src/http/ngx_http_file_cache.c:1029: error: Buffer Overrun S2
  Offset: [`cache->path->len`, +oo] Size: [0, +oo] by call to `ngx_http_file_cache_delete`.

src/http/ngx_http_file_cache.c:988:1: Parameter `cache->path->len`
986. 
987. 
988. static time_t
     ^
989. ngx_http_file_cache_forced_expire(ngx_http_file_cache_t *cache)
990. {

src/http/ngx_http_file_cache.c:1029:13: Call
1027. 
1028.         if (fcn->count == 0) {
1029.             ngx_http_file_cache_delete(cache, q, name);
                  ^
1030. 
1031.         } else {

src/http/ngx_http_file_cache.c:1138:1: Parameter `*name`
  1136. 
  1137. 
  1138. static void
        ^
  1139. ngx_http_file_cache_delete(ngx_http_file_cache_t *cache, ngx_queue_t *q,
  1140.     u_char *name)

src/http/ngx_http_file_cache.c:1165:9: Call
  1163. 
  1164.         len = path->name.len + 1 + path->len + 2 * NGX_HTTP_CACHE_KEY_LEN;
  1165.         ngx_create_hashed_filename(path, name, len);
                ^
  1166. 
  1167.         ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,

src/core/ngx_file.c:117:1: <Offset trace>
115. 
116. 
117. void
     ^
118. ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
119. {

src/core/ngx_file.c:117:1: Parameter `path->len`
    115. 
    116. 
    117. void
         ^
    118. ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
    119. {

src/core/ngx_file.c:117:1: <Length trace>
115. 
116. 
117. void
     ^
118. ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
119. {

src/core/ngx_file.c:117:1: Parameter `*file`
    115. 
    116. 
    117. void
         ^
    118. ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
    119. {

src/core/ngx_file.c:125:5: Array access: Offset: [cache->path->len, +oo] Size: [0, +oo] by call to `ngx_http_file_cache_delete` 
    123.     i = path->name.len + 1;
    124. 
    125.     file[path->name.len + path->len]  = '/';
             ^
    126. 
    127.     for (n = 0; n < 3; n++) {

void
ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
{
    size_t      i, level;
    ngx_uint_t  n;
    i = path->name.len + 1;
    file[path->name.len + path->len]  = '/';
    for (n = 0; n < 3; n++) {
        level = path->level[n];
        if (level == 0) {
            break;
        }
        len -= level;
        file[i - 1] = '/';
        ngx_memcpy(&file[i], &file[len], level);
        i += level + 1;
    }
}
['static time_t\nngx_http_file_cache_forced_expire(ngx_http_file_cache_t *cache)\n{\n    u_char                      *name;\n    size_t                       len;\n    time_t                       wait;\n    ngx_uint_t                   tries;\n    ngx_path_t                  *path;\n    ngx_queue_t                 *q;\n    ngx_http_file_cache_node_t  *fcn;\n    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,\n                   "http file cache forced expire");\n    path = cache->path;\n    len = path->name.len + 1 + path->len + 2 * NGX_HTTP_CACHE_KEY_LEN;\n    name = ngx_alloc(len + 1, ngx_cycle->log);\n    if (name == NULL) {\n        return 10;\n    }\n    ngx_memcpy(name, path->name.data, path->name.len);\n    wait = 10;\n    tries = 20;\n    ngx_shmtx_lock(&cache->shpool->mutex);\n    for (q = ngx_queue_last(&cache->sh->queue);\n         q != ngx_queue_sentinel(&cache->sh->queue);\n         q = ngx_queue_prev(q))\n    {\n        fcn = ngx_queue_data(q, ngx_http_file_cache_node_t, queue);\n        ngx_log_debug6(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,\n                  "http file cache forced expire: #%d %d %02xd%02xd%02xd%02xd",\n                  fcn->count, fcn->exists,\n                  fcn->key[0], fcn->key[1], fcn->key[2], fcn->key[3]);\n        if (fcn->count == 0) {\n            ngx_http_file_cache_delete(cache, q, name);\n        } else {\n            if (--tries) {\n                continue;\n            }\n            wait = 1;\n        }\n        break;\n    }\n    ngx_shmtx_unlock(&cache->shpool->mutex);\n    ngx_free(name);\n    return wait;\n}', 'static void\nngx_http_file_cache_delete(ngx_http_file_cache_t *cache, ngx_queue_t *q,\n    u_char *name)\n{\n    u_char                      *p;\n    size_t                       len;\n    ngx_path_t                  *path;\n    ngx_http_file_cache_node_t  *fcn;\n    fcn = ngx_queue_data(q, ngx_http_file_cache_node_t, queue);\n    if (fcn->exists) {\n        cache->sh->size -= (fcn->length + cache->bsize - 1) / cache->bsize;\n        path = cache->path;\n        p = name + path->name.len + 1 + path->len;\n        p = ngx_hex_dump(p, (u_char *) &fcn->node.key,\n                         sizeof(ngx_rbtree_key_t));\n        len = NGX_HTTP_CACHE_KEY_LEN - sizeof(ngx_rbtree_key_t);\n        p = ngx_hex_dump(p, fcn->key, len);\n        *p = \'\\0\';\n        fcn->count++;\n        fcn->deleting = 1;\n        ngx_shmtx_unlock(&cache->shpool->mutex);\n        len = path->name.len + 1 + path->len + 2 * NGX_HTTP_CACHE_KEY_LEN;\n        ngx_create_hashed_filename(path, name, len);\n        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0,\n                       "http file cache expire: \\"%s\\"", name);\n        if (ngx_delete_file(name) == NGX_FILE_ERROR) {\n            ngx_log_error(NGX_LOG_CRIT, ngx_cycle->log, ngx_errno,\n                          ngx_delete_file_n " \\"%s\\" failed", name);\n        }\n        ngx_shmtx_lock(&cache->shpool->mutex);\n        fcn->count--;\n        fcn->deleting = 0;\n    }\n    if (fcn->count == 0) {\n        ngx_queue_remove(q);\n        ngx_rbtree_delete(&cache->sh->rbtree, &fcn->node);\n        ngx_slab_free_locked(cache->shpool, fcn);\n    }\n}', "void\nngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)\n{\n    size_t      i, level;\n    ngx_uint_t  n;\n    i = path->name.len + 1;\n    file[path->name.len + path->len]  = '/';\n    for (n = 0; n < 3; n++) {\n        level = path->level[n];\n        if (level == 0) {\n            break;\n        }\n        len -= level;\n        file[i - 1] = '/';\n        ngx_memcpy(&file[i], &file[len], level);\n        i += level + 1;\n    }\n}"]