src/http/ngx_http_request_body.c:468: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_create_temp_file`.

src/http/ngx_http_request_body.c:443:14: Call
441. 
442.     if (rb->temp_file == NULL) {
443.         tf = ngx_pcalloc(r->pool, sizeof(ngx_temp_file_t));
                  ^
444.         if (tf == NULL) {
445.             return NGX_ERROR;

src/core/ngx_palloc.c:302:9: Call
  300.     void *p;
  301. 
  302.     p = ngx_palloc(pool, size);
               ^
  303.     if (p) {
  304.         ngx_memzero(p, size);

src/core/ngx_palloc.c:131:12: Call
    129. #endif
    130. 
    131.     return ngx_palloc_large(pool, size);
                    ^
    132. }
    133. 

src/core/ngx_palloc.c:220:9: Call
      218.     ngx_pool_large_t  *large;
      219. 
      220.     p = ngx_alloc(size, pool->log);
                   ^
      221.     if (p == NULL) {
      222.         return NULL;

src/os/unix/ngx_alloc.c:17:1: Parameter `log->next->disk_full_time`
        15. 
        16. 
        17. void *
            ^
        18. ngx_alloc(size_t size, ngx_log_t *log)
        19. {

src/http/ngx_http_request_body.c:468:17: Call
466.             /* empty body with r->request_body_in_file_only */
467. 
468.             if (ngx_create_temp_file(&tf->file, tf->path, tf->pool,
                     ^
469.                                      tf->persistent, tf->clean, tf->access)
470.                 != NGX_OK)

src/core/ngx_file.c:140:1: Parameter `path->level[*]`
  138. 
  139. 
  140. ngx_int_t
       ^
  141. ngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,
  142.     ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)

src/core/ngx_file.c:233:13: Call
  231.         }
  232. 
  233.         if (ngx_create_path(file, path) == NGX_ERROR) {
                   ^
  234.             return NGX_ERROR;
  235.         }

src/core/ngx_file.c:265:1: <Offset trace>
263. 
264. 
265. ngx_int_t
     ^
266. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
267. {

src/core/ngx_file.c:265:1: Parameter `path->level[*]`
    263. 
    264. 
    265. ngx_int_t
         ^
    266. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
    267. {

src/core/ngx_file.c:279:9: Assignment
    277.         }
    278. 
    279.         pos += path->level[i] + 1;
                 ^
    280. 
    281.         file->name.data[pos] = '\0';

src/core/ngx_file.c:265:1: <Length trace>
263. 
264. 
265. ngx_int_t
     ^
266. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
267. {

src/core/ngx_file.c:265:1: Parameter `*file->name.data`
    263. 
    264. 
    265. ngx_int_t
         ^
    266. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
    267. {

src/core/ngx_file.c:296:9: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_create_temp_file` 
    294.         }
    295. 
    296.         file->name.data[pos] = '/';
                 ^
    297.     }
    298. 

