src/http/modules/ngx_http_geo_module.c:1493: error: Buffer Overrun L3
  Offset: 65553 (⇐ 17 + 65536) Size: [0, +oo].

src/http/modules/ngx_http_geo_module.c:1474:9: <Length trace>
1472. 
1473.     while (vv->data) {
1474.         len = ngx_align(sizeof(ngx_http_variable_value_t) + vv->len,
              ^
1475.                         sizeof(void *));
1476.         ngx_crc32_update(&crc32, (u_char *) vv, len);

src/http/modules/ngx_http_geo_module.c:1474:9: Assignment
1472. 
1473.     while (vv->data) {
1474.         len = ngx_align(sizeof(ngx_http_variable_value_t) + vv->len,
              ^
1475.                         sizeof(void *));
1476.         ngx_crc32_update(&crc32, (u_char *) vv, len);

src/http/modules/ngx_http_geo_module.c:1478:9: Assignment
1476.         ngx_crc32_update(&crc32, (u_char *) vv, len);
1477.         vv->data += (size_t) base;
1478.         vv = (ngx_http_variable_value_t *) ((u_char *) vv + len);
              ^
1479.     }
1480.     ngx_crc32_update(&crc32, (u_char *) vv, sizeof(ngx_http_variable_value_t));

src/http/modules/ngx_http_geo_module.c:1481:5: Assignment
1479.     }
1480.     ngx_crc32_update(&crc32, (u_char *) vv, sizeof(ngx_http_variable_value_t));
1481.     vv++;
          ^
1482. 
1483.     ranges = (ngx_http_geo_range_t **) vv;

src/http/modules/ngx_http_geo_module.c:1483:5: Assignment
1481.     vv++;
1482. 
1483.     ranges = (ngx_http_geo_range_t **) vv;
          ^
1484. 
1485.     for (i = 0; i < 0x10000; i++) {

src/http/modules/ngx_http_geo_module.c:1493:5: Array access: Offset: 65553 (⇐ 17 + 65536) Size: [0, +oo]
1491.     }
1492. 
1493.     range = (ngx_http_geo_range_t *) &ranges[0x10000];
          ^
1494. 
1495.     while ((u_char *) range < base + size) {

