src/http/modules/ngx_http_autoindex_module.c:907: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_html`.

src/http/modules/ngx_http_autoindex_module.c:872:5: Assignment
870.     }
871. 
872.     b->last = ngx_cpymem(b->last, head, sizeof(head) - 1);
         ^
873. 
874.     for (i = 0; i < entries->nelts; i++) {

src/http/modules/ngx_http_autoindex_module.c:907:34: Call
905. 
906.         if (entry[i].escape) {
907.             b->last = (u_char *) ngx_escape_html(b->last, entry[i].name.data,
                                      ^
908.                                                  entry[i].name.len);
909.         } else {

src/core/ngx_string.c:1704:1: <Length trace>
1702. 
1703. 
1704. uintptr_t
      ^
1705. ngx_escape_html(u_char *dst, u_char *src, size_t size)
1706. {

src/core/ngx_string.c:1704:1: Parameter `*dst`
  1702. 
  1703. 
  1704. uintptr_t
        ^
  1705. ngx_escape_html(u_char *dst, u_char *src, size_t size)
  1706. {

src/core/ngx_string.c:1748:14: Assignment
  1746. 
  1747.         case '<':
  1748.             *dst++ = '&'; *dst++ = 'l'; *dst++ = 't'; *dst++ = ';';
                     ^
  1749.             break;
  1750. 

src/core/ngx_string.c:1748:27: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_html` 
  1746. 
  1747.         case '<':
  1748.             *dst++ = '&'; *dst++ = 'l'; *dst++ = 't'; *dst++ = ';';
                                  ^
  1749.             break;
  1750. 

