src/http/modules/ngx_http_limit_req_module.c:259: error: Buffer Overrun L3
  Offset: [-10, +oo] Size: 2048 by call to `ngx_log_error_core`.

src/http/modules/ngx_http_limit_req_module.c:253:13: Call
251.     }
252. 
253.     delay = ngx_http_limit_req_account(limits, n, &excess, &limit);
                 ^
254. 
255.     if (!delay) {

src/http/modules/ngx_http_limit_req_module.c:522:9: Assignment
  520.         ngx_shmtx_unlock(&ctx->shpool->mutex);
  521. 
  522.         ctx->node = NULL;
               ^
  523. 
  524.         if (limits[n].nodelay) {

src/http/modules/ngx_http_limit_req_module.c:259:5: Call
257.     }
258. 
259.     ngx_log_error(lrcf->delay_log_level, r->connection->log, 0,
         ^
260.                   "delaying request, excess: %ui.%03ui, by zone \"%V\"",
261.                   excess / 1000, excess % 1000, &limit->shm_zone->shm.name);

src/core/ngx_log.c:76:1: Global `err_levels.len`
  74. #if (NGX_HAVE_VARIADIC_MACROS)
  75. 
  76. void
      ^
  77. ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
  78.     const char *fmt, ...)

src/core/ngx_log.c:152:5: Assignment
  150.     }
  151. 
  152.     msg -= (7 + err_levels[level].len + 3);
           ^
  153. 
  154.     (void) ngx_sprintf(msg, "nginx: [%V] ", &err_levels[level]);

src/core/ngx_log.c:154:12: Call
  152.     msg -= (7 + err_levels[level].len + 3);
  153. 
  154.     (void) ngx_sprintf(msg, "nginx: [%V] ", &err_levels[level]);
                  ^
  155. 
  156.     (void) ngx_write_console(ngx_stderr, msg, p - msg);

src/core/ngx_string.c:102:1: Parameter `*buf`
    100. 
    101. 
    102. u_char * ngx_cdecl
         ^
    103. ngx_sprintf(u_char *buf, const char *fmt, ...)
    104. {

src/core/ngx_string.c:109:9: Call
    107. 
    108.     va_start(args, fmt);
    109.     p = ngx_vslprintf(buf, (void *) -1, fmt, args);
                 ^
    110.     va_end(args);
    111. 

src/core/ngx_string.c:144:1: <Length trace>
142. 
143. 
144. u_char *
     ^
145. ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
146. {

src/core/ngx_string.c:144:1: Parameter `*buf`
      142. 
      143. 
      144. u_char *
           ^
      145. ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
      146. {

src/core/ngx_string.c:363:21: Array access: Offset: [-10, +oo] Size: 2048 by call to `ngx_log_error_core` 
      361. 
      362.                 if (f < 0) {
      363.                     *buf++ = '-';
                               ^
      364.                     f = -f;
      365.                 }

