src/http/modules/ngx_http_userid_filter_module.c:285: error: Buffer Overrun L3
  Offset: [0, 65535] Size: [33, +oo] by call to `ngx_http_userid_variable`.

src/http/modules/ngx_http_userid_filter_module.c:285:12: Call
283.     conf = ngx_http_get_module_loc_conf(r, ngx_http_userid_filter_module);
284. 
285.     return ngx_http_userid_variable(r, v, &conf->name, ctx->uid_set);
                ^
286. }
287. 

src/http/modules/ngx_http_userid_filter_module.c:521:1: Parameter `name->len`
  519. 
  520. 
  521. static ngx_int_t
       ^
  522. ngx_http_userid_variable(ngx_http_request_t *r, ngx_http_variable_value_t *v,
  523.     ngx_str_t *name, uint32_t *uid)

src/http/modules/ngx_http_userid_filter_module.c:525:5: Assignment
  523.     ngx_str_t *name, uint32_t *uid)
  524. {
  525.     v->len = name->len + sizeof("=00001111222233334444555566667777") - 1;
           ^
  526.     v->data = ngx_pnalloc(r->pool, v->len);
  527.     if (v->data == NULL) {

src/http/modules/ngx_http_userid_filter_module.c:526:15: Call
  524. {
  525.     v->len = name->len + sizeof("=00001111222233334444555566667777") - 1;
  526.     v->data = ngx_pnalloc(r->pool, v->len);
                     ^
  527.     if (v->data == NULL) {
  528.         return NGX_ERROR;

src/core/ngx_palloc.c:155:13: Assignment
    153. 
    154.         do {
    155.             m = p->d.last;
                     ^
    156. 
    157.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:160:17: Assignment
    158.                 p->d.last = m + size;
    159. 
    160.                 return m;
                         ^
    161.             }
    162. 

src/http/modules/ngx_http_userid_filter_module.c:526:5: Assignment
  524. {
  525.     v->len = name->len + sizeof("=00001111222233334444555566667777") - 1;
  526.     v->data = ngx_pnalloc(r->pool, v->len);
           ^
  527.     if (v->data == NULL) {
  528.         return NGX_ERROR;

src/http/modules/ngx_http_userid_filter_module.c:535:5: Call
  533.     v->not_found = 0;
  534. 
  535.     ngx_sprintf(v->data, "%V=%08XD%08XD%08XD%08XD",
           ^
  536.                 name, uid[0], uid[1], uid[2], uid[3]);
  537. 

src/core/ngx_string.c:95:1: Parameter `*buf`
    93. 
    94. 
    95. u_char * ngx_cdecl
        ^
    96. ngx_sprintf(u_char *buf, const char *fmt, ...)
    97. {

src/core/ngx_string.c:102:9: Call
    100. 
    101.     va_start(args, fmt);
    102.     p = ngx_vsnprintf(buf, /* STUB */ 65536, fmt, args);
                 ^
    103.     va_end(args);
    104. 

src/core/ngx_string.c:123:1: <Length trace>
121. 
122. 
123. u_char *
     ^
124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
125. {

src/core/ngx_string.c:123:1: Parameter `*buf`
      121. 
      122. 
      123. u_char *
           ^
      124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
      125. {

src/core/ngx_string.c:244:25: Array access: Offset: [0, 65535] Size: [33, +oo] by call to `ngx_http_userid_variable` 
      242.                 if (slen == (size_t) -1) {
      243.                     while (*p && buf < last) {
      244.                         *buf++ = *p++;
                                   ^
      245.                     }
      246. 
