src/http/modules/ngx_http_uwsgi_module.c:975: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

src/http/modules/ngx_http_uwsgi_module.c:796:5: <Length trace>
794.     ngx_http_script_len_code_pt   lcode;
795. 
796.     len = 0;
         ^
797.     header_params = 0;
798.     ignored = NULL;

src/http/modules/ngx_http_uwsgi_module.c:796:5: Assignment
794.     ngx_http_script_len_code_pt   lcode;
795. 
796.     len = 0;
         ^
797.     header_params = 0;
798.     ignored = NULL;

src/http/modules/ngx_http_uwsgi_module.c:909:5: Assignment
907.     }
908. 
909.     len += uwcf->uwsgi_string.len;
         ^
910. 
911. #if 0

src/http/modules/ngx_http_uwsgi_module.c:920:9: Call
918. #endif
919. 
920.     b = ngx_create_temp_buf(r->pool, len + 4);
             ^
921.     if (b == NULL) {
922.         return NGX_ERROR;

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:130:13: Assignment
    128. 
    129.         do {
    130.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                     ^
    131. 
    132.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:135:17: Assignment
    133.                 p->d.last = m + size;
    134. 
    135.                 return m;
                         ^
    136.             }
    137. 

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:39:5: Assignment
  37. 
  38.     b->pos = b->start;
  39.     b->last = b->start;
          ^
  40.     b->end = b->last + size;
  41.     b->temporary = 1;

src/http/modules/ngx_http_uwsgi_module.c:941:9: Assignment
939. 
940.         e.ip = params->values->elts;
941.         e.pos = b->last;
             ^
942.         e.request = r;
943.         e.flushed = 1;

src/http/modules/ngx_http_uwsgi_module.c:974:14: Assignment
972.             }
973. 
974.             *e.pos++ = (u_char) (key_len & 0xff);
                  ^
975.             *e.pos++ = (u_char) ((key_len >> 8) & 0xff);
976. 

src/http/modules/ngx_http_uwsgi_module.c:975:13: Array access: Offset: [1, +oo] Size: [0, +oo]
973. 
974.             *e.pos++ = (u_char) (key_len & 0xff);
975.             *e.pos++ = (u_char) ((key_len >> 8) & 0xff);
                 ^
976. 
977.             code = *(ngx_http_script_code_pt *) e.ip;