u_char *
ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
{
    u_char                *p, zero;
    int                    d;
    double                 f, scale;
    size_t                 len, slen;
    int64_t                i64;
    uint64_t               ui64;
    ngx_msec_t             ms;
    ngx_uint_t             width, sign, hex, max_width, frac_width, n;
    ngx_str_t             *v;
    ngx_variable_value_t  *vv;
    while (*fmt && buf < last) {
        if (*fmt == '%') {
            i64 = 0;
            ui64 = 0;
            zero = (u_char) ((*++fmt == '0') ? '0' : ' ');
            width = 0;
            sign = 1;
            hex = 0;
            max_width = 0;
            frac_width = 0;
            slen = (size_t) -1;
            while (*fmt >= '0' && *fmt <= '9') {
                width = width * 10 + *fmt++ - '0';
            }
            for ( ;; ) {
                switch (*fmt) {
                case 'u':
                    sign = 0;
                    fmt++;
                    continue;
                case 'm':
                    max_width = 1;
                    fmt++;
                    continue;
                case 'X':
                    hex = 2;
                    sign = 0;
                    fmt++;
                    continue;
                case 'x':
                    hex = 1;
                    sign = 0;
                    fmt++;
                    continue;
                case '.':
                    fmt++;
                    while (*fmt >= '0' && *fmt <= '9') {
                        frac_width = frac_width * 10 + *fmt++ - '0';
                    }
                    break;
                case '*':
                    slen = va_arg(args, size_t);
                    fmt++;
                    continue;
                default:
                    break;
                }
                break;
            }
            switch (*fmt) {
            case 'V':
                v = va_arg(args, ngx_str_t *);
                len = ngx_min(((size_t) (last - buf)), v->len);
                buf = ngx_cpymem(buf, v->data, len);
                fmt++;
                continue;
            case 'v':
                vv = va_arg(args, ngx_variable_value_t *);
                len = ngx_min(((size_t) (last - buf)), vv->len);
                buf = ngx_cpymem(buf, vv->data, len);
                fmt++;
                continue;
            case 's':
                p = va_arg(args, u_char *);
                if (slen == (size_t) -1) {
                    while (*p && buf < last) {
                        *buf++ = *p++;
                    }
                } else {
                    len = ngx_min(((size_t) (last - buf)), slen);
                    buf = ngx_cpymem(buf, p, len);
                }
                fmt++;
                continue;
            case 'O':
                i64 = (int64_t) va_arg(args, off_t);
                sign = 1;
                break;
            case 'P':
                i64 = (int64_t) va_arg(args, ngx_pid_t);
                sign = 1;
                break;
            case 'T':
                i64 = (int64_t) va_arg(args, time_t);
                sign = 1;
                break;
            case 'M':
                ms = (ngx_msec_t) va_arg(args, ngx_msec_t);
                if ((ngx_msec_int_t) ms == -1) {
                    sign = 1;
                    i64 = -1;
                } else {
                    sign = 0;
                    ui64 = (uint64_t) ms;
                }
                break;
            case 'z':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ssize_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, size_t);
                }
                break;
            case 'i':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ngx_int_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, ngx_uint_t);
                }
                if (max_width) {
                    width = NGX_INT_T_LEN;
                }
                break;
            case 'd':
                if (sign) {
                    i64 = (int64_t) va_arg(args, int);
                } else {
                    ui64 = (uint64_t) va_arg(args, u_int);
                }
                break;
            case 'l':
                if (sign) {
                    i64 = (int64_t) va_arg(args, long);
                } else {
                    ui64 = (uint64_t) va_arg(args, u_long);
                }
                break;
            case 'D':
                if (sign) {
                    i64 = (int64_t) va_arg(args, int32_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, uint32_t);
                }
                break;
            case 'L':
                if (sign) {
                    i64 = va_arg(args, int64_t);
                } else {
                    ui64 = va_arg(args, uint64_t);
                }
                break;
            case 'A':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ngx_atomic_int_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, ngx_atomic_uint_t);
                }
                if (max_width) {
                    width = NGX_ATOMIC_T_LEN;
                }
                break;
            case 'f':
                f = va_arg(args, double);
                if (f < 0) {
                    *buf++ = '-';
                    f = -f;
