src/http/modules/ngx_http_chunked_filter_module.c:136: error: Buffer Overrun L2
  Offset: [0, 65535] Size: 18 by call to `ngx_sprintf`.

src/http/modules/ngx_http_chunked_filter_module.c:129:17: Call
127.         /* the "0000000000000000" is 64-bit hexadimal string */
128. 
129.         chunk = ngx_palloc(r->pool, sizeof("0000000000000000" CRLF) - 1);
                     ^
130.         if (chunk == NULL) {
131.             return NGX_ERROR;

src/core/ngx_palloc.c:125:13: Assignment
  123. 
  124.         do {
  125.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                   ^
  126. 
  127.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:130:17: Assignment
  128.                 p->d.last = m + size;
  129. 
  130.                 return m;
                       ^
  131.             }
  132. 

src/http/modules/ngx_http_chunked_filter_module.c:129:9: Assignment
127.         /* the "0000000000000000" is 64-bit hexadimal string */
128. 
129.         chunk = ngx_palloc(r->pool, sizeof("0000000000000000" CRLF) - 1);
             ^
130.         if (chunk == NULL) {
131.             return NGX_ERROR;

src/http/modules/ngx_http_chunked_filter_module.c:136:19: Call
134.         b->temporary = 1;
135.         b->pos = chunk;
136.         b->last = ngx_sprintf(chunk, "%xO" CRLF, size);
                       ^
137. 
138.         out.buf = b;

src/core/ngx_string.c:95:1: Parameter `*buf`
  93. 
  94. 
  95. u_char * ngx_cdecl
      ^
  96. ngx_sprintf(u_char *buf, const char *fmt, ...)
  97. {

src/core/ngx_string.c:102:9: Call
  100. 
  101.     va_start(args, fmt);
  102.     p = ngx_vsnprintf(buf, /* STUB */ 65536, fmt, args);
               ^
  103.     va_end(args);
  104. 

src/core/ngx_string.c:123:1: <Length trace>
121. 
122. 
123. u_char *
     ^
124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
125. {

src/core/ngx_string.c:123:1: Parameter `*buf`
    121. 
    122. 
    123. u_char *
         ^
    124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
    125. {

src/core/ngx_string.c:244:25: Array access: Offset: [0, 65535] Size: 18 by call to `ngx_sprintf` 
    242.                 if (slen == (size_t) -1) {
    243.                     while (*p && buf < last) {
    244.                         *buf++ = *p++;
                                 ^
    245.                     }
    246. 
