src/http/ngx_http_variables.c:2624: error: Buffer Overrun L3
  Offset: [0, 25] (⇐ [0, 24] + [0, 1]) Size: [0, 40] by call to `ngx_hash_init`.

src/http/ngx_http_variables.c:2544:13: Assignment
2542.         {
2543.             v[i].get_handler = ngx_http_variable_unknown_header_in;
2544.             v[i].data = (uintptr_t) &v[i].name;
                  ^
2545. 
2546.             continue;

src/http/ngx_http_variables.c:2618:5: Assignment
2616.     hash.hash = &cmcf->variables_hash;
2617.     hash.key = ngx_hash_key;
2618.     hash.max_size = cmcf->variables_hash_max_size;
          ^
2619.     hash.bucket_size = cmcf->variables_hash_bucket_size;
2620.     hash.name = "variables_hash";

src/http/ngx_http_variables.c:2624:9: Call
2622.     hash.temp_pool = NULL;
2623. 
2624.     if (ngx_hash_init(&hash, cmcf->variables_keys->keys.elts,
              ^
2625.                       cmcf->variables_keys->keys.nelts)
2626.         != NGX_OK)

src/core/ngx_hash.c:251:1: <Offset trace>
249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
250. 
251. ngx_int_t
     ^
252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
253. {

src/core/ngx_hash.c:251:1: Parameter `hinit->max_size`
  249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
  250. 
  251. ngx_int_t
       ^
  252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  253. {

src/core/ngx_hash.c:251:1: <Length trace>
249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
250. 
251. ngx_int_t
     ^
252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
253. {

src/core/ngx_hash.c:251:1: Parameter `hinit->max_size`
  249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
  250. 
  251. ngx_int_t
       ^
  252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  253. {

src/core/ngx_hash.c:371:19: Call
  369. 
  370.     } else {
  371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
                         ^
  372.         if (buckets == NULL) {
  373.             ngx_free(test);

src/core/ngx_palloc.c:299:1: Parameter `size`
    297. 
    298. 
    299. void *
         ^
    300. ngx_pcalloc(ngx_pool_t *pool, size_t size)
    301. {

src/core/ngx_palloc.c:304:9: Call
    302.     void *p;
    303. 
    304.     p = ngx_palloc(pool, size);
                 ^
    305.     if (p) {
    306.         ngx_memzero(p, size);

src/core/ngx_palloc.c:130:13: Assignment
      128. 
      129.         do {
      130.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                       ^
      131. 
      132.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:135:17: Assignment
      133.                 p->d.last = m + size;
      134. 
      135.                 return m;
                           ^
      136.             }
      137. 

src/core/ngx_palloc.c:304:5: Assignment
    302.     void *p;
    303. 
    304.     p = ngx_palloc(pool, size);
             ^
    305.     if (p) {
    306.         ngx_memzero(p, size);

src/core/ngx_palloc.c:309:5: Assignment
    307.     }
    308. 
    309.     return p;
             ^
    310. }
    311. 

src/core/ngx_hash.c:371:9: Assignment
  369. 
  370.     } else {
  371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
               ^
  372.         if (buckets == NULL) {
  373.             ngx_free(test);

src/core/ngx_hash.c:391:9: Array access: Offset: [0, 25] (⇐ [0, 24] + [0, 1]) Size: [0, 40] by call to `ngx_hash_init` 
  389.         }
  390. 
  391.         buckets[i] = (ngx_hash_elt_t *) elts;
               ^
  392.         elts += test[i];
  393. 