static ngx_int_t
ngx_http_geo_include_binary_base(ngx_conf_t *cf, ngx_http_geo_conf_ctx_t *ctx,
    ngx_str_t *name)
{
    u_char                     *base, ch;
    time_t                      mtime;
    size_t                      size, len;
    ssize_t                     n;
    uint32_t                    crc32;
    ngx_err_t                   err;
    ngx_int_t                   rc;
    ngx_uint_t                  i;
    ngx_file_t                  file;
    ngx_file_info_t             fi;
    ngx_http_geo_range_t       *range, **ranges;
    ngx_http_geo_header_t      *header;
    ngx_http_variable_value_t  *vv;
    ngx_memzero(&file, sizeof(ngx_file_t));
    file.name = *name;
    file.log = cf->log;
    file.fd = ngx_open_file(name->data, NGX_FILE_RDONLY, 0, 0);
    if (file.fd == NGX_INVALID_FILE) {
        err = ngx_errno;
        if (err != NGX_ENOENT) {
            ngx_conf_log_error(NGX_LOG_CRIT, cf, err,
                               ngx_open_file_n " \"%s\" failed", name->data);
        }
        return NGX_DECLINED;
    }
    if (ctx->outside_entries) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
            "binary geo range base \"%s\" cannot be mixed with usual entries",
            name->data);
        rc = NGX_ERROR;
        goto done;
    }
    if (ctx->binary_include) {
        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
            "second binary geo range base \"%s\" cannot be mixed with \"%s\"",
            name->data, ctx->include_name.data);
        rc = NGX_ERROR;
        goto done;
    }
    if (ngx_fd_info(file.fd, &fi) == NGX_FILE_ERROR) {
        ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
                           ngx_fd_info_n " \"%s\" failed", name->data);
        goto failed;
    }
    size = (size_t) ngx_file_size(&fi);
    mtime = ngx_file_mtime(&fi);
    ch = name->data[name->len - 4];
    name->data[name->len - 4] = '\0';
    if (ngx_file_info(name->data, &fi) == NGX_FILE_ERROR) {
        ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
                           ngx_file_info_n " \"%s\" failed", name->data);
        goto failed;
    }
    name->data[name->len - 4] = ch;
    if (mtime < ngx_file_mtime(&fi)) {
        ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
                           "stale binary geo range base \"%s\"", name->data);
        goto failed;
    }
    base = ngx_palloc(ctx->pool, size);
    if (base == NULL) {
        goto failed;
    }
    n = ngx_read_file(&file, base, size, 0);
    if (n == NGX_ERROR) {
        ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,
                           ngx_read_file_n " \"%s\" failed", name->data);
        goto failed;
    }
    if ((size_t) n != size) {
        ngx_conf_log_error(NGX_LOG_CRIT, cf, 0,
            ngx_read_file_n " \"%s\" returned only %z bytes instead of %z",
            name->data, n, size);
        goto failed;
    }
    header = (ngx_http_geo_header_t *) base;
    if (size < 16 || ngx_memcmp(&ngx_http_geo_header, header, 12) != 0) {
        ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
             "incompatible binary geo range base \"%s\"", name->data);
        goto failed;
    }
    ngx_crc32_init(crc32);
    vv = (ngx_http_variable_value_t *) (base + sizeof(ngx_http_geo_header_t));
    while (vv->data) {
        len = ngx_align(sizeof(ngx_http_variable_value_t) + vv->len,
                        sizeof(void *));
        ngx_crc32_update(&crc32, (u_char *) vv, len);
        vv->data += (size_t) base;
        vv = (ngx_http_variable_value_t *) ((u_char *) vv + len);
    }
    ngx_crc32_update(&crc32, (u_char *) vv, sizeof(ngx_http_variable_value_t));
    vv++;
    ranges = (ngx_http_geo_range_t **) vv;
    for (i = 0; i < 0x10000; i++) {
        ngx_crc32_update(&crc32, (u_char *) &ranges[i], sizeof(void *));
        if (ranges[i]) {
            ranges[i] = (ngx_http_geo_range_t *)
                            ((u_char *) ranges[i] + (size_t) base);
        }
    }
    range = (ngx_http_geo_range_t *) &ranges[0x10000];
    while ((u_char *) range < base + size) {
        while (range->value) {
            ngx_crc32_update(&crc32, (u_char *) range,
                             sizeof(ngx_http_geo_range_t));
            range->value = (ngx_http_variable_value_t *)
                               ((u_char *) range->value + (size_t) base);
            range++;
        }
        ngx_crc32_update(&crc32, (u_char *) range, sizeof(void *));
        range = (ngx_http_geo_range_t *) ((u_char *) range + sizeof(void *));
    }
    ngx_crc32_final(crc32);
    if (crc32 != header->crc32) {
        ngx_conf_log_error(NGX_LOG_WARN, cf, 0,
                  "CRC32 mismatch in binary geo range base \"%s\"", name->data);
        goto failed;
    }
    ngx_conf_log_error(NGX_LOG_NOTICE, cf, 0,
                       "using binary geo range base \"%s\"", name->data);
    ctx->include_name = *name;
    ctx->binary_include = 1;
    ctx->high.low = ranges;
    rc = NGX_OK;
    goto done;
failed:
    rc = NGX_DECLINED;
done:
    if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {
        ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,
                      ngx_close_file_n " \"%s\" failed", name->data);
    }
    return rc;
}
