src/http/ngx_http_variables.c:1300: error: Buffer Overrun L2
  Offset: [0, 65535] Size: 20 by call to `ngx_sprintf`.

src/http/ngx_http_variables.c:1295:13: Call
1293. 
1294.     if (r->headers_out.content_length_n >= 0) {
1295.         p = ngx_pnalloc(r->pool, NGX_OFF_T_LEN);
                  ^
1296.         if (p == NULL) {
1297.             return NGX_ERROR;

src/core/ngx_palloc.c:155:13: Assignment
  153. 
  154.         do {
  155.             m = p->d.last;
                   ^
  156. 
  157.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:160:17: Assignment
  158.                 p->d.last = m + size;
  159. 
  160.                 return m;
                       ^
  161.             }
  162. 

src/http/ngx_http_variables.c:1295:9: Assignment
1293. 
1294.     if (r->headers_out.content_length_n >= 0) {
1295.         p = ngx_pnalloc(r->pool, NGX_OFF_T_LEN);
              ^
1296.         if (p == NULL) {
1297.             return NGX_ERROR;

src/http/ngx_http_variables.c:1300:18: Call
1298.         }
1299. 
1300.         v->len = ngx_sprintf(p, "%O", r->headers_out.content_length_n) - p;
                       ^
1301.         v->valid = 1;
1302.         v->no_cacheable = 0;

src/core/ngx_string.c:95:1: Parameter `*buf`
  93. 
  94. 
  95. u_char * ngx_cdecl
      ^
  96. ngx_sprintf(u_char *buf, const char *fmt, ...)
  97. {

src/core/ngx_string.c:102:9: Call
  100. 
  101.     va_start(args, fmt);
  102.     p = ngx_vsnprintf(buf, /* STUB */ 65536, fmt, args);
               ^
  103.     va_end(args);
  104. 

src/core/ngx_string.c:123:1: <Length trace>
121. 
122. 
123. u_char *
     ^
124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
125. {

src/core/ngx_string.c:123:1: Parameter `*buf`
    121. 
    122. 
    123. u_char *
         ^
    124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
    125. {

src/core/ngx_string.c:244:25: Array access: Offset: [0, 65535] Size: 20 by call to `ngx_sprintf` 
    242.                 if (slen == (size_t) -1) {
    243.                     while (*p && buf < last) {
    244.                         *buf++ = *p++;
                                 ^
    245.                     }
    246. 
