src/core/ngx_crypt.c:243: error: Buffer Overrun L3
  Offset: [2, +oo] (⇐ [0, +oo] + 2) Size: [0, +oo] by call to `ngx_encode_base64`.

src/core/ngx_crypt.c:213:11: Assignment
211.     encoded.len = ngx_strlen(encoded.data);
212. 
213.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
               ^
214. 
215.     decoded.data = ngx_pnalloc(pool, len);

src/core/ngx_crypt.c:213:5: Assignment
211.     encoded.len = ngx_strlen(encoded.data);
212. 
213.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
         ^
214. 
215.     decoded.data = ngx_pnalloc(pool, len);

src/core/ngx_crypt.c:215:20: Call
213.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
214. 
215.     decoded.data = ngx_pnalloc(pool, len);
                        ^
216.     if (decoded.data == NULL) {
217.         return NGX_ERROR;

src/core/ngx_palloc.c:160:13: Assignment
  158. 
  159.         do {
  160.             m = p->d.last;
                   ^
  161. 
  162.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:165:17: Assignment
  163.                 p->d.last = m + size;
  164. 
  165.                 return m;
                       ^
  166.             }
  167. 

src/core/ngx_crypt.c:215:5: Assignment
213.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
214. 
215.     decoded.data = ngx_pnalloc(pool, len);
         ^
216.     if (decoded.data == NULL) {
217.         return NGX_ERROR;

src/core/ngx_crypt.c:243:5: Call
241. 
242.     encoded.data = ngx_cpymem(*encrypted, "{SSHA}", sizeof("{SSHA}") - 1);
243.     ngx_encode_base64(&encoded, &decoded);
         ^
244.     encoded.data[encoded.len] = '\0';
245. 

src/core/ngx_string.c:1102:1: Parameter `*src->data`
  1100. 
  1101. 
  1102. void
        ^
  1103. ngx_encode_base64(ngx_str_t *dst, ngx_str_t *src)
  1104. {

src/core/ngx_string.c:1108:5: Call
  1106.             "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
  1107. 
  1108.     ngx_encode_base64_internal(dst, src, basis64, 1);
            ^
  1109. }
  1110. 

src/core/ngx_string.c:1122:1: <Length trace>
1120. 
1121. 
1122. static void
      ^
1123. ngx_encode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis,
1124.     ngx_uint_t padding)

src/core/ngx_string.c:1122:1: Parameter `*src->data`
    1120. 
    1121. 
    1122. static void
          ^
    1123. ngx_encode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis,
    1124.     ngx_uint_t padding)

src/core/ngx_string.c:1130:5: Assignment
    1128. 
    1129.     len = src->len;
    1130.     s = src->data;
              ^
    1131.     d = dst->data;
    1132. 

src/core/ngx_string.c:1136:46: Array access: Offset: [2, +oo] (⇐ [0, +oo] + 2) Size: [0, +oo] by call to `ngx_encode_base64` 
    1134.         *d++ = basis[(s[0] >> 2) & 0x3f];
    1135.         *d++ = basis[((s[0] & 3) << 4) | (s[1] >> 4)];
    1136.         *d++ = basis[((s[1] & 0x0f) << 2) | (s[2] >> 6)];
                                                       ^
    1137.         *d++ = basis[s[2] & 0x3f];
    1138. 

static void
ngx_encode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis,
    ngx_uint_t padding)
{
    u_char         *d, *s;
    size_t          len;
    len = src->len;
    s = src->data;
    d = dst->data;
    while (len > 2) {
        *d++ = basis[(s[0] >> 2) & 0x3f];
        *d++ = basis[((s[0] & 3) << 4) | (s[1] >> 4)];
        *d++ = basis[((s[1] & 0x0f) << 2) | (s[2] >> 6)];
        *d++ = basis[s[2] & 0x3f];
        s += 3;
        len -= 3;
    }
    if (len) {
        *d++ = basis[(s[0] >> 2) & 0x3f];
        if (len == 1) {
            *d++ = basis[(s[0] & 3) << 4];
            if (padding) {
                *d++ = '=';
            }
        } else {
            *d++ = basis[((s[0] & 3) << 4) | (s[1] >> 4)];
            *d++ = basis[(s[1] & 0x0f) << 2];
        }
        if (padding) {
            *d++ = '=';
        }
    }
    dst->len = d - dst->data;
}
['static ngx_int_t\nngx_crypt_ssha(ngx_pool_t *pool, u_char *key, u_char *salt, u_char **encrypted)\n{\n    size_t       len;\n    ngx_int_t    rc;\n    ngx_str_t    encoded, decoded;\n    ngx_sha1_t   sha1;\n    encoded.data = salt + sizeof("{SSHA}") - 1;\n    encoded.len = ngx_strlen(encoded.data);\n    len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);\n    decoded.data = ngx_pnalloc(pool, len);\n    if (decoded.data == NULL) {\n        return NGX_ERROR;\n    }\n    rc = ngx_decode_base64(&decoded, &encoded);\n    if (rc != NGX_OK || decoded.len < 20) {\n        decoded.len = 20;\n    }\n    ngx_sha1_init(&sha1);\n    ngx_sha1_update(&sha1, key, ngx_strlen(key));\n    ngx_sha1_update(&sha1, decoded.data + 20, decoded.len - 20);\n    ngx_sha1_final(decoded.data, &sha1);\n    len = sizeof("{SSHA}") - 1 + ngx_base64_encoded_length(decoded.len) + 1;\n    *encrypted = ngx_pnalloc(pool, len);\n    if (*encrypted == NULL) {\n        return NGX_ERROR;\n    }\n    encoded.data = ngx_cpymem(*encrypted, "{SSHA}", sizeof("{SSHA}") - 1);\n    ngx_encode_base64(&encoded, &decoded);\n    encoded.data[encoded.len] = \'\\0\';\n    return NGX_OK;\n}', 'void *\nngx_pnalloc(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    if (size <= pool->max) {\n        p = pool->current;\n        do {\n            m = p->d.last;\n            if ((size_t) (p->d.end - m) >= size) {\n                p->d.last = m + size;\n                return m;\n            }\n            p = p->d.next;\n        } while (p);\n        return ngx_palloc_block(pool, size);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'void\nngx_encode_base64(ngx_str_t *dst, ngx_str_t *src)\n{\n    static u_char   basis64[] =\n            "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";\n    ngx_encode_base64_internal(dst, src, basis64, 1);\n}', "static void\nngx_encode_base64_internal(ngx_str_t *dst, ngx_str_t *src, const u_char *basis,\n    ngx_uint_t padding)\n{\n    u_char         *d, *s;\n    size_t          len;\n    len = src->len;\n    s = src->data;\n    d = dst->data;\n    while (len > 2) {\n        *d++ = basis[(s[0] >> 2) & 0x3f];\n        *d++ = basis[((s[0] & 3) << 4) | (s[1] >> 4)];\n        *d++ = basis[((s[1] & 0x0f) << 2) | (s[2] >> 6)];\n        *d++ = basis[s[2] & 0x3f];\n        s += 3;\n        len -= 3;\n    }\n    if (len) {\n        *d++ = basis[(s[0] >> 2) & 0x3f];\n        if (len == 1) {\n            *d++ = basis[(s[0] & 3) << 4];\n            if (padding) {\n                *d++ = '=';\n            }\n        } else {\n            *d++ = basis[((s[0] & 3) << 4) | (s[1] >> 4)];\n            *d++ = basis[(s[1] & 0x0f) << 2];\n        }\n        if (padding) {\n            *d++ = '=';\n        }\n    }\n    dst->len = d - dst->data;\n}"]