src/http/ngx_http_request_body.c:454: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_create_temp_file`.

src/http/ngx_http_request_body.c:429:14: Call
427. 
428.     if (rb->temp_file == NULL) {
429.         tf = ngx_pcalloc(r->pool, sizeof(ngx_temp_file_t));
                  ^
430.         if (tf == NULL) {
431.             return NGX_ERROR;

src/core/ngx_palloc.c:304:9: Call
  302.     void *p;
  303. 
  304.     p = ngx_palloc(pool, size);
               ^
  305.     if (p) {
  306.         ngx_memzero(p, size);

src/core/ngx_palloc.c:142:16: Call
    140.         } while (p);
    141. 
    142.         return ngx_palloc_block(pool, size);
                        ^
    143.     }
    144. 

src/core/ngx_palloc.c:188:9: Call
      186.     psize = (size_t) (pool->d.end - (u_char *) pool);
      187. 
      188.     m = ngx_memalign(NGX_POOL_ALIGNMENT, psize, pool->log);
                   ^
      189.     if (m == NULL) {
      190.         return NULL;

src/os/unix/ngx_alloc.c:51:1: Parameter `log->file->fd`
        49. #if (NGX_HAVE_POSIX_MEMALIGN)
        50. 
        51. void *
            ^
        52. ngx_memalign(size_t alignment, size_t size, ngx_log_t *log)
        53. {

src/http/ngx_http_request_body.c:454:17: Call
452.             /* empty body with r->request_body_in_file_only */
453. 
454.             if (ngx_create_temp_file(&tf->file, tf->path, tf->pool,
                     ^
455.                                      tf->persistent, tf->clean, tf->access)
456.                 != NGX_OK)

src/core/ngx_file.c:132:1: Parameter `path->level[*]`
  130. 
  131. 
  132. ngx_int_t
       ^
  133. ngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,
  134.     ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)

src/core/ngx_file.c:214:13: Call
  212.         }
  213. 
  214.         if (ngx_create_path(file, path) == NGX_ERROR) {
                   ^
  215.             return NGX_ERROR;
  216.         }

src/core/ngx_file.c:246:1: <Offset trace>
244. 
245. 
246. ngx_int_t
     ^
247. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
248. {

src/core/ngx_file.c:246:1: Parameter `path->level[*]`
    244. 
    245. 
    246. ngx_int_t
         ^
    247. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
    248. {

src/core/ngx_file.c:260:9: Assignment
    258.         }
    259. 
    260.         pos += path->level[i] + 1;
                 ^
    261. 
    262.         file->name.data[pos] = '\0';

src/core/ngx_file.c:246:1: <Length trace>
244. 
245. 
246. ngx_int_t
     ^
247. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
248. {

src/core/ngx_file.c:246:1: Parameter `*file->name.data`
    244. 
    245. 
    246. ngx_int_t
         ^
    247. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
    248. {

src/core/ngx_file.c:277:9: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_create_temp_file` 
    275.         }
    276. 
    277.         file->name.data[pos] = '/';
                 ^
    278.     }
    279. 

