src/http/ngx_http_upstream.c:3425: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo].

src/http/ngx_http_upstream.c:3393:5: <Length trace>
3391.     }
3392. 
3393.     len = 0;
          ^
3394.     state = r->upstream_states->elts;
3395. 

src/http/ngx_http_upstream.c:3393:5: Assignment
3391.     }
3392. 
3393.     len = 0;
          ^
3394.     state = r->upstream_states->elts;
3395. 

src/http/ngx_http_upstream.c:3405:9: Call
3403.     }
3404. 
3405.     p = ngx_pnalloc(r->pool, len);
              ^
3406.     if (p == NULL) {
3407.         return NGX_ERROR;

src/core/ngx_palloc.c:155:13: Assignment
  153. 
  154.         do {
  155.             m = p->d.last;
                   ^
  156. 
  157.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:160:17: Assignment
  158.                 p->d.last = m + size;
  159. 
  160.                 return m;
                       ^
  161.             }
  162. 

src/http/ngx_http_upstream.c:3405:5: Assignment
3403.     }
3404. 
3405.     p = ngx_pnalloc(r->pool, len);
          ^
3406.     if (p == NULL) {
3407.         return NGX_ERROR;

src/http/ngx_http_upstream.c:3424:14: Assignment
3422. 
3423.         if (state[i].peer) {
3424.             *p++ = ',';
                   ^
3425.             *p++ = ' ';
3426. 

src/http/ngx_http_upstream.c:3425:13: Array access: Offset: [1, +oo] Size: [0, +oo]
3423.         if (state[i].peer) {
3424.             *p++ = ',';
3425.             *p++ = ' ';
                  ^
3426. 
3427.         } else {
