\n                    buf = ngx_sprintf_num(buf, last, frac, '0', 0, frac_width);\n                }\n                fmt++;\n                continue;\n#if !(NGX_WIN32)\n            case 'r':\n                i64 = (int64_t) va_arg(args, rlim_t);\n                sign = 1;\n                break;\n#endif\n            case 'p':\n                ui64 = (uintptr_t) va_arg(args, void *);\n                hex = 2;\n                sign = 0;\n                zero = '0';\n                width = NGX_PTR_SIZE * 2;\n                break;\n            case 'c':\n                d = va_arg(args, int);\n                *buf++ = (u_char) (d & 0xff);\n                fmt++;\n                continue;\n            case 'Z':\n                *buf++ = '\\0';\n                fmt++;\n                continue;\n            case 'N':\n#if (NGX_WIN32)\n                *buf++ = CR;\n#endif\n                *buf++ = LF;\n                fmt++;\n                continue;\n            case '%':\n                *buf++ = '%';\n                fmt++;\n                continue;\n            default:\n                *buf++ = *fmt++;\n                continue;\n            }\n            if (sign) {\n                if (i64 < 0) {\n                    *buf++ = '-';\n                    ui64 = (uint64_t) -i64;\n                } else {\n                    ui64 = (uint64_t) i64;\n                }\n            }\n            buf = ngx_sprintf_num(buf, last, ui64, zero, hex, width);\n            fmt++;\n        } else {\n            *buf++ = *fmt++;\n        }\n    }\n    return buf;\n}"]