src/http/modules/ngx_http_ssi_filter_module.c:2330: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_ssi_filter_module.c:2243:1: Global `ngx_http_ssi_none.len`
2241. 
2242. 
2243. static ngx_int_t
      ^
2244. ngx_http_ssi_echo(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,
2245.     ngx_str_t **params)

src/http/modules/ngx_http_ssi_filter_module.c:2325:17: Call
2323. 
2324.         if (len) {
2325.             p = ngx_pnalloc(r->pool, value->len + len);
                      ^
2326.             if (p == NULL) {
2327.                 return NGX_HTTP_SSI_ERROR;

src/core/ngx_palloc.c:140:16: Call
  138. #if !(NGX_DEBUG_PALLOC)
  139.     if (size <= pool->max) {
  140.         return ngx_palloc_small(pool, size, 0);
                      ^
  141.     }
  142. #endif

src/core/ngx_palloc.c:157:9: Assignment
    155. 
    156.     do {
    157.         m = p->d.last;
                 ^
    158. 
    159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
    164.             p->d.last = m + size;
    165. 
    166.             return m;
                     ^
    167.         }
    168. 

src/core/ngx_palloc.c:140:9: Assignment
  138. #if !(NGX_DEBUG_PALLOC)
  139.     if (size <= pool->max) {
  140.         return ngx_palloc_small(pool, size, 0);
               ^
  141.     }
  142. #endif

src/http/modules/ngx_http_ssi_filter_module.c:2325:13: Assignment
2323. 
2324.         if (len) {
2325.             p = ngx_pnalloc(r->pool, value->len + len);
                  ^
2326.             if (p == NULL) {
2327.                 return NGX_HTTP_SSI_ERROR;

src/http/modules/ngx_http_ssi_filter_module.c:2330:20: Call
2328.             }
2329. 
2330.             (void) ngx_escape_uri(p, value->data, value->len, NGX_ESCAPE_HTML);
                         ^
2331.         }
2332. 

src/core/ngx_string.c:1424:1: <Length trace>
1422. 
1423. 
1424. uintptr_t
      ^
1425. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1426. {

src/core/ngx_string.c:1424:1: Parameter `*dst`
  1422. 
  1423. 
  1424. uintptr_t
        ^
  1425. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1426. {

src/core/ngx_string.c:1578:14: Assignment
  1576.     while (size) {
  1577.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1578.             *dst++ = '%';
                     ^
  1579.             *dst++ = hex[*src >> 4];
  1580.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1579:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1577.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1578.             *dst++ = '%';
  1579.             *dst++ = hex[*src >> 4];
                    ^
  1580.             *dst++ = hex[*src & 0xf];
  1581.             src++;

