src/http/ngx_http_upstream_round_robin.c:149: error: Buffer Overrun L3
  Offset: [0, 65535] Size: [6, +oo] by call to `ngx_inet_resolve_host`.

src/http/ngx_http_upstream_round_robin.c:149:9: Call
147.     u.port = (in_port_t) (us->port ? us->port : us->default_port);
148. 
149.     if (ngx_inet_resolve_host(cf->pool, &u) != NGX_OK) {
             ^
150.         if (u.err) {
151.             ngx_log_error(NGX_LOG_EMERG, cf->log, 0,

src/core/ngx_inet.c:688:1: Parameter `u->host.len`
  686. 
  687. 
  688. ngx_int_t
       ^
  689. ngx_inet_resolve_host(ngx_pool_t *pool, ngx_url_t *u)
  690. {

src/core/ngx_inet.c:790:13: Call
  788.         u->addrs[0].socklen = sizeof(struct sockaddr_in);
  789. 
  790.         p = ngx_pnalloc(pool, u->host.len + sizeof(":65535") - 1);
                   ^
  791.         if (p == NULL) {
  792.             return NGX_ERROR;

src/core/ngx_palloc.c:155:13: Assignment
    153. 
    154.         do {
    155.             m = p->d.last;
                     ^
    156. 
    157.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:160:17: Assignment
    158.                 p->d.last = m + size;
    159. 
    160.                 return m;
                         ^
    161.             }
    162. 

src/core/ngx_inet.c:790:9: Assignment
  788.         u->addrs[0].socklen = sizeof(struct sockaddr_in);
  789. 
  790.         p = ngx_pnalloc(pool, u->host.len + sizeof(":65535") - 1);
               ^
  791.         if (p == NULL) {
  792.             return NGX_ERROR;

src/core/ngx_inet.c:795:32: Call
  793.         }
  794. 
  795.         u->addrs[0].name.len = ngx_sprintf(p, "%V:%d",
                                      ^
  796.                                            &u->host, ntohs(port)) - p;
  797.         u->addrs[0].name.data = p;

src/core/ngx_string.c:95:1: Parameter `*buf`
    93. 
    94. 
    95. u_char * ngx_cdecl
        ^
    96. ngx_sprintf(u_char *buf, const char *fmt, ...)
    97. {

src/core/ngx_string.c:102:9: Call
    100. 
    101.     va_start(args, fmt);
    102.     p = ngx_vsnprintf(buf, /* STUB */ 65536, fmt, args);
                 ^
    103.     va_end(args);
    104. 

src/core/ngx_string.c:123:1: <Length trace>
121. 
122. 
123. u_char *
     ^
124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
125. {

src/core/ngx_string.c:123:1: Parameter `*buf`
      121. 
      122. 
      123. u_char *
           ^
      124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
      125. {

src/core/ngx_string.c:244:25: Array access: Offset: [0, 65535] Size: [6, +oo] by call to `ngx_inet_resolve_host` 
      242.                 if (slen == (size_t) -1) {
      243.                     while (*p && buf < last) {
      244.                         *buf++ = *p++;
                                   ^
      245.                     }
      246. 
