src/http/modules/ngx_http_chunked_filter_module.c:293: error: Buffer Overrun L3
  Offset: [0, 4] Size: [0, +oo].

src/http/modules/ngx_http_chunked_filter_module.c:239:5: <Length trace>
237.     ngx_table_elt_t  *header;
238. 
239.     len = 0;
         ^
240. 
241.     part = &r->headers_out.trailers.part;

src/http/modules/ngx_http_chunked_filter_module.c:239:5: Assignment
237.     ngx_table_elt_t  *header;
238. 
239.     len = 0;
         ^
240. 
241.     part = &r->headers_out.trailers.part;

src/http/modules/ngx_http_chunked_filter_module.c:282:5: Assignment
280.     }
281. 
282.     len += sizeof(CRLF "0" CRLF CRLF) - 1;
         ^
283. 
284.     b->pos = ngx_palloc(r->pool, len);

src/http/modules/ngx_http_chunked_filter_module.c:284:14: Call
282.     len += sizeof(CRLF "0" CRLF CRLF) - 1;
283. 
284.     b->pos = ngx_palloc(r->pool, len);
                  ^
285.     if (b->pos == NULL) {
286.         return NULL;

src/core/ngx_palloc.c:127:16: Call
  125. #if !(NGX_DEBUG_PALLOC)
  126.     if (size <= pool->max) {
  127.         return ngx_palloc_small(pool, size, 1);
                      ^
  128.     }
  129. #endif

src/core/ngx_palloc.c:157:9: Assignment
    155. 
    156.     do {
    157.         m = p->d.last;
                 ^
    158. 
    159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
    164.             p->d.last = m + size;
    165. 
    166.             return m;
                     ^
    167.         }
    168. 

src/core/ngx_palloc.c:127:9: Assignment
  125. #if !(NGX_DEBUG_PALLOC)
  126.     if (size <= pool->max) {
  127.         return ngx_palloc_small(pool, size, 1);
               ^
  128.     }
  129. #endif

src/http/modules/ngx_http_chunked_filter_module.c:284:5: Assignment
282.     len += sizeof(CRLF "0" CRLF CRLF) - 1;
283. 
284.     b->pos = ngx_palloc(r->pool, len);
         ^
285.     if (b->pos == NULL) {
286.         return NULL;

src/http/modules/ngx_http_chunked_filter_module.c:289:5: Assignment
287.     }
288. 
289.     b->last = b->pos;
         ^
290. 
291.     *b->last++ = CR; *b->last++ = LF;

src/http/modules/ngx_http_chunked_filter_module.c:293:22: Array access: Offset: [0, 4] Size: [0, +oo]
291.     *b->last++ = CR; *b->last++ = LF;
292.     *b->last++ = '0';
293.     *b->last++ = CR; *b->last++ = LF;
                          ^
294. 
295.     part = &r->headers_out.trailers.part;

