src/http/ngx_http_header_filter_module.c:474: error: Buffer Overrun S2
  Offset added: [max(1, `r->headers_out.charset.len`), `r->headers_out.charset.len` + 65540] (⇐ [0, 65540] + [max(1, `r->headers_out.charset.len`), `r->headers_out.charset.len`]) Size: [0, +oo].

src/http/ngx_http_header_filter_module.c:157:1: <Offset trace>
155. 
156. 
157. static ngx_int_t
     ^
158. ngx_http_header_filter(ngx_http_request_t *r)
159. {

src/http/ngx_http_header_filter_module.c:157:1: Parameter `r->headers_out.charset.len`
155. 
156. 
157. static ngx_int_t
     ^
158. ngx_http_header_filter(ngx_http_request_t *r)
159. {

src/http/ngx_http_header_filter_module.c:430:5: <Length trace>
428. 
429.     /* "HTTP/1.x " */
430.     b->last = ngx_cpymem(b->last, "HTTP/1.1 ", sizeof("HTTP/1.x ") - 1);
         ^
431. 
432.     /* status line */

src/http/ngx_http_header_filter_module.c:430:5: Assignment
428. 
429.     /* "HTTP/1.x " */
430.     b->last = ngx_cpymem(b->last, "HTTP/1.1 ", sizeof("HTTP/1.x ") - 1);
         ^
431. 
432.     /* status line */

src/http/ngx_http_header_filter_module.c:474:23: Array access: Offset added: [max(1, r->headers_out.charset.len), r->headers_out.charset.len + 65540] (⇐ [0, 65540] + [max(1, r->headers_out.charset.len), r->headers_out.charset.len]) Size: [0, +oo]
472.             b->last = ngx_cpymem(b->last, "; charset=",
473.                                  sizeof("; charset=") - 1);
474.             b->last = ngx_copy(b->last, r->headers_out.charset.data,
                           ^
475.                                r->headers_out.charset.len);
476. 