uintptr_t
ngx_escape_html(u_char *dst, u_char *src, size_t size)
{
    u_char      ch;
    ngx_uint_t  len;
    if (dst == NULL) {
        len = 0;
        while (size) {
            switch (*src++) {
            case '<':
                len += sizeof("&lt;") - 2;
                break;
            case '>':
                len += sizeof("&gt;") - 2;
                break;
            case '&':
                len += sizeof("&amp;") - 2;
                break;
            case '"':
                len += sizeof("&quot;") - 2;
                break;
            default:
                break;
            }
            size--;
        }
        return (uintptr_t) len;
    }
    while (size) {
        ch = *src++;
        switch (ch) {
        case '<':
            *dst++ = '&'; *dst++ = 'l'; *dst++ = 't'; *dst++ = ';';
            break;
        case '>':
            *dst++ = '&'; *dst++ = 'g'; *dst++ = 't'; *dst++ = ';';
            break;
        case '&':
            *dst++ = '&'; *dst++ = 'a'; *dst++ = 'm'; *dst++ = 'p';
            *dst++ = ';';
            break;
        case '"':
            *dst++ = '&'; *dst++ = 'q'; *dst++ = 'u'; *dst++ = 'o';
            *dst++ = 't'; *dst++ = ';';
            break;
        default:
            *dst++ = ch;
            break;
        }
        size--;
    }
    return (uintptr_t) dst;
}
['static ngx_buf_t *\nngx_http_autoindex_xml(ngx_http_request_t *r, ngx_array_t *entries)\n{\n    size_t                          len;\n    ngx_tm_t                        tm;\n    ngx_buf_t                      *b;\n    ngx_str_t                       type;\n    ngx_uint_t                      i;\n    ngx_http_autoindex_entry_t     *entry;\n    static u_char  head[] = "<?xml version=\\"1.0\\"?>" CRLF "<list>" CRLF;\n    static u_char  tail[] = "</list>" CRLF;\n    len = sizeof(head) - 1 + sizeof(tail) - 1;\n    entry = entries->elts;\n    for (i = 0; i < entries->nelts; i++) {\n        entry[i].escape = ngx_escape_html(NULL, entry[i].name.data,\n                                          entry[i].name.len);\n        len += sizeof("<directory></directory>" CRLF) - 1\n            + entry[i].name.len + entry[i].escape\n            + sizeof(" mtime=\\"1986-12-31T10:00:00Z\\"") - 1;\n        if (entry[i].file) {\n            len += sizeof(" size=\\"\\"") - 1 + NGX_OFF_T_LEN;\n        }\n    }\n    b = ngx_create_temp_buf(r->pool, len);\n    if (b == NULL) {\n        return NULL;\n    }\n    b->last = ngx_cpymem(b->last, head, sizeof(head) - 1);\n    for (i = 0; i < entries->nelts; i++) {\n        *b->last++ = \'<\';\n        if (entry[i].dir) {\n            ngx_str_set(&type, "directory");\n        } else if (entry[i].file) {\n            ngx_str_set(&type, "file");\n        } else {\n            ngx_str_set(&type, "other");\n        }\n        b->last = ngx_cpymem(b->last, type.data, type.len);\n        b->last = ngx_cpymem(b->last, " mtime=\\"", sizeof(" mtime=\\"") - 1);\n        ngx_gmtime(entry[i].mtime, &tm);\n        b->last = ngx_sprintf(b->last, "%4d-%02d-%02dT%02d:%02d:%02dZ",\n                              tm.ngx_tm_year, tm.ngx_tm_mon,\n                              tm.ngx_tm_mday, tm.ngx_tm_hour,\n                              tm.ngx_tm_min, tm.ngx_tm_sec);\n        if (entry[i].file) {\n            b->last = ngx_cpymem(b->last, "\\" size=\\"",\n                                 sizeof("\\" size=\\"") - 1);\n            b->last = ngx_sprintf(b->last, "%O", entry[i].size);\n        }\n        *b->last++ = \'"\'; *b->last++ = \'>\';\n        if (entry[i].escape) {\n            b->last = (u_char *) ngx_escape_html(b->last, entry[i].name.data,\n                                                 entry[i].name.len);\n        } else {\n            b->last = ngx_cpymem(b->last, entry[i].name.data,\n                                 entry[i].name.len);\n        }\n        *b->last++ = \'<\'; *b->last++ = \'/\';\n        b->last = ngx_cpymem(b->last, type.data, type.len);\n        *b->last++ = \'>\';\n        *b->last++ = CR; *b->last++ = LF;\n    }\n    b->last = ngx_cpymem(b->last, tail, sizeof(tail) - 1);\n    return b;\n}', 'uintptr_t\nngx_escape_html(u_char *dst, u_char *src, size_t size)\n{\n    u_char      ch;\n    ngx_uint_t  len;\n    if (dst == NULL) {\n        len = 0;\n        while (size) {\n            switch (*src++) {\n            case \'<\':\n                len += sizeof("&lt;") - 2;\n                break;\n            case \'>\':\n                len += sizeof("&gt;") - 2;\n                break;\n            case \'&\':\n                len += sizeof("&amp;") - 2;\n                break;\n            case \'"\':\n                len += sizeof("&quot;") - 2;\n                break;\n            default:\n                break;\n            }\n            size--;\n        }\n        return (uintptr_t) len;\n    }\n    while (size) {\n        ch = *src++;\n        switch (ch) {\n        case \'<\':\n            *dst++ = \'&\'; *dst++ = \'l\'; *dst++ = \'t\'; *dst++ = \';\';\n            break;\n        case \'>\':\n            *dst++ = \'&\'; *dst++ = \'g\'; *dst++ = \'t\'; *dst++ = \';\';\n            break;\n        case \'&\':\n            *dst++ = \'&\'; *dst++ = \'a\'; *dst++ = \'m\'; *dst++ = \'p\';\n            *dst++ = \';\';\n            break;\n        case \'"\':\n            *dst++ = \'&\'; *dst++ = \'q\'; *dst++ = \'u\'; *dst++ = \'o\';\n            *dst++ = \'t\'; *dst++ = \';\';\n            break;\n        default:\n            *dst++ = ch;\n            break;\n        }\n        size--;\n    }\n    return (uintptr_t) dst;\n}']