['static ngx_int_t\nngx_http_geo_include_binary_base(ngx_conf_t *cf, ngx_http_geo_conf_ctx_t *ctx,\n    ngx_str_t *name)\n{\n    u_char                     *base, ch;\n    time_t                      mtime;\n    size_t                      size, len;\n    ssize_t                     n;\n    uint32_t                    crc32;\n    ngx_err_t                   err;\n    ngx_int_t                   rc;\n    ngx_uint_t                  i;\n    ngx_file_t                  file;\n    ngx_file_info_t             fi;\n    ngx_http_geo_range_t       *range, **ranges;\n    ngx_http_geo_header_t      *header;\n    ngx_http_variable_value_t  *vv;\n    ngx_memzero(&file, sizeof(ngx_file_t));\n    file.name = *name;\n    file.log = cf->log;\n    file.fd = ngx_open_file(name->data, NGX_FILE_RDONLY, 0, 0);\n    if (file.fd == NGX_INVALID_FILE) {\n        err = ngx_errno;\n        if (err != NGX_ENOENT) {\n            ngx_conf_log_error(NGX_LOG_CRIT, cf, err,\n                               ngx_open_file_n " \\"%s\\" failed", name->data);\n        }\n        return NGX_DECLINED;\n    }\n    if (ctx->outside_entries) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n            "binary geo range base \\"%s\\" cannot be mixed with usual entries",\n            name->data);\n        rc = NGX_ERROR;\n        goto done;\n    }\n    if (ctx->binary_include) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n            "second binary geo range base \\"%s\\" cannot be mixed with \\"%s\\"",\n            name->data, ctx->include_name.data);\n        rc = NGX_ERROR;\n        goto done;\n    }\n    if (ngx_fd_info(file.fd, &fi) == NGX_FILE_ERROR) {\n        ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,\n                           ngx_fd_info_n " \\"%s\\" failed", name->data);\n        goto failed;\n    }\n    size = (size_t) ngx_file_size(&fi);\n    mtime = ngx_file_mtime(&fi);\n    ch = name->data[name->len - 4];\n    name->data[name->len - 4] = \'\\0\';\n    if (ngx_file_info(name->data, &fi) == NGX_FILE_ERROR) {\n        ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,\n                           ngx_file_info_n " \\"%s\\" failed", name->data);\n        goto failed;\n    }\n    name->data[name->len - 4] = ch;\n    if (mtime < ngx_file_mtime(&fi)) {\n        ngx_conf_log_error(NGX_LOG_WARN, cf, 0,\n                           "stale binary geo range base \\"%s\\"", name->data);\n        goto failed;\n    }\n    base = ngx_palloc(ctx->pool, size);\n    if (base == NULL) {\n        goto failed;\n    }\n    n = ngx_read_file(&file, base, size, 0);\n    if (n == NGX_ERROR) {\n        ngx_conf_log_error(NGX_LOG_CRIT, cf, ngx_errno,\n                           ngx_read_file_n " \\"%s\\" failed", name->data);\n        goto failed;\n    }\n    if ((size_t) n != size) {\n        ngx_conf_log_error(NGX_LOG_CRIT, cf, 0,\n            ngx_read_file_n " \\"%s\\" returned only %z bytes instead of %z",\n            name->data, n, size);\n        goto failed;\n    }\n    header = (ngx_http_geo_header_t *) base;\n    if (size < 16 || ngx_memcmp(&ngx_http_geo_header, header, 12) != 0) {\n        ngx_conf_log_error(NGX_LOG_WARN, cf, 0,\n             "incompatible binary geo range base \\"%s\\"", name->data);\n        goto failed;\n    }\n    ngx_crc32_init(crc32);\n    vv = (ngx_http_variable_value_t *) (base + sizeof(ngx_http_geo_header_t));\n    while (vv->data) {\n        len = ngx_align(sizeof(ngx_http_variable_value_t) + vv->len,\n                        sizeof(void *));\n        ngx_crc32_update(&crc32, (u_char *) vv, len);\n        vv->data += (size_t) base;\n        vv = (ngx_http_variable_value_t *) ((u_char *) vv + len);\n    }\n    ngx_crc32_update(&crc32, (u_char *) vv, sizeof(ngx_http_variable_value_t));\n    vv++;\n    ranges = (ngx_http_geo_range_t **) vv;\n    for (i = 0; i < 0x10000; i++) {\n        ngx_crc32_update(&crc32, (u_char *) &ranges[i], sizeof(void *));\n        if (ranges[i]) {\n            ranges[i] = (ngx_http_geo_range_t *)\n                            ((u_char *) ranges[i] + (size_t) base);\n        }\n    }\n    range = (ngx_http_geo_range_t *) &ranges[0x10000];\n    while ((u_char *) range < base + size) {\n        while (range->value) {\n            ngx_crc32_update(&crc32, (u_char *) range,\n                             sizeof(ngx_http_geo_range_t));\n            range->value = (ngx_http_variable_value_t *)\n                               ((u_char *) range->value + (size_t) base);\n            range++;\n        }\n        ngx_crc32_update(&crc32, (u_char *) range, sizeof(void *));\n        range = (ngx_http_geo_range_t *) ((u_char *) range + sizeof(void *));\n    }\n    ngx_crc32_final(crc32);\n    if (crc32 != header->crc32) {\n        ngx_conf_log_error(NGX_LOG_WARN, cf, 0,\n                  "CRC32 mismatch in binary geo range base \\"%s\\"", name->data);\n        goto failed;\n    }\n    ngx_conf_log_error(NGX_LOG_NOTICE, cf, 0,\n                       "using binary geo range base \\"%s\\"", name->data);\n    ctx->include_name = *name;\n    ctx->binary_include = 1;\n    ctx->high.low = ranges;\n    rc = NGX_OK;\n    goto done;\nfailed:\n    rc = NGX_DECLINED;\ndone:\n    if (ngx_close_file(file.fd) == NGX_FILE_ERROR) {\n        ngx_log_error(NGX_LOG_ALERT, cf->log, ngx_errno,\n                      ngx_close_file_n " \\"%s\\" failed", name->data);\n    }\n    return rc;\n}']