                }
                ui64 = (int64_t) f;
                buf = ngx_sprintf_num(buf, last, ui64, zero, 0, width);
                if (frac_width) {
                    if (buf < last) {
                        *buf++ = '.';
                    }
                    scale = 1.0;
                    for (n = frac_width; n; n--) {
                        scale *= 10.0;
                    }
                    ui64 = (uint64_t) ((f - (int64_t) ui64) * scale + 0.5);
                    buf = ngx_sprintf_num(buf, last, ui64, '0', 0, frac_width);
                }
                fmt++;
                continue;
#if !(NGX_WIN32)
            case 'r':
                i64 = (int64_t) va_arg(args, rlim_t);
                sign = 1;
                break;
#endif
            case 'p':
                ui64 = (uintptr_t) va_arg(args, void *);
                hex = 2;
                sign = 0;
                zero = '0';
                width = NGX_PTR_SIZE * 2;
                break;
            case 'c':
                d = va_arg(args, int);
                *buf++ = (u_char) (d & 0xff);
                fmt++;
                continue;
            case 'Z':
                *buf++ = '\0';
                fmt++;
                continue;
            case 'N':
#if (NGX_WIN32)
                *buf++ = CR;
#endif
                *buf++ = LF;
                fmt++;
                continue;
            case '%':
                *buf++ = '%';
                fmt++;
                continue;
            default:
                *buf++ = *fmt++;
                continue;
            }
            if (sign) {
                if (i64 < 0) {
                    *buf++ = '-';
                    ui64 = (uint64_t) -i64;
                } else {
                    ui64 = (uint64_t) i64;
                }
            }
            buf = ngx_sprintf_num(buf, last, ui64, zero, hex, width);
            fmt++;
        } else {
            *buf++ = *fmt++;
        }
    }
    return buf;
}
['static ngx_int_t\nngx_http_limit_req_handler(ngx_http_request_t *r)\n{\n    size_t                       len;\n    uint32_t                     hash;\n    ngx_int_t                    rc;\n    ngx_uint_t                   n, excess;\n    ngx_msec_t                   delay;\n    ngx_http_variable_value_t   *vv;\n    ngx_http_limit_req_ctx_t    *ctx;\n    ngx_http_limit_req_conf_t   *lrcf;\n    ngx_http_limit_req_limit_t  *limit, *limits;\n    if (r->main->limit_req_set) {\n        return NGX_DECLINED;\n    }\n    lrcf = ngx_http_get_module_loc_conf(r, ngx_http_limit_req_module);\n    limits = lrcf->limits.elts;\n    excess = 0;\n    rc = NGX_DECLINED;\n    for (n = 0; n < lrcf->limits.nelts; n++) {\n        limit = &limits[n];\n        ctx = limit->shm_zone->data;\n        vv = ngx_http_get_indexed_variable(r, ctx->index);\n        if (vv == NULL || vv->not_found) {\n            continue;\n        }\n        len = vv->len;\n        if (len == 0) {\n            continue;\n        }\n        if (len > 65535) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "the value of the \\"%V\\" variable "\n                          "is more than 65535 bytes: \\"%v\\"",\n                          &ctx->var, vv);\n            continue;\n        }\n        hash = ngx_crc32_short(vv->data, len);\n        ngx_shmtx_lock(&ctx->shpool->mutex);\n        rc = ngx_http_limit_req_lookup(limit, hash, vv->data, len, &excess,\n                                       (n == lrcf->limits.nelts - 1));\n        ngx_shmtx_unlock(&ctx->shpool->mutex);\n        ngx_log_debug4(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "limit_req[%ui]: %i %ui.%03ui",\n                       n, rc, excess / 1000, excess % 1000);\n        if (rc != NGX_AGAIN) {\n            break;\n        }\n    }\n    if (rc == NGX_DECLINED) {\n        return NGX_DECLINED;\n    }\n    r->main->limit_req_set = 1;\n    if (rc == NGX_BUSY || rc == NGX_ERROR) {\n        if (rc == NGX_BUSY) {\n            ngx_log_error(lrcf->limit_log_level, r->connection->log, 0,\n                          "limiting requests, excess: %ui.%03ui by zone \\"%V\\"",\n                          excess / 1000, excess % 1000,\n                          &limit->shm_zone->shm.name);\n        }\n        while (n--) {\n            ctx = limits[n].shm_zone->data;\n            if (ctx->node == NULL) {\n                continue;\n            }\n            ngx_shmtx_lock(&ctx->shpool->mutex);\n            ctx->node->count--;\n            ngx_shmtx_unlock(&ctx->shpool->mutex);\n            ctx->node = NULL;\n        }\n        return NGX_HTTP_SERVICE_UNAVAILABLE;\n    }\n    if (rc == NGX_AGAIN) {\n        excess = 0;\n    }\n    delay = ngx_http_limit_req_account(limits, n, &excess, &limit);\n    if (!delay) {\n        return NGX_DECLINED;\n    }\n    ngx_log_error(lrcf->delay_log_level, r->connection->log, 0,\n                  "delaying request, excess: %ui.