src/http/ngx_http_request.c:471: error: Buffer Overrun L3
  Offset: [11, +oo] Size: [0, +oo] by call to `ngx_proxy_protocol_read`.

src/http/ngx_http_request.c:403:5: Assignment
401.     cscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_core_module);
402. 
403.     size = cscf->client_header_buffer_size;
         ^
404. 
405.     b = c->buffer;

src/http/ngx_http_request.c:408:13: Call
406. 
407.     if (b == NULL) {
408.         b = ngx_create_temp_buf(c->pool, size);
                 ^
409.         if (b == NULL) {
410.             ngx_http_close_connection(c);

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:127:16: Call
    125. #if !(NGX_DEBUG_PALLOC)
    126.     if (size <= pool->max) {
    127.         return ngx_palloc_small(pool, size, 1);
                        ^
    128.     }
    129. #endif

src/core/ngx_palloc.c:157:9: Assignment
      155. 
      156.     do {
      157.         m = p->d.last;
                   ^
      158. 
      159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
      164.             p->d.last = m + size;
      165. 
      166.             return m;
                       ^
      167.         }
      168. 

src/core/ngx_palloc.c:127:9: Assignment
    125. #if !(NGX_DEBUG_PALLOC)
    126.     if (size <= pool->max) {
    127.         return ngx_palloc_small(pool, size, 1);
                 ^
    128.     }
    129. #endif

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:38:5: Assignment
  36.      */
  37. 
  38.     b->pos = b->start;
          ^
  39.     b->last = b->start;
  40.     b->end = b->last + size;

src/http/ngx_http_request.c:471:13: Call
469.         hc->proxy_protocol = 0;
470. 
471.         p = ngx_proxy_protocol_read(c, b->pos, b->last);
                 ^
472. 
473.         if (p == NULL) {

src/core/ngx_proxy_protocol.c:51:1: Parameter `*buf`
  49. 
  50. 
  51. u_char *
      ^
  52. ngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)
  53. {

src/core/ngx_proxy_protocol.c:60:5: Assignment
  58.     static const u_char signature[] = "\r\n\r\n\0\r\nQUIT\n";
  59. 
  60.     p = buf;
          ^
  61.     len = last - buf;
  62. 

src/core/ngx_proxy_protocol.c:73:5: Assignment
  71.     }
  72. 
  73.     p += 6;
          ^
  74.     len -= 6;
  75. 

src/core/ngx_proxy_protocol.c:89:5: Assignment
  87.     }
  88. 
  89.     p += 5;
          ^
  90. 
  91.     pp = ngx_pcalloc(c->pool, sizeof(ngx_proxy_protocol_t));

src/core/ngx_proxy_protocol.c:96:9: Call
  94.     }
  95. 
  96.     p = ngx_proxy_protocol_read_addr(c, p, last, &pp->src_addr);
              ^
  97.     if (p == NULL) {
  98.         goto invalid;

src/core/ngx_proxy_protocol.c:149:1: <Length trace>
147. 
148. 
149. static u_char *
     ^
150. ngx_proxy_protocol_read_addr(ngx_connection_t *c, u_char *p, u_char *last,
151.     ngx_str_t *addr)

src/core/ngx_proxy_protocol.c:149:1: Parameter `*p`
    147. 
    148. 
    149. static u_char *
         ^
    150. ngx_proxy_protocol_read_addr(ngx_connection_t *c, u_char *p, u_char *last,
    151.     ngx_str_t *addr)

src/core/ngx_proxy_protocol.c:163:14: Array access: Offset: [11, +oo] Size: [0, +oo] by call to `ngx_proxy_protocol_read` 
    161.         }
    162. 
    163.         ch = *p++;
                      ^
    164. 
    165.         if (ch == ' ') {

