src/http/modules/ngx_http_charset_filter_module.c:791: error: Buffer Overrun L3
  Offset: [0, 65535] Size: [0, +oo] by call to `ngx_sprintf`.

src/http/modules/ngx_http_charset_filter_module.c:608:1: Parameter `*buf->last`
606. 
607. 
608. static ngx_chain_t *
     ^
609. ngx_http_charset_recode_from_utf8(ngx_pool_t *pool, ngx_buf_t *buf,
610.     ngx_http_charset_ctx_t *ctx)

src/http/modules/ngx_http_charset_filter_module.c:757:5: Assignment
755.     }
756. 
757.     size = buf->last - buf->pos;
         ^
758. 
759.     if (size < NGX_HTML_ENTITY_LEN) {

src/http/modules/ngx_http_charset_filter_module.c:763:10: Call
761.     }
762. 
763.     cl = ngx_http_charset_get_buffer(pool, ctx, size);
              ^
764.     if (cl == NULL) {
765.         return NULL;

src/http/modules/ngx_http_charset_filter_module.c:1050:1: Parameter `size`
  1048. 
  1049. 
  1050. static ngx_chain_t *
        ^
  1051. ngx_http_charset_get_buffer(ngx_pool_t *pool, ngx_http_charset_ctx_t *ctx,
  1052.     size_t size)

src/http/modules/ngx_http_charset_filter_module.c:1080:15: Call
  1078.     }
  1079. 
  1080.     cl->buf = ngx_create_temp_buf(pool, size);
                      ^
  1081.     if (cl->buf == NULL) {
  1082.         return NULL;

src/core/ngx_buf.c:11:1: Parameter `size`
     9. 
    10. 
    11. ngx_buf_t *
        ^
    12. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
    13. {

src/core/ngx_buf.c:21:16: Call
    19.     }
    20. 
    21.     b->start = ngx_palloc(pool, size);
                       ^
    22.     if (b->start == NULL) {
    23.         return NULL;

src/core/ngx_palloc.c:125:13: Assignment
      123. 
      124.         do {
      125.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                       ^
      126. 
      127.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:130:17: Assignment
      128.                 p->d.last = m + size;
      129. 
      130.                 return m;
                           ^
      131.             }
      132. 

src/core/ngx_buf.c:21:5: Assignment
    19.     }
    20. 
    21.     b->start = ngx_palloc(pool, size);
            ^
    22.     if (b->start == NULL) {
    23.         return NULL;

src/core/ngx_buf.c:37:5: Assignment
    35.      */
    36. 
    37.     b->pos = b->start;
            ^
    38.     b->last = b->start;
    39.     b->end = b->last + size;

src/http/modules/ngx_http_charset_filter_module.c:771:5: Assignment
769. 
770.     b = cl->buf;
771.     dst = b->pos;
         ^
772. 
773.     if (c) {

src/http/modules/ngx_http_charset_filter_module.c:791:15: Call
789. 
790.     } else {
791.         dst = ngx_sprintf(dst, "&#%uD;", n);
                   ^
792.     }
793. 

src/core/ngx_string.c:95:1: Parameter `*buf`
  93. 
  94. 
  95. u_char * ngx_cdecl
      ^
  96. ngx_sprintf(u_char *buf, const char *fmt, ...)
  97. {

src/core/ngx_string.c:102:9: Call
  100. 
  101.     va_start(args, fmt);
  102.     p = ngx_vsnprintf(buf, /* STUB */ 65536, fmt, args);
               ^
  103.     va_end(args);
  104. 

src/core/ngx_string.c:123:1: <Length trace>
121. 
122. 
123. u_char *
     ^
124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
125. {

src/core/ngx_string.c:123:1: Parameter `*buf`
    121. 
    122. 
    123. u_char *
         ^
    124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
    125. {

src/core/ngx_string.c:244:25: Array access: Offset: [0, 65535] Size: [0, +oo] by call to `ngx_sprintf` 
    242.                 if (slen == (size_t) -1) {
    243.                     while (*p && buf < last) {
    244.                         *buf++ = *p++;
                                 ^
    245.                     }
    246. 
