src/core/ngx_inet.c:1310: error: Buffer Overrun S2
  Offset: [`u->naddrs`, +oo] Size: [0, +oo].

src/core/ngx_inet.c:1262:1: <Offset trace>
1260. 
1261. 
1262. static ngx_int_t
      ^
1263. ngx_inet_add_addr(ngx_pool_t *pool, ngx_url_t *u, struct sockaddr *sockaddr,
1264.     socklen_t socklen, ngx_uint_t total)

src/core/ngx_inet.c:1262:1: Parameter `u->naddrs`
1260. 
1261. 
1262. static ngx_int_t
      ^
1263. ngx_inet_add_addr(ngx_pool_t *pool, ngx_url_t *u, struct sockaddr *sockaddr,
1264.     socklen_t socklen, ngx_uint_t total)

src/core/ngx_inet.c:1262:1: <Length trace>
1260. 
1261. 
1262. static ngx_int_t
      ^
1263. ngx_inet_add_addr(ngx_pool_t *pool, ngx_url_t *u, struct sockaddr *sockaddr,
1264.     socklen_t socklen, ngx_uint_t total)

src/core/ngx_inet.c:1262:1: Parameter `*u->addrs`
1260. 
1261. 
1262. static ngx_int_t
      ^
1263. ngx_inet_add_addr(ngx_pool_t *pool, ngx_url_t *u, struct sockaddr *sockaddr,
1264.     socklen_t socklen, ngx_uint_t total)

src/core/ngx_inet.c:1310:9: Array access: Offset: [u->naddrs, +oo] Size: [0, +oo]
1308.         len = ngx_sock_ntop(sa, socklen, p, len, 1);
1309. 
1310.         addr = &u->addrs[u->naddrs++];
              ^
1311. 
1312.         addr->sockaddr = sa;

static ngx_int_t
ngx_inet_add_addr(ngx_pool_t *pool, ngx_url_t *u, struct sockaddr *sockaddr,
    socklen_t socklen, ngx_uint_t total)
{
    u_char           *p;
    size_t            len;
    ngx_uint_t        i, nports;
    ngx_addr_t       *addr;
    struct sockaddr  *sa;
    nports = u->last_port ? u->last_port - u->port + 1 : 1;
    if (u->addrs == NULL) {
        u->addrs = ngx_palloc(pool, total * nports * sizeof(ngx_addr_t));
        if (u->addrs == NULL) {
            return NGX_ERROR;
        }
    }
    for (i = 0; i < nports; i++) {
        sa = ngx_pcalloc(pool, socklen);
        if (sa == NULL) {
            return NGX_ERROR;
        }
        ngx_memcpy(sa, sockaddr, socklen);
        ngx_inet_set_port(sa, u->port + i);
        switch (sa->sa_family) {
#if (NGX_HAVE_INET6)
        case AF_INET6:
            len = NGX_INET6_ADDRSTRLEN + sizeof("[]:65536") - 1;
            break;
#endif
        default:
            len = NGX_INET_ADDRSTRLEN + sizeof(":65535") - 1;
        }
        p = ngx_pnalloc(pool, len);
        if (p == NULL) {
            return NGX_ERROR;
        }
        len = ngx_sock_ntop(sa, socklen, p, len, 1);
        addr = &u->addrs[u->naddrs++];
        addr->sockaddr = sa;
        addr->socklen = socklen;
        addr->name.len = len;
        addr->name.data = p;
    }
    return NGX_OK;
}
['static ngx_int_t\nngx_inet_add_addr(ngx_pool_t *pool, ngx_url_t *u, struct sockaddr *sockaddr,\n    socklen_t socklen, ngx_uint_t total)\n{\n    u_char           *p;\n    size_t            len;\n    ngx_uint_t        i, nports;\n    ngx_addr_t       *addr;\n    struct sockaddr  *sa;\n    nports = u->last_port ? u->last_port - u->port + 1 : 1;\n    if (u->addrs == NULL) {\n        u->addrs = ngx_palloc(pool, total * nports * sizeof(ngx_addr_t));\n        if (u->addrs == NULL) {\n            return NGX_ERROR;\n        }\n    }\n    for (i = 0; i < nports; i++) {\n        sa = ngx_pcalloc(pool, socklen);\n        if (sa == NULL) {\n            return NGX_ERROR;\n        }\n        ngx_memcpy(sa, sockaddr, socklen);\n        ngx_inet_set_port(sa, u->port + i);\n        switch (sa->sa_family) {\n#if (NGX_HAVE_INET6)\n        case AF_INET6:\n            len = NGX_INET6_ADDRSTRLEN + sizeof("[]:65536") - 1;\n            break;\n#endif\n        default:\n            len = NGX_INET_ADDRSTRLEN + sizeof(":65535") - 1;\n        }\n        p = ngx_pnalloc(pool, len);\n        if (p == NULL) {\n            return NGX_ERROR;\n        }\n        len = ngx_sock_ntop(sa, socklen, p, len, 1);\n        addr = &u->addrs[u->naddrs++];\n        addr->sockaddr = sa;\n        addr->socklen = socklen;\n        addr->name.len = len;\n        addr->name.data = p;\n    }\n    return NGX_OK;\n}']