src/core/ngx_file.c:214: error: Buffer Overrun S2
  Offset: [`path->name.len` + 1, +oo] Size: [0, +oo] by call to `ngx_create_path`.

src/core/ngx_file.c:132:1: Parameter `path->level[*]`
130. 
131. 
132. ngx_int_t
     ^
133. ngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,
134.     ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)

src/core/ngx_file.c:214:13: Call
212.         }
213. 
214.         if (ngx_create_path(file, path) == NGX_ERROR) {
                 ^
215.             return NGX_ERROR;
216.         }

src/core/ngx_file.c:246:1: <Offset trace>
244. 
245. 
246. ngx_int_t
     ^
247. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
248. {

src/core/ngx_file.c:246:1: Parameter `path->level[*]`
  244. 
  245. 
  246. ngx_int_t
       ^
  247. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
  248. {

src/core/ngx_file.c:260:9: Assignment
  258.         }
  259. 
  260.         pos += path->level[i] + 1;
               ^
  261. 
  262.         file->name.data[pos] = '\0';

src/core/ngx_file.c:246:1: <Length trace>
244. 
245. 
246. ngx_int_t
     ^
247. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
248. {

src/core/ngx_file.c:246:1: Parameter `*file->name.data`
  244. 
  245. 
  246. ngx_int_t
       ^
  247. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
  248. {

src/core/ngx_file.c:277:9: Array access: Offset: [path->name.len + 1, +oo] Size: [0, +oo] by call to `ngx_create_path` 
  275.         }
  276. 
  277.         file->name.data[pos] = '/';
               ^
  278.     }
  279. 

ngx_int_t
ngx_create_path(ngx_file_t *file, ngx_path_t *path)
{
    size_t      pos;
    ngx_err_t   err;
    ngx_uint_t  i;
    pos = path->name.len;
    for (i = 0; i < 3; i++) {
        if (path->level[i] == 0) {
            break;
        }
        pos += path->level[i] + 1;
        file->name.data[pos] = '\0';
        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,
                       "temp file: \"%s\"", file->name.data);
        if (ngx_create_dir(file->name.data, 0700) == NGX_FILE_ERROR) {
            err = ngx_errno;
            if (err != NGX_EEXIST) {
                ngx_log_error(NGX_LOG_CRIT, file->log, err,
                              ngx_create_dir_n " \"%s\" failed",
                              file->name.data);
                return NGX_ERROR;
            }
        }
        file->name.data[pos] = '/';
    }
    return NGX_OK;
}
['ngx_int_t\nngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,\n    ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)\n{\n    u_char                   *p;\n    uint32_t                  n;\n    ngx_err_t                 err;\n    ngx_str_t                 prefix;\n    ngx_pool_cleanup_t       *cln;\n    ngx_pool_cleanup_file_t  *clnf;\n    prefix = path ? path->name : file->name;\n    file->name.len = prefix.len + 1 + (path ? path->len : 0) + 10;\n    file->name.data = ngx_pnalloc(pool, file->name.len + 1);\n    if (file->name.data == NULL) {\n        return NGX_ERROR;\n    }\n#if 0\n    for (i = 0; i < file->name.len; i++) {\n         file->name.data[i] = \'X\';\n    }\n#endif\n    p = ngx_cpymem(file->name.data, prefix.data, prefix.len);\n    if (path) {\n        p += 1 + path->len;\n    } else {\n        *p++ = \'.\';\n    }\n    n = (uint32_t) ngx_next_temp_number(0);\n    cln = ngx_pool_cleanup_add(pool, sizeof(ngx_pool_cleanup_file_t));\n    if (cln == NULL) {\n        return NGX_ERROR;\n    }\n    for ( ;; ) {\n        (void) ngx_sprintf(p, "%010uD%Z", n);\n        if (path) {\n            ngx_create_hashed_filename(path, file->name.data, file->name.len);\n        }\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "hashed path: %s", file->name.data);\n        file->fd = ngx_open_tempfile(file->name.data, persistent, access);\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "temp fd:%d", file->fd);\n        if (file->fd != NGX_INVALID_FILE) {\n            cln->handler = clean ? ngx_pool_delete_file : ngx_pool_cleanup_file;\n            clnf = cln->data;\n            clnf->fd = file->fd;\n            clnf->name = file->name.data;\n            clnf->log = pool->log;\n            return NGX_OK;\n        }\n        err = ngx_errno;\n        if (err == NGX_EEXIST) {\n            n = (uint32_t) ngx_next_temp_number(1);\n            continue;\n        }\n        if ((path == NULL) || (path->level[0] == 0) || (err != NGX_ENOPATH)) {\n            ngx_log_error(NGX_LOG_CRIT, file->log, err,\n                          ngx_open_tempfile_n " \\"%s\\" failed",\n                          file->name.data);\n            return NGX_ERROR;\n        }\n        if (ngx_create_path(file, path) == NGX_ERROR) {\n            return NGX_ERROR;\n        }\n    }\n}', 'ngx_int_t\nngx_create_path(ngx_file_t *file, ngx_path_t *path)\n{\n    size_t      pos;\n    ngx_err_t   err;\n    ngx_uint_t  i;\n    pos = path->name.len;\n    for (i = 0; i < 3; i++) {\n        if (path->level[i] == 0) {\n            break;\n        }\n        pos += path->level[i] + 1;\n        file->name.data[pos] = \'\\0\';\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "temp file: \\"%s\\"", file->name.data);\n        if (ngx_create_dir(file->name.data, 0700) == NGX_FILE_ERROR) {\n            err = ngx_errno;\n            if (err != NGX_EEXIST) {\n                ngx_log_error(NGX_LOG_CRIT, file->log, err,\n                              ngx_create_dir_n " \\"%s\\" failed",\n                              file->name.data);\n                return NGX_ERROR;\n            }\n        }\n        file->name.data[pos] = \'/\';\n    }\n    return NGX_OK;\n}']