static ngx_int_t
ngx_http_uwsgi_create_request(ngx_http_request_t *r)
{
    u_char                        ch, *lowcase_key;
    size_t                        key_len, val_len, len, allocated;
    ngx_uint_t                    i, n, hash, skip_empty, header_params;
    ngx_buf_t                    *b;
    ngx_chain_t                  *cl, *body;
    ngx_list_part_t              *part;
    ngx_table_elt_t              *header, **ignored;
    ngx_http_uwsgi_params_t      *params;
    ngx_http_script_code_pt       code;
    ngx_http_script_engine_t      e, le;
    ngx_http_uwsgi_loc_conf_t    *uwcf;
    ngx_http_script_len_code_pt   lcode;
    len = 0;
    header_params = 0;
    ignored = NULL;
    uwcf = ngx_http_get_module_loc_conf(r, ngx_http_uwsgi_module);
#if (NGX_HTTP_CACHE)
    params = r->upstream->cacheable ? &uwcf->params_cache : &uwcf->params;
#else
    params = &uwcf->params;
#endif
    if (params->lengths) {
        ngx_memzero(&le, sizeof(ngx_http_script_engine_t));
        ngx_http_script_flush_no_cacheable_variables(r, params->flushes);
        le.flushed = 1;
        le.ip = params->lengths->elts;
        le.request = r;
        while (*(uintptr_t *) le.ip) {
            lcode = *(ngx_http_script_len_code_pt *) le.ip;
            key_len = lcode(&le);
            lcode = *(ngx_http_script_len_code_pt *) le.ip;
            skip_empty = lcode(&le);
            for (val_len = 0; *(uintptr_t *) le.ip; val_len += lcode (&le)) {
                lcode = *(ngx_http_script_len_code_pt *) le.ip;
            }
            le.ip += sizeof(uintptr_t);
            if (skip_empty && val_len == 0) {
                continue;
            }
            len += 2 + key_len + 2 + val_len;
        }
    }
    if (uwcf->upstream.pass_request_headers) {
        allocated = 0;
        lowcase_key = NULL;
        if (params->number) {
            n = 0;
            part = &r->headers_in.headers.part;
            while (part) {
                n += part->nelts;
                part = part->next;
            }
            ignored = ngx_palloc(r->pool, n * sizeof(void *));
            if (ignored == NULL) {
                return NGX_ERROR;
            }
        }
        part = &r->headers_in.headers.part;
        header = part->elts;
        for (i = 0;   ; i++) {
            if (i >= part->nelts) {
                if (part->next == NULL) {
                    break;
                }
                part = part->next;
                header = part->elts;
                i = 0;
            }
            if (params->number) {
                if (allocated < header[i].key.len) {
                    allocated = header[i].key.len + 16;
                    lowcase_key = ngx_pnalloc(r->pool, allocated);
                    if (lowcase_key == NULL) {
                        return NGX_ERROR;
                    }
                }
                hash = 0;
                for (n = 0; n < header[i].key.len; n++) {
                    ch = header[i].key.data[n];
                    if (ch >= 'A' && ch <= 'Z') {
                        ch |= 0x20;
                    } else if (ch == '-') {
                        ch = '_';
                    }
                    hash = ngx_hash(hash, ch);
                    lowcase_key[n] = ch;
                }
                if (ngx_hash_find(&params->hash, hash, lowcase_key, n)) {
                    ignored[header_params++] = &header[i];
                    continue;
                }
            }
            len += 2 + sizeof("HTTP_") - 1 + header[i].key.len
                 + 2 + header[i].value.len;
        }
    }
    len += uwcf->uwsgi_string.len;
#if 0
    if (len > 0 && len < 2) {
        ngx_log_error (NGX_LOG_ALERT, r->connection->log, 0,
                       "uwsgi request is too little: %uz", len);
        return NGX_ERROR;
    }
#endif
    b = ngx_create_temp_buf(r->pool, len + 4);
    if (b == NULL) {
        return NGX_ERROR;
    }
    cl = ngx_alloc_chain_link(r->pool);
    if (cl == NULL) {
        return NGX_ERROR;
    }
    cl->buf = b;
    *b->last++ = (u_char) uwcf->modifier1;
    *b->last++ = (u_char) (len & 0xff);
    *b->last++ = (u_char) ((len >> 8) & 0xff);
    *b->last++ = (u_char) uwcf->modifier2;
    if (params->lengths) {
        ngx_memzero(&e, sizeof(ngx_http_script_engine_t));
        e.ip = params->values->elts;
        e.pos = b->last;
        e.request = r;
        e.flushed = 1;
