src/core/ngx_file.c:196: error: Buffer Overrun S2
  Offset: [`path->len` + `path->name.len`, `path->len` + `path->name.len`] Size: [0, +oo] by call to `ngx_create_hashed_filename`.

src/core/ngx_file.c:140:1: Parameter `path->len`
138. 
139. 
140. ngx_int_t
     ^
141. ngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,
142.     ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)

src/core/ngx_file.c:196:13: Call
194. 
195.         if (!prefix) {
196.             ngx_create_hashed_filename(path, file->name.data, file->name.len);
                 ^
197.         }
198. 

src/core/ngx_file.c:240:1: <Offset trace>
238. 
239. 
240. void
     ^
241. ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
242. {

src/core/ngx_file.c:240:1: Parameter `path->len`
  238. 
  239. 
  240. void
       ^
  241. ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
  242. {

src/core/ngx_file.c:240:1: <Length trace>
238. 
239. 
240. void
     ^
241. ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
242. {

src/core/ngx_file.c:240:1: Parameter `*file`
  238. 
  239. 
  240. void
       ^
  241. ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
  242. {

src/core/ngx_file.c:248:5: Array access: Offset: [path->len + path->name.len, path->len + path->name.len] Size: [0, +oo] by call to `ngx_create_hashed_filename` 
  246.     i = path->name.len + 1;
  247. 
  248.     file[path->name.len + path->len]  = '/';
           ^
  249. 
  250.     for (n = 0; n < NGX_MAX_PATH_LEVEL; n++) {

void
ngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)
{
    size_t      i, level;
    ngx_uint_t  n;
    i = path->name.len + 1;
    file[path->name.len + path->len]  = '/';
    for (n = 0; n < NGX_MAX_PATH_LEVEL; n++) {
        level = path->level[n];
        if (level == 0) {
            break;
        }
        len -= level;
        file[i - 1] = '/';
        ngx_memcpy(&file[i], &file[len], level);
        i += level + 1;
    }
}
['ngx_int_t\nngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,\n    ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)\n{\n    size_t                    levels;\n    u_char                   *p;\n    uint32_t                  n;\n    ngx_err_t                 err;\n    ngx_str_t                 name;\n    ngx_uint_t                prefix;\n    ngx_pool_cleanup_t       *cln;\n    ngx_pool_cleanup_file_t  *clnf;\n    if (file->name.len) {\n        name = file->name;\n        levels = 0;\n        prefix = 1;\n    } else {\n        name = path->name;\n        levels = path->len;\n        prefix = 0;\n    }\n    file->name.len = name.len + 1 + levels + 10;\n    file->name.data = ngx_pnalloc(pool, file->name.len + 1);\n    if (file->name.data == NULL) {\n        return NGX_ERROR;\n    }\n#if 0\n    for (i = 0; i < file->name.len; i++) {\n        file->name.data[i] = \'X\';\n    }\n#endif\n    p = ngx_cpymem(file->name.data, name.data, name.len);\n    if (prefix) {\n        *p = \'.\';\n    }\n    p += 1 + levels;\n    n = (uint32_t) ngx_next_temp_number(0);\n    cln = ngx_pool_cleanup_add(pool, sizeof(ngx_pool_cleanup_file_t));\n    if (cln == NULL) {\n        return NGX_ERROR;\n    }\n    for ( ;; ) {\n        (void) ngx_sprintf(p, "%010uD%Z", n);\n        if (!prefix) {\n            ngx_create_hashed_filename(path, file->name.data, file->name.len);\n        }\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "hashed path: %s", file->name.data);\n        file->fd = ngx_open_tempfile(file->name.data, persistent, access);\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "temp fd:%d", file->fd);\n        if (file->fd != NGX_INVALID_FILE) {\n            cln->handler = clean ? ngx_pool_delete_file : ngx_pool_cleanup_file;\n            clnf = cln->data;\n            clnf->fd = file->fd;\n            clnf->name = file->name.data;\n            clnf->log = pool->log;\n            return NGX_OK;\n        }\n        err = ngx_errno;\n        if (err == NGX_EEXIST_FILE) {\n            n = (uint32_t) ngx_next_temp_number(1);\n            continue;\n        }\n        if ((path->level[0] == 0) || (err != NGX_ENOPATH)) {\n            ngx_log_error(NGX_LOG_CRIT, file->log, err,\n                          ngx_open_tempfile_n " \\"%s\\" failed",\n                          file->name.data);\n            return NGX_ERROR;\n        }\n        if (ngx_create_path(file, path) == NGX_ERROR) {\n            return NGX_ERROR;\n        }\n    }\n}', "void\nngx_create_hashed_filename(ngx_path_t *path, u_char *file, size_t len)\n{\n    size_t      i, level;\n    ngx_uint_t  n;\n    i = path->name.len + 1;\n    file[path->name.len + path->len]  = '/';\n    for (n = 0; n < NGX_MAX_PATH_LEVEL; n++) {\n        level = path->level[n];\n        if (level == 0) {\n            break;\n        }\n        len -= level;\n        file[i - 1] = '/';\n        ngx_memcpy(&file[i], &file[len], level);\n        i += level + 1;\n    }\n}"]