static u_char *
ngx_proxy_protocol_read_addr(ngx_connection_t *c, u_char *p, u_char *last,
    ngx_str_t *addr)
{
    size_t  len;
    u_char  ch, *pos;
    pos = p;
    for ( ;; ) {
        if (p == last) {
            return NULL;
        }
        ch = *p++;
        if (ch == ' ') {
            break;
        }
        if (ch != ':' && ch != '.'
            && (ch < 'a' || ch > 'f')
            && (ch < 'A' || ch > 'F')
            && (ch < '0' || ch > '9'))
        {
            return NULL;
        }
    }
    len = p - pos - 1;
    addr->data = ngx_pnalloc(c->pool, len);
    if (addr->data == NULL) {
        return NULL;
    }
    ngx_memcpy(addr->data, pos, len);
    addr->len = len;
    return p;
}
['static void\nngx_http_wait_request_handler(ngx_event_t *rev)\n{\n    u_char                    *p;\n    size_t                     size;\n    ssize_t                    n;\n    ngx_buf_t                 *b;\n    ngx_connection_t          *c;\n    ngx_http_connection_t     *hc;\n    ngx_http_core_srv_conf_t  *cscf;\n    c = rev->data;\n    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http wait request handler");\n    if (rev->timedout) {\n        ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT, "client timed out");\n        ngx_http_close_connection(c);\n        return;\n    }\n    if (c->close) {\n        ngx_http_close_connection(c);\n        return;\n    }\n    hc = c->data;\n    cscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_core_module);\n    size = cscf->client_header_buffer_size;\n    b = c->buffer;\n    if (b == NULL) {\n        b = ngx_create_temp_buf(c->pool, size);\n        if (b == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        c->buffer = b;\n    } else if (b->start == NULL) {\n        b->start = ngx_palloc(c->pool, size);\n        if (b->start == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        b->pos = b->start;\n        b->last = b->start;\n        b->end = b->last + size;\n    }\n    n = c->recv(c, b->last, size);\n    if (n == NGX_AGAIN) {\n        if (!rev->timer_set) {\n            ngx_add_timer(rev, c->listening->post_accept_timeout);\n            ngx_reusable_connection(c, 1);\n        }\n        if (ngx_handle_read_event(rev, 0) != NGX_OK) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        if (ngx_pfree(c->pool, b->start) == NGX_OK) {\n            b->start = NULL;\n        }\n        return;\n    }\n    if (n == NGX_ERROR) {\n        ngx_http_close_connection(c);\n        return;\n    }\n    if (n == 0) {\n        ngx_log_error(NGX_LOG_INFO, c->log, 0,\n                      "client closed connection");\n        ngx_http_close_connection(c);\n        return;\n    }\n    b->last += n;\n    if (hc->proxy_protocol) {\n        hc->proxy_protocol = 0;\n        p = ngx_proxy_protocol_read(c, b->pos, b->last);\n        if (p == NULL) {\n            ngx_http_close_connection(c);\n            return;\n        }\n        b->pos = p;\n        if (b->pos == b->last) {\n            c->log->action = "waiting for request";\n            b->pos = b->start;\n            b->last = b->start;\n            ngx_post_event(rev, &ngx_posted_events);\n            return;\n        }\n    }\n    c->log->action = "reading client request line";\n    ngx_reusable_connection(c, 0);\n    c->data = ngx_http_create_request(c);\n    if (c->data == NULL) {\n        ngx_http_close_connection(c);\n        return;\n    }\n    rev->handler = ngx_http_process_request_line;\n    ngx_http_process_request_line(rev);\n}', 'ngx_buf_t *\nngx_create_temp_buf(ngx_pool_t *pool, size_t size)\n{\n    ngx_buf_t *b;\n    b = ngx_calloc_buf(pool);\n    if (b == NULL) {\n        return NULL;\n    }\n    b->start = ngx_palloc(pool, size);\n    if (b->start == NULL) {\n        return NULL;\n    }\n    b->pos = b->start;\n    b->last = b->start;\n    b->end = b->last + size;\n    b->temporary = 1;\n    return b;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n#if !