%03ui, by zone \\"%V\\"",\n                  excess / 1000, excess % 1000, &limit->shm_zone->shm.name);\n    if (ngx_handle_read_event(r->connection->read, 0) != NGX_OK) {\n        return NGX_HTTP_INTERNAL_SERVER_ERROR;\n    }\n    r->read_event_handler = ngx_http_test_reading;\n    r->write_event_handler = ngx_http_limit_req_delay;\n    ngx_add_timer(r->connection->write, delay);\n    return NGX_AGAIN;\n}', 'static ngx_msec_t\nngx_http_limit_req_account(ngx_http_limit_req_limit_t *limits, ngx_uint_t n,\n    ngx_uint_t *ep, ngx_http_limit_req_limit_t **limit)\n{\n    ngx_int_t                   excess;\n    ngx_time_t                 *tp;\n    ngx_msec_t                  now, delay, max_delay;\n    ngx_msec_int_t              ms;\n    ngx_http_limit_req_ctx_t   *ctx;\n    ngx_http_limit_req_node_t  *lr;\n    excess = *ep;\n    if (excess == 0 || (*limit)->nodelay) {\n        max_delay = 0;\n    } else {\n        ctx = (*limit)->shm_zone->data;\n        max_delay = excess * 1000 / ctx->rate;\n    }\n    while (n--) {\n        ctx = limits[n].shm_zone->data;\n        lr = ctx->node;\n        if (lr == NULL) {\n            continue;\n        }\n        ngx_shmtx_lock(&ctx->shpool->mutex);\n        tp = ngx_timeofday();\n        now = (ngx_msec_t) (tp->sec * 1000 + tp->msec);\n        ms = (ngx_msec_int_t) (now - lr->last);\n        excess = lr->excess - ctx->rate * ngx_abs(ms) / 1000 + 1000;\n        if (excess < 0) {\n            excess = 0;\n        }\n        lr->last = now;\n        lr->excess = excess;\n        lr->count--;\n        ngx_shmtx_unlock(&ctx->shpool->mutex);\n        ctx->node = NULL;\n        if (limits[n].nodelay) {\n            continue;\n        }\n        delay = excess * 1000 / ctx->rate;\n        if (delay > max_delay) {\n            max_delay = delay;\n            *ep = excess;\n            *limit = &limits[n];\n        }\n    }\n    return max_delay;\n}', 'void\nngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,\n    const char *fmt, ...)\n#else\nvoid\nngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,\n    const char *fmt, va_list args)\n#endif\n{\n#if (NGX_HAVE_VARIADIC_MACROS)\n    va_list  args;\n#endif\n    u_char  *p, *last, *msg;\n    u_char   errstr[NGX_MAX_ERROR_STR];\n    if (log->file->fd == NGX_INVALID_FILE) {\n        return;\n    }\n    last = errstr + NGX_MAX_ERROR_STR;\n    ngx_memcpy(errstr, ngx_cached_err_log_time.data,\n               ngx_cached_err_log_time.len);\n    p = errstr + ngx_cached_err_log_time.len;\n    p = ngx_slprintf(p, last, " [%V] ", &err_levels[level]);\n    p = ngx_slprintf(p, last, "%P#" NGX_TID_T_FMT ": ",\n                    ngx_log_pid, ngx_log_tid);\n    if (log->connection) {\n        p = ngx_slprintf(p, last, "*%uA ", log->connection);\n    }\n    msg = p;\n#if (NGX_HAVE_VARIADIC_MACROS)\n    va_start(args, fmt);\n    p = ngx_vslprintf(p, last, fmt, args);\n    va_end(args);\n#else\n    p = ngx_vslprintf(p, last, fmt, args);\n#endif\n    if (err) {\n        p = ngx_log_errno(p, last, err);\n    }\n    if (level != NGX_LOG_DEBUG && log->handler) {\n        p = log->handler(log, p, last - p);\n    }\n    if (p > last - NGX_LINEFEED_SIZE) {\n        p = last - NGX_LINEFEED_SIZE;\n    }\n    ngx_linefeed(p);\n    (void) ngx_write_fd(log->file->fd, errstr, p - errstr);\n    if (!ngx_use_stderr\n        || level > NGX_LOG_WARN\n        || log->file->fd == ngx_stderr)\n    {\n        return;\n    }\n    msg -= (7 + err_levels[level].len + 3);\n    (void) ngx_sprintf(msg, "nginx: [%V] ", &err_levels[level]);\n    (void) ngx_write_console(ngx_stderr, msg, p - msg);\n}', 'u_char * ngx_cdecl\nngx_sprintf(u_char *buf, const char *fmt, ...)\n{\n    u_char   *p;\n    va_list   args;\n    va_start(args, fmt);\n    p = ngx_vslprintf(buf, (void *) -1, fmt, args);\n    va_end(args);\n    return p;\n}', "u_char *\nngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)\n{\n    u_char                *p, zero;\n    int                    d;\n    double                 f, scale;\n    size_t                 len, slen;\n    int64_t                i64;\n    uint64_t               ui64;\n    ngx_msec_t             ms;\n    ngx_uint_t             width, sign, hex, max_width, frac_width, n;\n    ngx_str_t             *v;\n    ngx_variable_value_t  *vv;\n    while (*fmt && buf < last) {\n        if (*fmt == '%') {\n            i64 = 0;\n            ui64 = 0;\n            zero = (u_char) ((*++fmt == '0') ? '0' : ' ');\n            width = 0;\n            sign = 1;\n            hex = 0;\n            max_width = 0;\n            frac_width = 0;\n            slen = (size_t) -1;\n            while (*fmt >= '0' && *fmt <= '9') {\n                width = width * 10 + *fmt++ - '0';\n            }\n            for ( ;; ) {\n                switch (*fmt) {\n                case 'u':\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case 'm':\n                    max_width = 1;\n                    fmt++;\n                    continue;\n                case 'X':\n                    hex = 2;\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case 'x':\n                    hex = 1;\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case '.':\n                    fmt++;\n                    while (*fmt >= '0' && *fmt <= '9') {\n                        frac_width = frac_width * 10 + *fmt++ - '0';\n                    }\n                    break;\n                case '*':\n                    slen = va_arg(args, size_t);\n                    fmt++;\n                    continue;\n                default:\n                    break;\n                }\n                break;\n            }\n            switch (*fmt) {\n            case 'V':\n                v = va_arg(args, ngx_str_t *);\n                len = ngx_min(((size_t) (last - buf)), v->len);\n                buf = ngx_cpymem(buf, v->data, len);\n                fmt++;\n                continue;\n            case 'v':\n                vv = va_arg(args, ngx_variable_value_t *);\n                len = ngx_min(((size_t) (last - buf)), vv->len);\n                buf = ngx_cpymem(buf, vv->data, len);\n                fmt++;\n                continue;\n            case 's':\n                p = va_arg(args, u_char *);\n                if (slen == (size_t) -1) {\n                    while (*p && buf < last) {\n                        *buf++ = *p++;\n                    }\n                } else {\n                    len = ngx_min(((size_t) (last - buf)), slen);\n                    buf = ngx_cpymem(buf, p, len);\n                }\n                fmt++;\n                continue;\n            case 'O':\n                i64 = (int64_t) va_arg(args, off_t);\n                sign = 1;\n                break;\n            case 'P':\n                i64 = (int64_t) va_arg(args, ngx_pid_t);\n                sign = 1;\n                break;\n            case 'T':\n                i64 = (int64_t) va_arg(args, time_t);\n                sign = 1;\n                break;\n            case 'M':\n                ms = (ngx_msec_t) va_arg(args, ngx_msec_t);\n                if ((ngx_msec_int_t) ms == -1) {\n                    sign = 1;\n                    i64 = -1;\n                } else {\n                    sign = 0;\n                    ui64 = (uint64_t) ms;\n                }\n                break;\n            case 'z':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ssize_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, size_t);\n                }\n                break;\n            case 'i':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ngx_int_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, ngx_uint_t);\n                }\n                if (max_width) {\n                    width = NGX_INT_T_LEN;\n                }\n                break;\n            case 'd':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, int);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, u_int);\n                }\n                break;\n            case 'l':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, long);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, u_long);\n                }\n                break;\n            case 'D':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, int32_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, uint32_t);\n                }\n                break;\n            case 'L':\n                if (sign) {\n                    i64 = va_arg(args, int64_t);\n                } else {\n                    ui64 = va_arg(args, uint64_t);\n                }\n                break;\n            case 'A':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ngx_atomic_int_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, ngx_atomic_uint_t);\n                }\n                if (max_width) {\n                    width = NGX_ATOMIC_T_LEN;\n                }\n                break;\n            case 'f':\n                f = va_arg(args, double);\n                if (f < 0) {\n                    *buf++ = '-';\n                    f = -f;\n                }\n                ui64 = (int64_t) f;\n                buf = ngx_sprintf_num(buf, last, ui64, zero, 0, width);\n                if (frac_width) {\n                    if (buf < last) {\n                        *buf++ = '.';\n                    }\n                    scale = 1.0;\n                    for (n = frac_width; n; n--) {\n                        scale *= 10.0;\n                    }\n                    ui64 = (uint64_t) ((f - (int64_t) ui64) * scale + 0.5);\n                    buf = ngx_sprintf_num(buf, last, ui64, '0', 0, frac_width);\n                }\n                fmt++;\n                continue;\n#if !(NGX_WIN32)\n            case 'r':\n                i64 = (int64_t) va_arg(args, rlim_t);\n                sign = 1;\n                break;\n#endif\n            case 'p':\n                ui64 = (uintptr_t) va_arg(args, void *);\n                hex = 2;\n                sign = 0;\n                zero = '0';\n                width = NGX_PTR_SIZE * 2;\n                break;\n            case 'c':\n                d = va_arg(args, int);\n                *buf++ = (u_char) (d & 0xff);\n                fmt++;\n                continue;\n            case 'Z':\n                *buf++ = '\\0';\n                fmt++;\n                continue;\n            case 'N':\n#if (NGX_WIN32)\n                *buf++ = CR;\n#endif\n                *buf++ = LF;\n                fmt++;\n                continue;\n            case '%':\n                *buf++ = '%';\n                fmt++;\n                continue;\n            default:\n                *buf++ = *fmt++;\n                continue;\n            }\n            if (sign) {\n                if (i64 < 0) {\n                    *buf++ = '-';\n                    ui64 = (uint64_t) -i64;\n                } else {\n                    ui64 = (uint64_t) i64;\n                }\n            }\n            buf = ngx_sprintf_num(buf, last, ui64, zero, hex, width);\n            fmt++;\n        } else {\n            *buf++ = *fmt++;\n        }\n    }\n    return buf;\n}"]