ngx_int_t
ngx_create_path(ngx_file_t *file, ngx_path_t *path)
{
    size_t      pos;
    ngx_err_t   err;
    ngx_uint_t  i;
    pos = path->name.len;
    for (i = 0; i < 3; i++) {
        if (path->level[i] == 0) {
            break;
        }
        pos += path->level[i] + 1;
        file->name.data[pos] = '\0';
        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,
                       "temp file: \"%s\"", file->name.data);
        if (ngx_create_dir(file->name.data, 0700) == NGX_FILE_ERROR) {
            err = ngx_errno;
            if (err != NGX_EEXIST) {
                ngx_log_error(NGX_LOG_CRIT, file->log, err,
                              ngx_create_dir_n " \"%s\" failed",
                              file->name.data);
                return NGX_ERROR;
            }
        }
        file->name.data[pos] = '/';
    }
    return NGX_OK;
}
['static ngx_int_t\nngx_http_write_request_body(ngx_http_request_t *r)\n{\n    ssize_t                    n;\n    ngx_chain_t               *cl;\n    ngx_temp_file_t           *tf;\n    ngx_http_request_body_t   *rb;\n    ngx_http_core_loc_conf_t  *clcf;\n    rb = r->request_body;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http write client request body, bufs %p", rb->bufs);\n    if (rb->temp_file == NULL) {\n        tf = ngx_pcalloc(r->pool, sizeof(ngx_temp_file_t));\n        if (tf == NULL) {\n            return NGX_ERROR;\n        }\n        clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n        tf->file.fd = NGX_INVALID_FILE;\n        tf->file.log = r->connection->log;\n        tf->path = clcf->client_body_temp_path;\n        tf->pool = r->pool;\n        tf->warn = "a client request body is buffered to a temporary file";\n        tf->log_level = r->request_body_file_log_level;\n        tf->persistent = r->request_body_in_persistent_file;\n        tf->clean = r->request_body_in_clean_file;\n        if (r->request_body_file_group_access) {\n            tf->access = 0660;\n        }\n        rb->temp_file = tf;\n        if (rb->bufs == NULL) {\n            if (ngx_create_temp_file(&tf->file, tf->path, tf->pool,\n                                     tf->persistent, tf->clean, tf->access)\n                != NGX_OK)\n            {\n                return NGX_ERROR;\n            }\n            return NGX_OK;\n        }\n    }\n    if (rb->bufs == NULL) {\n        return NGX_OK;\n    }\n    n = ngx_write_chain_to_temp_file(rb->temp_file, rb->bufs);\n    if (n == NGX_ERROR) {\n        return NGX_ERROR;\n    }\n    rb->temp_file->offset += n;\n    for (cl = rb->bufs; cl; cl = cl->next) {\n        cl->buf->pos = cl->buf->last;\n    }\n    rb->bufs = NULL;\n    return NGX_OK;\n}', 'void *\nngx_pcalloc(ngx_pool_t *pool, size_t size)\n{\n    void *p;\n    p = ngx_palloc(pool, size);\n    if (p) {\n        ngx_memzero(p, size);\n    }\n    return p;\n}', 'void *\nngx_palloc(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    if (size <= pool->max) {\n        p = pool->current;\n        do {\n            m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);\n            if ((size_t) (p->d.end - m) >= size) {\n                p->d.last = m + size;\n                return m;\n            }\n            p = p->d.next;\n        } while (p);\n        return ngx_palloc_block(pool, size);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'static void *\nngx_palloc_block(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    size_t       psize;\n    ngx_pool_t  *p, *new;\n    psize = (size_t) (pool->d.end - (u_char *) pool);\n    m = ngx_memalign(NGX_POOL_ALIGNMENT, psize, pool->log);\n    if (m == NULL) {\n        return NULL;\n    }\n    new = (ngx_pool_t *) m;\n    new->d.end = m + psize;\n    new->d.next = NULL;\n    new->d.failed = 0;\n    m += sizeof(ngx_pool_data_t);\n    m = ngx_align_ptr(m, NGX_ALIGNMENT);\n    new->d.last = m + size;\n    for (p = pool->current; p->d.next; p = p->d.next) {\n        if (p->d.failed++ > 4) {\n            pool->current = p->d.next;\n        }\n    }\n    p->d.next = new;\n    return m;\n}', 'void *\nngx_memalign(size_t alignment, size_t size, ngx_log_t *log)\n{\n    void  *p;\n    int    err;\n    err = posix_memalign(&p, alignment, size);\n    if (err) {\n        ngx_log_error(NGX_LOG_EMERG, log, err,\n                      "posix_memalign(%uz, %uz) failed", alignment, size);\n        p = NULL;\n    }\n    ngx_log_debug3(NGX_LOG_DEBUG_ALLOC, log, 0,\n                   "posix_memalign: %p:%uz @%uz", p, size, alignment);\n    return p;\n}', 'ngx_int_t\nngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,\n    ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)\n{\n    u_char                   *p;\n    uint32_t                  n;\n    ngx_err_t                 err;\n    ngx_str_t                 prefix;\n    ngx_pool_cleanup_t       *cln;\n    ngx_pool_cleanup_file_t  *clnf;\n    prefix = path ? path->name : file->name;\n    file->name.len = prefix.len + 1 + (path ? path->len : 0) + 10;\n    file->name.data = ngx_pnalloc(pool, file->name.len + 1);\n    if (file->name.data == NULL) {\n        return NGX_ERROR;\n    }\n#if 0\n    for (i = 0; i < file->name.len; i++) {\n         file->name.data[i] = \'X\';\n    }\n#endif\n    p = ngx_cpymem(file->name.data, prefix.data, prefix.len);\n    if (path) {\n        p += 1 + path->len;\n    } else {\n        *p++ = \'.\';\n    }\n    n = (uint32_t) ngx_next_temp_number(0);\n    cln = ngx_pool_cleanup_add(pool, sizeof(ngx_pool_cleanup_file_t));\n    if (cln == NULL) {\n        return NGX_ERROR;\n    }\n    for ( ;; ) {\n        (void) ngx_sprintf(p, "%010uD%Z", n);\n        if (path) {\n            ngx_create_hashed_filename(path, file->name.data, file->name.len);\n        }\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "hashed path: %s", file->name.data);\n        file->fd = ngx_open_tempfile(file->name.data, persistent, access);\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "temp fd:%d", file->fd);\n        if (file->fd != NGX_INVALID_FILE) {\n            cln->handler = clean ? ngx_pool_delete_file : ngx_pool_cleanup_file;\n            clnf = cln->data;\n            clnf->fd = file->fd;\n            clnf->name = file->name.data;\n            clnf->log = pool->log;\n            return NGX_OK;\n        }\n        err = ngx_errno;\n        if (err == NGX_EEXIST) {\n            n = (uint32_t) ngx_next_temp_number(1);\n            continue;\n        }\n        if ((path == NULL) || (path->level[0] == 0) || (err != NGX_ENOPATH)) {\n            ngx_log_error(NGX_LOG_CRIT, file->log, err,\n                          ngx_open_tempfile_n " \\"%s\\" failed",\n                          file->name.data);\n            return NGX_ERROR;\n        }\n        if (ngx_create_path(file, path) == NGX_ERROR) {\n            return NGX_ERROR;\n        }\n    }\n}', 'ngx_int_t\nngx_create_path(ngx_file_t *file, ngx_path_t *path)\n{\n    size_t      pos;\n    ngx_err_t   err;\n    ngx_uint_t  i;\n    pos = path->name.len;\n    for (i = 0; i < 3; i++) {\n        if (path->level[i] == 0) {\n            break;\n        }\n        pos += path->level[i] + 1;\n        file->name.data[pos] = \'\\0\';\n        ngx_log_debug1(NGX_LOG_DEBUG_CORE, file->log, 0,\n                       "temp file: \\"%s\\"", file->name.data);\n        if (ngx_create_dir(file->name.data, 0700) == NGX_FILE_ERROR) {\n            err = ngx_errno;\n            if (err != NGX_EEXIST) {\n                ngx_log_error(NGX_LOG_CRIT, file->log, err,\n                              ngx_create_dir_n " \\"%s\\" failed",\n                              file->name.data);\n                return NGX_ERROR;\n            }\n        }\n        file->name.data[pos] = \'/\';\n    }\n    return NGX_OK;\n}']