(NGX_DEBUG_PALLOC)\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 1);\n    }\n#endif\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}', 'u_char *\nngx_proxy_protocol_read(ngx_connection_t *c, u_char *buf, u_char *last)\n{\n    size_t                 len;\n    u_char                *p;\n    ngx_proxy_protocol_t  *pp;\n    static const u_char signature[] = "\\r\\n\\r\\n\\0\\r\\nQUIT\\n";\n    p = buf;\n    len = last - buf;\n    if (len >= sizeof(ngx_proxy_protocol_header_t)\n        && memcmp(p, signature, sizeof(signature) - 1) == 0)\n    {\n        return ngx_proxy_protocol_v2_read(c, buf, last);\n    }\n    if (len < 8 || ngx_strncmp(p, "PROXY ", 6) != 0) {\n        goto invalid;\n    }\n    p += 6;\n    len -= 6;\n    if (len >= 7 && ngx_strncmp(p, "UNKNOWN", 7) == 0) {\n        ngx_log_debug0(NGX_LOG_DEBUG_CORE, c->log, 0,\n                       "PROXY protocol unknown protocol");\n        p += 7;\n        goto skip;\n    }\n    if (len < 5 || ngx_strncmp(p, "TCP", 3) != 0\n        || (p[3] != \'4\' && p[3] != \'6\') || p[4] != \' \')\n    {\n        goto invalid;\n    }\n    p += 5;\n    pp = ngx_pcalloc(c->pool, sizeof(ngx_proxy_protocol_t));\n    if (pp == NULL) {\n        return NULL;\n    }\n    p = ngx_proxy_protocol_read_addr(c, p, last, &pp->src_addr);\n    if (p == NULL) {\n        goto invalid;\n    }\n    p = ngx_proxy_protocol_read_addr(c, p, last, &pp->dst_addr);\n    if (p == NULL) {\n        goto invalid;\n    }\n    p = ngx_proxy_protocol_read_port(p, last, &pp->src_port, \' \');\n    if (p == NULL) {\n        goto invalid;\n    }\n    p = ngx_proxy_protocol_read_port(p, last, &pp->dst_port, CR);\n    if (p == NULL) {\n        goto invalid;\n    }\n    if (p == last) {\n        goto invalid;\n    }\n    if (*p++ != LF) {\n        goto invalid;\n    }\n    ngx_log_debug4(NGX_LOG_DEBUG_CORE, c->log, 0,\n                   "PROXY protocol src: %V %d, dst: %V %d",\n                   &pp->src_addr, pp->src_port, &pp->dst_addr, pp->dst_port);\n    c->proxy_protocol = pp;\n    return p;\nskip:\n    for (   ; p < last - 1; p++) {\n        if (p[0] == CR && p[1] == LF) {\n            return p + 2;\n        }\n    }\ninvalid:\n    ngx_log_error(NGX_LOG_ERR, c->log, 0,\n                  "broken header: \\"%*s\\"", (size_t) (last - buf), buf);\n    return NULL;\n}', "static u_char *\nngx_proxy_protocol_read_addr(ngx_connection_t *c, u_char *p, u_char *last,\n    ngx_str_t *addr)\n{\n    size_t  len;\n    u_char  ch, *pos;\n    pos = p;\n    for ( ;; ) {\n        if (p == last) {\n            return NULL;\n        }\n        ch = *p++;\n        if (ch == ' ') {\n            break;\n        }\n        if (ch != ':' && ch != '.'\n            && (ch < 'a' || ch > 'f')\n            && (ch < 'A' || ch > 'F')\n            && (ch < '0' || ch > '9'))\n        {\n            return NULL;\n        }\n    }\n    len = p - pos - 1;\n    addr->data = ngx_pnalloc(c->pool, len);\n    if (addr->data == NULL) {\n        return NULL;\n    }\n    ngx_memcpy(addr->data, pos, len);\n    addr->len = len;\n    return p;\n}"]