src/http/modules/ngx_http_autoindex_module.c:745: error: Buffer Overrun L3
  Offset: [5, +oo] Size: [0, +oo] by call to `ngx_escape_json`.

src/http/modules/ngx_http_autoindex_module.c:730:9: Assignment
728. 
729.     if (callback) {
730.         b->last = ngx_cpymem(b->last, "/* callback */" CRLF,
             ^
731.                              sizeof("/* callback */" CRLF) - 1);
732. 

src/http/modules/ngx_http_autoindex_module.c:745:34: Call
743. 
744.         if (entry[i].escape) {
745.             b->last = (u_char *) ngx_escape_json(b->last, entry[i].name.data,
                                      ^
746.                                                  entry[i].name.len);
747.         } else {

src/core/ngx_string.c:1776:1: <Length trace>
1774. 
1775. 
1776. uintptr_t
      ^
1777. ngx_escape_json(u_char *dst, u_char *src, size_t size)
1778. {

src/core/ngx_string.c:1776:1: Parameter `*dst`
  1774. 
  1775. 
  1776. uintptr_t
        ^
  1777. ngx_escape_json(u_char *dst, u_char *src, size_t size)
  1778. {

src/core/ngx_string.c:1813:14: Assignment
  1811. 
  1812.         } else {
  1813.             *dst++ = '\\'; *dst++ = 'u'; *dst++ = '0'; *dst++ = '0';
                     ^
  1814.             *dst++ = '0' + (ch >> 4);
  1815. 

src/core/ngx_string.c:1813:29: Assignment
  1811. 
  1812.         } else {
  1813.             *dst++ = '\\'; *dst++ = 'u'; *dst++ = '0'; *dst++ = '0';
                                    ^
  1814.             *dst++ = '0' + (ch >> 4);
  1815. 

src/core/ngx_string.c:1813:43: Assignment
  1811. 
  1812.         } else {
  1813.             *dst++ = '\\'; *dst++ = 'u'; *dst++ = '0'; *dst++ = '0';
                                                  ^
  1814.             *dst++ = '0' + (ch >> 4);
  1815. 

src/core/ngx_string.c:1813:57: Assignment
  1811. 
  1812.         } else {
  1813.             *dst++ = '\\'; *dst++ = 'u'; *dst++ = '0'; *dst++ = '0';
                                                                ^
  1814.             *dst++ = '0' + (ch >> 4);
  1815. 

src/core/ngx_string.c:1814:14: Assignment
  1812.         } else {
  1813.             *dst++ = '\\'; *dst++ = 'u'; *dst++ = '0'; *dst++ = '0';
  1814.             *dst++ = '0' + (ch >> 4);
                     ^
  1815. 
  1816.             ch &= 0xf;

src/core/ngx_string.c:1818:13: Array access: Offset: [5, +oo] Size: [0, +oo] by call to `ngx_escape_json` 
  1816.             ch &= 0xf;
  1817. 
  1818.             *dst++ = (ch < 10) ? ('0' + ch) : ('A' + ch - 10);
                    ^
  1819.         }
  1820. 