ngx_int_t
ngx_create_path(ngx_file_t *file, ngx_path_t *path)
{
    size_t      pos;
    ngx_err_t   err;
    ngx_uint_t  i;
    pos = path->name.len;
    for (i = 0; i < NGX_MAX_PATH_LEVEL; i++) {
        if (path->level[i] == 0) {
            break;
        }
        pos += path->level[i] + 1;
        file->name.data[pos] = '\0';
        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,
                       "temp file: \"%s\"", file->name.data);
        if (ngx_create_dir(file->name.data, 0700) == NGX_FILE_ERROR) {
            err = ngx_errno;
            if (err != NGX_EEXIST) {
                ngx_log_error(NGX_LOG_CRIT, file->log, err,
                              ngx_create_dir_n " \"%s\" failed",
                              file->name.data);
                return NGX_ERROR;
            }
        }
        file->name.data[pos] = '/';
    }
    return NGX_OK;
}
['static ngx_int_t\nngx_http_write_request_body(ngx_http_request_t *r)\n{\n    ssize_t                    n;\n    ngx_chain_t               *cl, *ln;\n    ngx_temp_file_t           *tf;\n    ngx_http_request_body_t   *rb;\n    ngx_http_core_loc_conf_t  *clcf;\n    rb = r->request_body;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http write client request body, bufs %p", rb->bufs);\n    if (rb->temp_file == NULL) {\n        tf = ngx_pcalloc(r->pool, sizeof(ngx_temp_file_t));\n        if (tf == NULL) {\n            return NGX_ERROR;\n        }\n        clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n        tf->file.fd = NGX_INVALID_FILE;\n        tf->file.log = r->connection->log;\n        tf->path = clcf->client_body_temp_path;\n        tf->pool = r->pool;\n        tf->warn = "a client request body is buffered to a temporary file";\n        tf->log_level = r->request_body_file_log_level;\n        tf->persistent = r->request_body_in_persistent_file;\n        tf->clean = r->request_body_in_clean_file;\n        if (r->request_body_file_group_access) {\n            tf->access = 0660;\n        }\n        rb->temp_file = tf;\n        if (rb->bufs == NULL) {\n            if (ngx_create_temp_file(&tf->file, tf->path, tf->pool,\n                                     tf->persistent, tf->clean, tf->access)\n                != NGX_OK)\n            {\n                return NGX_ERROR;\n            }\n            return NGX_OK;\n        }\n    }\n    if (rb->bufs == NULL) {\n        return NGX_OK;\n    }\n    n = ngx_write_chain_to_temp_file(rb->temp_file, rb->bufs);\n    if (n == NGX_ERROR) {\n        return NGX_ERROR;\n    }\n    rb->temp_file->offset += n;\n    for (cl = rb->bufs; cl;  ) {\n        cl->buf->pos = cl->buf->last;\n        ln = cl;\n        cl = cl->next;\n        ngx_free_chain(r->pool, ln);\n    }\n    rb->bufs = NULL;\n    return NGX_OK;\n}', 'void *\nngx_pcalloc(ngx_pool_t *pool, size_t size)\n{\n    void *p;\n    p = ngx_palloc(pool, size);\n    if (p) {\n        ngx_memzero(p, size);\n    }\n    return p;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n#if !(NGX_DEBUG_PALLOC)\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 1);\n    }\n#endif\n    return ngx_palloc_large(pool, size);\n}', 'static void *\nngx_palloc_large(ngx_pool_t *pool, size_t size)\n{\n    void              *p;\n    ngx_uint_t         n;\n    ngx_pool_large_t  *large;\n    p = ngx_alloc(size, pool->log);\n    if (p == NULL) {\n        return NULL;\n    }\n    n = 0;\n    for (large = pool->large; large; large = large->next) {\n        if (large->alloc == NULL) {\n            large->alloc = p;\n            return p;\n        }\n        if (n++ > 3) {\n            break;\n        }\n    }\n    large = ngx_palloc_small(pool, sizeof(ngx_pool_large_t), 1);\n    if (large == NULL) {\n        ngx_free(p);\n        return NULL;\n    }\n    large->alloc = p;\n    large->next = pool->large;\n    pool->large = large;\n    return p;\n}', 'void *\nngx_alloc(size_t size, ngx_log_t *log)\n{\n    void  *p;\n    p = malloc(size);\n    if (p == NULL) {\n        ngx_log_error(NGX_LOG_EMERG, log, ngx_errno,\n                      "malloc(%uz) failed", size);\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_ALLOC, log, 0, "malloc: %p:%uz", p, size);\n    return p;\n}', 'ngx_int_t\nngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,\n    ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)\n{\n    size_t                    levels;\n    u_char                   *p;\n    uint32_t                  n;\n    ngx_err_t                 err;\n    ngx_str_t                 name;\n    ngx_uint_t                prefix;\n    ngx_pool_cleanup_t       *cln;\n    ngx_pool_cleanup_file_t  *clnf;\n    if (file->name.len) {\n        name = file->name;\n        levels = 0;\n        prefix = 1;\n    } else {\n        name = path->name;\n        levels = path->len;\n        prefix = 0;\n    }\n    file->name.len = name.len + 1 + levels + 10;\n    file->name.data = ngx_pnalloc(pool, file->name.len + 1);\n    if (file->name.data == NULL) {\n        return NGX_ERROR;\n    }\n#if 0\n    for (i = 0; i < file->name.len; i++) {\n        file->name.data[i] = \'X\';\n    }\n#endif\n    p = ngx_cpymem(file->name.data, name.data, name.len);\n    if (prefix) {\n        *p = \'.\';\n    }\n    p += 1 + levels;\n    n = (uint32_t) ngx_next_temp_number(0);\n    cln = ngx_pool_cleanup_add(pool, sizeof(ngx_pool_cleanup_file_t));\n    if (cln == NULL) {\n        return NGX_ERROR;\n    }\n    for ( ;; ) {\n        (void) ngx_sprintf(p, "%010uD%Z", n);\n        if (!prefix) {\n            ngx_create_hashed_filename(path, file->name.data, file->name.len);\n        }\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "hashed path: %s", file->name.data);\n        file->fd = ngx_open_tempfile(file->name.data, persistent, access);\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "temp fd:%d", file->fd);\n        if (file->fd != NGX_INVALID_FILE) {\n            cln->handler = clean ? ngx_pool_delete_file : ngx_pool_cleanup_file;\n            clnf = cln->data;\n            clnf->fd = file->fd;\n            clnf->name = file->name.data;\n            clnf->log = pool->log;\n            return NGX_OK;\n        }\n        err = ngx_errno;\n        if (err == NGX_EEXIST_FILE) {\n            n = (uint32_t) ngx_next_temp_number(1);\n            continue;\n        }\n        if ((path->level[0] == 0) || (err != NGX_ENOPATH)) {\n            ngx_log_error(NGX_LOG_CRIT, file->log, err,\n                          ngx_open_tempfile_n " \\"%s\\" failed",\n                          file->name.data);\n            return NGX_ERROR;\n        }\n        if (ngx_create_path(file, path) == NGX_ERROR) {\n            return NGX_ERROR;\n        }\n    }\n}', 'ngx_int_t\nngx_create_path(ngx_file_t *file, ngx_path_t *path)\n{\n    size_t      pos;\n    ngx_err_t   err;\n    ngx_uint_t  i;\n    pos = path->name.len;\n    for (i = 0; i < NGX_MAX_PATH_LEVEL; i++) {\n        if (path->level[i] == 0) {\n            break;\n        }\n        pos += path->level[i] + 1;\n        file->name.data[pos] = \'\\0\';\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "temp file: \\"%s\\"", file->name.data);\n        if (ngx_create_dir(file->name.data, 0700) == NGX_FILE_ERROR) {\n            err = ngx_errno;\n            if (err != NGX_EEXIST) {\n                ngx_log_error(NGX_LOG_CRIT, file->log, err,\n                              ngx_create_dir_n " \\"%s\\" failed",\n                              file->name.data);\n                return NGX_ERROR;\n            }\n        }\n        file->name.data[pos] = \'/\';\n    }\n    return NGX_OK;\n}']