uintptr_t
ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
{
    ngx_uint_t      n;
    uint32_t       *escape;
    static u_char   hex[] = "0123456789ABCDEF";
    static uint32_t   uri[] = {
        0xffffffff,
        0x80000029,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   args[] = {
        0xffffffff,
        0x88000869,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   uri_component[] = {
        0xffffffff,
        0xfc009fff,
        0x78000001,
        0xb8000001,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   html[] = {
        0xffffffff,
        0x000000ad,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   refresh[] = {
        0xffffffff,
        0x00000085,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   memcached[] = {
        0xffffffff,
        0x00000021,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
    };
    static uint32_t  *map[] =
        { uri, args, uri_component, html, refresh, memcached, memcached };
    escape = map[type];
    if (dst == NULL) {
        n = 0;
        while (size) {
            if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
                n++;
            }
            src++;
            size--;
        }
        return (uintptr_t) n;
    }
    while (size) {
        if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
            *dst++ = '%';
            *dst++ = hex[*src >> 4];
            *dst++ = hex[*src & 0xf];
            src++;
        } else {
            *dst++ = *src++;
        }
        size--;
    }
    return (uintptr_t) dst;
}
['static ngx_int_t\nngx_http_ssi_echo(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,\n    ngx_str_t **params)\n{\n    u_char                     *p;\n    uintptr_t                   len;\n    ngx_int_t                   key;\n    ngx_buf_t                  *b;\n    ngx_str_t                  *var, *value, *enc, text;\n    ngx_chain_t                *cl;\n    ngx_http_variable_value_t  *vv;\n    var = params[NGX_HTTP_SSI_ECHO_VAR];\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "ssi echo \\"%V\\"", var);\n    key = ngx_hash_strlow(var->data, var->data, var->len);\n    value = ngx_http_ssi_get_variable(r, var, key);\n    if (value == NULL) {\n        vv = ngx_http_get_variable(r, var, key);\n        if (vv == NULL) {\n            return NGX_HTTP_SSI_ERROR;\n        }\n        if (!vv->not_found) {\n            text.data = vv->data;\n            text.len = vv->len;\n            value = &text;\n        }\n    }\n    if (value == NULL) {\n        value = params[NGX_HTTP_SSI_ECHO_DEFAULT];\n        if (value == NULL) {\n            value = &ngx_http_ssi_none;\n        } else if (value->len == 0) {\n            return NGX_OK;\n        }\n    } else {\n        if (value->len == 0) {\n            return NGX_OK;\n        }\n    }\n    enc = params[NGX_HTTP_SSI_ECHO_ENCODING];\n    if (enc) {\n        if (enc->len == 4 && ngx_strncmp(enc->data, "none", 4) == 0) {\n            ctx->encoding = NGX_HTTP_SSI_NO_ENCODING;\n        } else if (enc->len == 3 && ngx_strncmp(enc->data, "url", 3) == 0) {\n            ctx->encoding = NGX_HTTP_SSI_URL_ENCODING;\n        } else if (enc->len == 6 && ngx_strncmp(enc->data, "entity", 6) == 0) {\n            ctx->encoding = NGX_HTTP_SSI_ENTITY_ENCODING;\n        } else {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "unknown encoding \\"%V\\" in the \\"echo\\" command",\n                          enc);\n        }\n    }\n    p = value->data;\n    switch (ctx->encoding) {\n    case NGX_HTTP_SSI_URL_ENCODING:\n        len = 2 * ngx_escape_uri(NULL, value->data, value->len,\n                                 NGX_ESCAPE_HTML);\n        if (len) {\n            p = ngx_pnalloc(r->pool, value->len + len);\n            if (p == NULL) {\n                return NGX_HTTP_SSI_ERROR;\n            }\n            (void) ngx_escape_uri(p, value->data, value->len, NGX_ESCAPE_HTML);\n        }\n        len += value->len;\n        break;\n    case NGX_HTTP_SSI_ENTITY_ENCODING:\n        len = ngx_escape_html(NULL, value->data, value->len);\n        if (len) {\n            p = ngx_pnalloc(r->pool, value->len + len);\n            if (p == NULL) {\n                return NGX_HTTP_SSI_ERROR;\n            }\n            (void) ngx_escape_html(p, value->data, value->len);\n        }\n        len += value->len;\n        break;\n    default:\n        len = value->len;\n        break;\n    }\n    b = ngx_calloc_buf(r->pool);\n    if (b == NULL) {\n        return NGX_HTTP_SSI_ERROR;\n    }\n    cl = ngx_alloc_chain_link(r->pool);\n    if (cl == NULL) {\n        return NGX_HTTP_SSI_ERROR;\n    }\n    b->memory = 1;\n    b->pos = p;\n    b->last = p + len;\n    cl->buf = b;\n    cl->next = NULL;\n    *ctx->last_out = cl;\n    ctx->last_out = &cl->next;\n    return NGX_OK;\n}', 'void *\nngx_pnalloc(ngx_pool_t *pool, size_t size)\n{\n#if !(NGX_DEBUG_PALLOC)\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 0);\n    }\n#endif\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}', 'uintptr_t\nngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)\n{\n    ngx_uint_t      n;\n    uint32_t       *escape;\n    static u_char   hex[] = "0123456789ABCDEF";\n    static uint32_t   uri[] = {\n        0xffffffff,\n        0x80000029,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   args[] = {\n        0xffffffff,\n        0x88000869,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   uri_component[] = {\n        0xffffffff,\n        0xfc009fff,\n        0x78000001,\n        0xb8000001,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   html[] = {\n        0xffffffff,\n        0x000000ad,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   refresh[] = {\n        0xffffffff,\n        0x00000085,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   memcached[] = {\n        0xffffffff,\n        0x00000021,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n    };\n    static uint32_t  *map[] =\n        { uri, args, uri_component, html, refresh, memcached, memcached };\n    escape = map[type];\n    if (dst == NULL) {\n        n = 0;\n        while (size) {\n            if (escape[*src >> 5] & (1 << (*src & 0x1f))) {\n                n++;\n            }\n            src++;\n            size--;\n        }\n        return (uintptr_t) n;\n    }\n    while (size) {\n        if (escape[*src >> 5] & (1 << (*src & 0x1f))) {\n            *dst++ = \'%\';\n            *dst++ = hex[*src >> 4];\n            *dst++ = hex[*src & 0xf];\n            src++;\n        } else {\n            *dst++ = *src++;\n        }\n        size--;\n    }\n    return (uintptr_t) dst;\n}']