uintptr_t
ngx_escape_json(u_char *dst, u_char *src, size_t size)
{
    u_char      ch;
    ngx_uint_t  len;
    if (dst == NULL) {
        len = 0;
        while (size) {
            ch = *src++;
            if (ch == '\\' || ch == '"') {
                len++;
            } else if (ch <= 0x1f) {
                len += sizeof("\\u001F") - 2;
            }
            size--;
        }
        return (uintptr_t) len;
    }
    while (size) {
        ch = *src++;
        if (ch > 0x1f) {
            if (ch == '\\' || ch == '"') {
                *dst++ = '\\';
            }
            *dst++ = ch;
        } else {
            *dst++ = '\\'; *dst++ = 'u'; *dst++ = '0'; *dst++ = '0';
            *dst++ = '0' + (ch >> 4);
            ch &= 0xf;
            *dst++ = (ch < 10) ? ('0' + ch) : ('A' + ch - 10);
        }
        size--;
    }
    return (uintptr_t) dst;
}
['static ngx_buf_t *\nngx_http_autoindex_json(ngx_http_request_t *r, ngx_array_t *entries,\n    ngx_str_t *callback)\n{\n    size_t                       len;\n    ngx_buf_t                   *b;\n    ngx_uint_t                   i;\n    ngx_http_autoindex_entry_t  *entry;\n    len = sizeof("[" CRLF CRLF "]") - 1;\n    if (callback) {\n        len += sizeof("/* callback */" CRLF "();") - 1 + callback->len;\n    }\n    entry = entries->elts;\n    for (i = 0; i < entries->nelts; i++) {\n        entry[i].escape = ngx_escape_json(NULL, entry[i].name.data,\n                                          entry[i].name.len);\n        len += sizeof("{  }," CRLF) - 1\n            + sizeof("\\"name\\":\\"\\"") - 1\n            + entry[i].name.len + entry[i].escape\n            + sizeof(", \\"type\\":\\"directory\\"") - 1\n            + sizeof(", \\"mtime\\":\\"Wed, 31 Dec 1986 10:00:00 GMT\\"") - 1;\n        if (entry[i].file) {\n            len += sizeof(", \\"size\\":") - 1 + NGX_OFF_T_LEN;\n        }\n    }\n    b = ngx_create_temp_buf(r->pool, len);\n    if (b == NULL) {\n        return NULL;\n    }\n    if (callback) {\n        b->last = ngx_cpymem(b->last, "/* callback */" CRLF,\n                             sizeof("/* callback */" CRLF) - 1);\n        b->last = ngx_cpymem(b->last, callback->data, callback->len);\n        *b->last++ = \'(\';\n    }\n    *b->last++ = \'[\';\n    for (i = 0; i < entries->nelts; i++) {\n        b->last = ngx_cpymem(b->last, CRLF "{ \\"name\\":\\"",\n                             sizeof(CRLF "{ \\"name\\":\\"") - 1);\n        if (entry[i].escape) {\n            b->last = (u_char *) ngx_escape_json(b->last, entry[i].name.data,\n                                                 entry[i].name.len);\n        } else {\n            b->last = ngx_cpymem(b->last, entry[i].name.data,\n                                 entry[i].name.len);\n        }\n        b->last = ngx_cpymem(b->last, "\\", \\"type\\":\\"",\n                             sizeof("\\", \\"type\\":\\"") - 1);\n        if (entry[i].dir) {\n            b->last = ngx_cpymem(b->last, "directory", sizeof("directory") - 1);\n        } else if (entry[i].file) {\n            b->last = ngx_cpymem(b->last, "file", sizeof("file") - 1);\n        } else {\n            b->last = ngx_cpymem(b->last, "other", sizeof("other") - 1);\n        }\n        b->last = ngx_cpymem(b->last, "\\", \\"mtime\\":\\"",\n                             sizeof("\\", \\"mtime\\":\\"") - 1);\n        b->last = ngx_http_time(b->last, entry[i].mtime);\n        if (entry[i].file) {\n            b->last = ngx_cpymem(b->last, "\\", \\"size\\":",\n                                 sizeof("\\", \\"size\\":") - 1);\n            b->last = ngx_sprintf(b->last, "%O", entry[i].size);\n        } else {\n            *b->last++ = \'"\';\n        }\n        b->last = ngx_cpymem(b->last, " },", sizeof(" },") - 1);\n    }\n    if (i > 0) {\n        b->last--;\n    }\n    b->last = ngx_cpymem(b->last, CRLF "]", sizeof(CRLF "]") - 1);\n    if (callback) {\n        *b->last++ = \')\'; *b->last++ = \';\';\n    }\n    return b;\n}', 'uintptr_t\nngx_escape_json(u_char *dst, u_char *src, size_t size)\n{\n    u_char      ch;\n    ngx_uint_t  len;\n    if (dst == NULL) {\n        len = 0;\n        while (size) {\n            ch = *src++;\n            if (ch == \'\\\\\' || ch == \'"\') {\n                len++;\n            } else if (ch <= 0x1f) {\n                len += sizeof("\\\\u001F") - 2;\n            }\n            size--;\n        }\n        return (uintptr_t) len;\n    }\n    while (size) {\n        ch = *src++;\n        if (ch > 0x1f) {\n            if (ch == \'\\\\\' || ch == \'"\') {\n                *dst++ = \'\\\\\';\n            }\n            *dst++ = ch;\n        } else {\n            *dst++ = \'\\\\\'; *dst++ = \'u\'; *dst++ = \'0\'; *dst++ = \'0\';\n            *dst++ = \'0\' + (ch >> 4);\n            ch &= 0xf;\n            *dst++ = (ch < 10) ? (\'0\' + ch) : (\'A\' + ch - 10);\n        }\n        size--;\n    }\n    return (uintptr_t) dst;\n}']