        le.ip = params->lengths->elts;
        while (*(uintptr_t *) le.ip) {
            lcode = *(ngx_http_script_len_code_pt *) le.ip;
            key_len = (u_char) lcode (&le);
            lcode = *(ngx_http_script_len_code_pt *) le.ip;
            skip_empty = lcode(&le);
            for (val_len = 0; *(uintptr_t *) le.ip; val_len += lcode(&le)) {
                lcode = *(ngx_http_script_len_code_pt *) le.ip;
            }
            le.ip += sizeof(uintptr_t);
            if (skip_empty && val_len == 0) {
                e.skip = 1;
                while (*(uintptr_t *) e.ip) {
                    code = *(ngx_http_script_code_pt *) e.ip;
                    code((ngx_http_script_engine_t *) &e);
                }
                e.ip += sizeof(uintptr_t);
                e.skip = 0;
                continue;
            }
            *e.pos++ = (u_char) (key_len & 0xff);
            *e.pos++ = (u_char) ((key_len >> 8) & 0xff);
            code = *(ngx_http_script_code_pt *) e.ip;
            code((ngx_http_script_engine_t *) & e);
            *e.pos++ = (u_char) (val_len & 0xff);
            *e.pos++ = (u_char) ((val_len >> 8) & 0xff);
            while (*(uintptr_t *) e.ip) {
                code = *(ngx_http_script_code_pt *) e.ip;
                code((ngx_http_script_engine_t *) & e);
            }
            e.ip += sizeof(uintptr_t);
            ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                           "uwsgi param: \"%*s: %*s\"",
                           key_len, e.pos - (key_len + 2 + val_len),
                           val_len, e.pos - val_len);
        }
        b->last = e.pos;
    }
    if (uwcf->upstream.pass_request_headers) {
        part = &r->headers_in.headers.part;
        header = part->elts;
        for (i = 0;   ; i++) {
            if (i >= part->nelts) {
                if (part->next == NULL) {
                    break;
                }
                part = part->next;
                header = part->elts;
                i = 0;
            }
            for (n = 0; n < header_params; n++) {
                if (&header[i] == ignored[n]) {
                    goto next;
                }
            }
            key_len = sizeof("HTTP_") - 1 + header[i].key.len;
            *b->last++ = (u_char) (key_len & 0xff);
            *b->last++ = (u_char) ((key_len >> 8) & 0xff);
            b->last = ngx_cpymem(b->last, "HTTP_", sizeof("HTTP_") - 1);
            for (n = 0; n < header[i].key.len; n++) {
                ch = header[i].key.data[n];
                if (ch >= 'a' && ch <= 'z') {
                    ch &= ~0x20;
                } else if (ch == '-') {
                    ch = '_';
                }
                *b->last++ = ch;
            }
            val_len = header[i].value.len;
            *b->last++ = (u_char) (val_len & 0xff);
            *b->last++ = (u_char) ((val_len >> 8) & 0xff);
            b->last = ngx_copy(b->last, header[i].value.data, val_len);
            ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                           "uwsgi param: \"%*s: %*s\"",
                           key_len, b->last - (key_len + 2 + val_len),
                           val_len, b->last - val_len);
        next:
            continue;
        }
    }
    b->last = ngx_copy(b->last, uwcf->uwsgi_string.data,
                       uwcf->uwsgi_string.len);
    if (uwcf->upstream.pass_request_body) {
        body = r->upstream->request_bufs;
        r->upstream->request_bufs = cl;
        while (body) {
            b = ngx_alloc_buf(r->pool);
            if (b == NULL) {
                return NGX_ERROR;
            }
            ngx_memcpy(b, body->buf, sizeof(ngx_buf_t));
            cl->next = ngx_alloc_chain_link(r->pool);
            if (cl->next == NULL) {
                return NGX_ERROR;
            }
            cl = cl->next;
            cl->buf = b;
            body = body->next;
        }
    } else {
        r->upstream->request_bufs = cl;
    }
    cl->next = NULL;
    return NGX_OK;
}