static ngx_chain_t *
ngx_http_chunked_create_trailers(ngx_http_request_t *r,
    ngx_http_chunked_filter_ctx_t *ctx)
{
    size_t            len;
    ngx_buf_t        *b;
    ngx_uint_t        i;
    ngx_chain_t      *cl;
    ngx_list_part_t  *part;
    ngx_table_elt_t  *header;
    len = 0;
    part = &r->headers_out.trailers.part;
    header = part->elts;
    for (i = 0;  ; i++) {
        if (i >= part->nelts) {
            if (part->next == NULL) {
                break;
            }
            part = part->next;
            header = part->elts;
            i = 0;
        }
        if (header[i].hash == 0) {
            continue;
        }
        len += header[i].key.len + sizeof(": ") - 1
               + header[i].value.len + sizeof(CRLF) - 1;
    }
    cl = ngx_chain_get_free_buf(r->pool, &ctx->free);
    if (cl == NULL) {
        return NULL;
    }
    b = cl->buf;
    b->tag = (ngx_buf_tag_t) &ngx_http_chunked_filter_module;
    b->temporary = 0;
    b->memory = 1;
    b->last_buf = 1;
    if (len == 0) {
        b->pos = (u_char *) CRLF "0" CRLF CRLF;
        b->last = b->pos + sizeof(CRLF "0" CRLF CRLF) - 1;
        return cl;
    }
    len += sizeof(CRLF "0" CRLF CRLF) - 1;
    b->pos = ngx_palloc(r->pool, len);
    if (b->pos == NULL) {
        return NULL;
    }
    b->last = b->pos;
    *b->last++ = CR; *b->last++ = LF;
    *b->last++ = '0';
    *b->last++ = CR; *b->last++ = LF;
    part = &r->headers_out.trailers.part;
    header = part->elts;
    for (i = 0;  ; i++) {
        if (i >= part->nelts) {
            if (part->next == NULL) {
                break;
            }
            part = part->next;
            header = part->elts;
            i = 0;
        }
        if (header[i].hash == 0) {
            continue;
        }
        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                       "http trailer: \"%V: %V\"",
                       &header[i].key, &header[i].value);
        b->last = ngx_copy(b->last, header[i].key.data, header[i].key.len);
        *b->last++ = ':'; *b->last++ = ' ';
        b->last = ngx_copy(b->last, header[i].value.data, header[i].value.len);
        *b->last++ = CR; *b->last++ = LF;
    }
    *b->last++ = CR; *b->last++ = LF;
    return cl;
}
['static ngx_chain_t *\nngx_http_chunked_create_trailers(ngx_http_request_t *r,\n    ngx_http_chunked_filter_ctx_t *ctx)\n{\n    size_t            len;\n    ngx_buf_t        *b;\n    ngx_uint_t        i;\n    ngx_chain_t      *cl;\n    ngx_list_part_t  *part;\n    ngx_table_elt_t  *header;\n    len = 0;\n    part = &r->headers_out.trailers.part;\n    header = part->elts;\n    for (i = 0;  ; i++) {\n        if (i >= part->nelts) {\n            if (part->next == NULL) {\n                break;\n            }\n            part = part->next;\n            header = part->elts;\n            i = 0;\n        }\n        if (header[i].hash == 0) {\n            continue;\n        }\n        len += header[i].key.len + sizeof(": ") - 1\n               + header[i].value.len + sizeof(CRLF) - 1;\n    }\n    cl = ngx_chain_get_free_buf(r->pool, &ctx->free);\n    if (cl == NULL) {\n        return NULL;\n    }\n    b = cl->buf;\n    b->tag = (ngx_buf_tag_t) &ngx_http_chunked_filter_module;\n    b->temporary = 0;\n    b->memory = 1;\n    b->last_buf = 1;\n    if (len == 0) {\n        b->pos = (u_char *) CRLF "0" CRLF CRLF;\n        b->last = b->pos + sizeof(CRLF "0" CRLF CRLF) - 1;\n        return cl;\n    }\n    len += sizeof(CRLF "0" CRLF CRLF) - 1;\n    b->pos = ngx_palloc(r->pool, len);\n    if (b->pos == NULL) {\n        return NULL;\n    }\n    b->last = b->pos;\n    *b->last++ = CR; *b->last++ = LF;\n    *b->last++ = \'0\';\n    *b->last++ = CR; *b->last++ = LF;\n    part = &r->headers_out.trailers.part;\n    header = part->elts;\n    for (i = 0;  ; i++) {\n        if (i >= part->nelts) {\n            if (part->next == NULL) {\n                break;\n            }\n            part = part->next;\n            header = part->elts;\n            i = 0;\n        }\n        if (header[i].hash == 0) {\n            continue;\n        }\n        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http trailer: \\"%V: %V\\"",\n                       &header[i].key, &header[i].value);\n        b->last = ngx_copy(b->last, header[i].key.data, header[i].key.len);\n        *b->last++ = \':\'; *b->last++ = \' \';\n        b->last = ngx_copy(b->last, header[i].value.data, header[i].value.len);\n        *b->last++ = CR; *b->last++ = LF;\n    }\n    *b->last++ = CR; *b->last++ = LF;\n    return cl;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n#if !(NGX_DEBUG_PALLOC)\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 1);\n    }\n#endif\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}']