src/http/ngx_http_upstream.c:4193: error: Buffer Overrun L3
  Offset: [0, 534] (⇐ [0, 24] + [0, 510]) Size: [0, +oo] by call to `ngx_hash_init`.

src/http/ngx_http_upstream.c:4187:5: Assignment
4185.     hash.hash = &umcf->headers_in_hash;
4186.     hash.key = ngx_hash_key_lc;
4187.     hash.max_size = 512;
          ^
4188.     hash.bucket_size = ngx_align(64, ngx_cacheline_size);
4189.     hash.name = "upstream_headers_in_hash";

src/http/ngx_http_upstream.c:4193:9: Call
4191.     hash.temp_pool = NULL;
4192. 
4193.     if (ngx_hash_init(&hash, headers_in.elts, headers_in.nelts) != NGX_OK) {
              ^
4194.         return NGX_CONF_ERROR;
4195.     }

src/core/ngx_hash.c:250:1: <Offset trace>
248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
249. 
250. ngx_int_t
     ^
251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
252. {

src/core/ngx_hash.c:250:1: Parameter `hinit->max_size`
  248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
  249. 
  250. ngx_int_t
       ^
  251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  252. {

src/core/ngx_hash.c:250:1: <Length trace>
248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
249. 
250. ngx_int_t
     ^
251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
252. {

src/core/ngx_hash.c:250:1: Parameter `hinit->max_size`
  248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
  249. 
  250. ngx_int_t
       ^
  251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  252. {

src/core/ngx_hash.c:371:19: Call
  369. 
  370.     } else {
  371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
                         ^
  372.         if (buckets == NULL) {
  373.             ngx_free(test);

src/core/ngx_palloc.c:283:1: Parameter `size`
    281. 
    282. 
    283. void *
         ^
    284. ngx_pcalloc(ngx_pool_t *pool, size_t size)
    285. {

src/core/ngx_palloc.c:288:9: Call
    286.     void *p;
    287. 
    288.     p = ngx_palloc(pool, size);
                 ^
    289.     if (p) {
    290.         ngx_memzero(p, size);

src/core/ngx_palloc.c:125:13: Assignment
      123. 
      124.         do {
      125.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                       ^
      126. 
      127.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:130:17: Assignment
      128.                 p->d.last = m + size;
      129. 
      130.                 return m;
                           ^
      131.             }
      132. 

src/core/ngx_palloc.c:288:5: Assignment
    286.     void *p;
    287. 
    288.     p = ngx_palloc(pool, size);
             ^
    289.     if (p) {
    290.         ngx_memzero(p, size);

src/core/ngx_palloc.c:293:5: Assignment
    291.     }
    292. 
    293.     return p;
             ^
    294. }
    295. 

src/core/ngx_hash.c:371:9: Assignment
  369. 
  370.     } else {
  371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
               ^
  372.         if (buckets == NULL) {
  373.             ngx_free(test);

src/core/ngx_hash.c:391:9: Array access: Offset: [0, 534] (⇐ [0, 24] + [0, 510]) Size: [0, +oo] by call to `ngx_hash_init` 
  389.         }
  390. 
  391.         buckets[i] = (ngx_hash_elt_t *) elts;
               ^
  392.         elts += test[i];
  393. 