['static ngx_int_t\nngx_http_uwsgi_create_request(ngx_http_request_t *r)\n{\n    u_char                        ch, *lowcase_key;\n    size_t                        key_len, val_len, len, allocated;\n    ngx_uint_t                    i, n, hash, skip_empty, header_params;\n    ngx_buf_t                    *b;\n    ngx_chain_t                  *cl, *body;\n    ngx_list_part_t              *part;\n    ngx_table_elt_t              *header, **ignored;\n    ngx_http_uwsgi_params_t      *params;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_engine_t      e, le;\n    ngx_http_uwsgi_loc_conf_t    *uwcf;\n    ngx_http_script_len_code_pt   lcode;\n    len = 0;\n    header_params = 0;\n    ignored = NULL;\n    uwcf = ngx_http_get_module_loc_conf(r, ngx_http_uwsgi_module);\n#if (NGX_HTTP_CACHE)\n    params = r->upstream->cacheable ? &uwcf->params_cache : &uwcf->params;\n#else\n    params = &uwcf->params;\n#endif\n    if (params->lengths) {\n        ngx_memzero(&le, sizeof(ngx_http_script_engine_t));\n        ngx_http_script_flush_no_cacheable_variables(r, params->flushes);\n        le.flushed = 1;\n        le.ip = params->lengths->elts;\n        le.request = r;\n        while (*(uintptr_t *) le.ip) {\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            key_len = lcode(&le);\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            skip_empty = lcode(&le);\n            for (val_len = 0; *(uintptr_t *) le.ip; val_len += lcode (&le)) {\n                lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            }\n            le.ip += sizeof(uintptr_t);\n            if (skip_empty && val_len == 0) {\n                continue;\n            }\n            len += 2 + key_len + 2 + val_len;\n        }\n    }\n    if (uwcf->upstream.pass_request_headers) {\n        allocated = 0;\n        lowcase_key = NULL;\n        if (params->number) {\n            n = 0;\n            part = &r->headers_in.headers.part;\n            while (part) {\n                n += part->nelts;\n                part = part->next;\n            }\n            ignored = ngx_palloc(r->pool, n * sizeof(void *));\n            if (ignored == NULL) {\n                return NGX_ERROR;\n            }\n        }\n        part = &r->headers_in.headers.part;\n        header = part->elts;\n        for (i = 0;   ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                header = part->elts;\n                i = 0;\n            }\n            if (params->number) {\n                if (allocated < header[i].key.len) {\n                    allocated = header[i].key.len + 16;\n                    lowcase_key = ngx_pnalloc(r->pool, allocated);\n                    if (lowcase_key == NULL) {\n                        return NGX_ERROR;\n                    }\n                }\n                hash = 0;\n                for (n = 0; n < header[i].key.len; n++) {\n                    ch = header[i].key.data[n];\n                    if (ch >= \'A\' && ch <= \'Z\') {\n                        ch |= 0x20;\n                    } else if (ch == \'-\') {\n                        ch = \'_\';\n                    }\n                    hash = ngx_hash(hash, ch);\n                    lowcase_key[n] = ch;\n                }\n                if (ngx_hash_find(&params->hash, hash, lowcase_key, n)) {\n                    ignored[header_params++] = &header[i];\n                    continue;\n                }\n            }\n            len += 2 + sizeof("HTTP_") - 1 + header[i].key.len\n                 + 2 + header[i].value.len;\n        }\n    }\n    len += uwcf->uwsgi_string.len;\n#if 0\n    if (len > 0 && len < 2) {\n        ngx_log_error (NGX_LOG_ALERT, r->connection->log, 0,\n                       "uwsgi request is too little: %uz", len);\n        return NGX_ERROR;\n    }\n#endif\n    b = ngx_create_temp_buf(r->pool, len + 4);\n    if (b == NULL) {\n        return NGX_ERROR;\n    }\n    cl = ngx_alloc_chain_link(r->pool);\n    if (cl == NULL) {\n        return NGX_ERROR;\n    }\n    cl->buf = b;\n    *b->last++ = (u_char) uwcf->modifier1;\n    *b->last++ = (u_char) (len & 0xff);\n    *b->last++ = (u_char) ((len >> 8) & 0xff);\n    *b->last++ = (u_char) uwcf->modifier2;\n    if (params->lengths) {\n        ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n        e.ip = params->values->elts;\n        e.pos = b->last;\n        e.request = r;\n        e.flushed = 1;\n        le.ip = params->lengths->elts;\n        while (*(uintptr_t *) le.ip) {\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            key_len = (u_char) lcode (&le);\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            skip_empty = lcode(&le);\n            for (val_len = 0; *(uintptr_t *) le.ip; val_len += lcode(&le)) {\n                lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            }\n            le.ip += sizeof(uintptr_t);\n            if (skip_empty && val_len == 0) {\n                e.skip = 1;\n                while (*(uintptr_t *) e.ip) {\n                    code = *(ngx_http_script_code_pt *) e.ip;\n                    code((ngx_http_script_engine_t *) &e);\n                }\n                e.ip += sizeof(uintptr_t);\n                e.skip = 0;\n                continue;\n            }\n            *e.pos++ = (u_char) (key_len & 0xff);\n            *e.pos++ = (u_char) ((key_len >> 8) & 0xff);\n            code = *(ngx_http_script_code_pt *) e.ip;\n            code((ngx_http_script_engine_t *) & e);\n            *e.pos++ = (u_char) (val_len & 0xff);\n            *e.pos++ = (u_char) ((val_len >> 8) & 0xff);\n            while (*(uintptr_t *) e.ip) {\n                code = *(ngx_http_script_code_pt *) e.ip;\n                code((ngx_http_script_engine_t *) & e);\n            }\n            e.ip += sizeof(uintptr_t);\n            ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "uwsgi param: \\"%*s: %*s\\"",\n                           key_len, e.pos - (key_len + 2 + val_len),\n                           val_len, e.pos - val_len);\n        }\n        b->last = e.pos;\n    }\n    if (uwcf->upstream.pass_request_headers) {\n        part = &r->headers_in.headers.part;\n        header = part->elts;\n        for (i = 0;   ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                header = part->elts;\n                i = 0;\n            }\n            for (n = 0; n < header_params; n++) {\n                if (&header[i] == ignored[n]) {\n                    goto next;\n                }\n            }\n            key_len = sizeof("HTTP_") - 1 + header[i].key.len;\n            *b->last++ = (u_char) (key_len & 0xff);\n            *b->last++ = (u_char) ((key_len >> 8) & 0xff);\n            b->last = ngx_cpymem(b->last, "HTTP_", sizeof("HTTP_") - 1);\n            for (n = 0; n < header[i].key.len; n++) {\n                ch = header[i].key.data[n];\n                if (ch >= \'a\' && ch <= \'z\') {\n                    ch &= ~0x20;\n                } else if (ch == \'-\') {\n                    ch = \'_\';\n                }\n                *b->last++ = ch;\n            }\n            val_len = header[i].value.len;\n            *b->last++ = (u_char) (val_len & 0xff);\n            *b->last++ = (u_char) ((val_len >> 8) & 0xff);\n            b->last = ngx_copy(b->last, header[i].value.data, val_len);\n            ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "uwsgi param: \\"%*s: %*s\\"",\n                           key_len, b->last - (key_len + 2 + val_len),\n                           val_len, b->last - val_len);\n        next:\n            continue;\n        }\n    }\n    b->last = ngx_copy(b->last, uwcf->uwsgi_string.data,\n                       uwcf->uwsgi_string.len);\n    if (uwcf->upstream.pass_request_body) {\n        body = r->upstream->request_bufs;\n        r->upstream->request_bufs = cl;\n        while (body) {\n            b = ngx_alloc_buf(r->pool);\n            if (b == NULL) {\n                return NGX_ERROR;\n            }\n            ngx_memcpy(b, body->buf, sizeof(ngx_buf_t));\n            cl->next = ngx_alloc_chain_link(r->pool);\n            if (cl->next == NULL) {\n                return NGX_ERROR;\n            }\n            cl = cl->next;\n            cl->buf = b;\n            body = body->next;\n        }\n    } else {\n        r->upstream->request_bufs = cl;\n    }\n    cl->next = NULL;\n    return NGX_OK;\n}', 'ngx_buf_t *\nngx_create_temp_buf(ngx_pool_t *pool, size_t size)\n{\n    ngx_buf_t *b;\n    b = ngx_calloc_buf(pool);\n    if (b == NULL) {\n        return NULL;\n    }\n    b->start = ngx_palloc(pool, size);\n    if (b->start == NULL) {\n        return NULL;\n    }\n    b->pos = b->start;\n    b->last = b->start;\n    b->end = b->last + size;\n    b->temporary = 1;\n    return b;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    if (size <= pool->max) {\n        p = pool->current;\n        do {\n            m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);\n            if ((size_t) (p->d.end - m) >= size) {\n                p->d.last = m + size;\n                return m;\n            }\n            p = p->d.next;\n        } while (p);\n        return ngx_palloc_block(pool, size);\n    }\n    return ngx_palloc_large(pool, size);\n}']