src/http/modules/ngx_http_ssi_filter_module.c:2178: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_ssi_filter_module.c:2090:1: Global `ngx_http_ssi_none.len`
2088. 
2089. 
2090. static ngx_int_t
      ^
2091. ngx_http_ssi_echo(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,
2092.     ngx_str_t **params)

src/http/modules/ngx_http_ssi_filter_module.c:2173:17: Call
2171. 
2172.         if (len) {
2173.             p = ngx_pnalloc(r->pool, value->len + len);
                      ^
2174.             if (p == NULL) {
2175.                 return NGX_HTTP_SSI_ERROR;

src/core/ngx_palloc.c:155:13: Assignment
  153. 
  154.         do {
  155.             m = p->d.last;
                   ^
  156. 
  157.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:160:17: Assignment
  158.                 p->d.last = m + size;
  159. 
  160.                 return m;
                       ^
  161.             }
  162. 

src/http/modules/ngx_http_ssi_filter_module.c:2173:13: Assignment
2171. 
2172.         if (len) {
2173.             p = ngx_pnalloc(r->pool, value->len + len);
                  ^
2174.             if (p == NULL) {
2175.                 return NGX_HTTP_SSI_ERROR;

src/http/modules/ngx_http_ssi_filter_module.c:2178:20: Call
2176.             }
2177. 
2178.             (void) ngx_escape_uri(p, value->data, value->len, NGX_ESCAPE_HTML);
                         ^
2179. 
2180.             value->len += len;

src/core/ngx_string.c:1213:1: <Length trace>
1211. 
1212. 
1213. uintptr_t
      ^
1214. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1215. {

src/core/ngx_string.c:1213:1: Parameter `*dst`
  1211. 
  1212. 
  1213. uintptr_t
        ^
  1214. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1215. {

src/core/ngx_string.c:1346:14: Assignment
  1344.     for (i = 0; i < size; i++) {
  1345.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1346.             *dst++ = '%';
                     ^
  1347.             *dst++ = hex[*src >> 4];
  1348.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1347:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1345.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1346.             *dst++ = '%';
  1347.             *dst++ = hex[*src >> 4];
                    ^
  1348.             *dst++ = hex[*src & 0xf];
  1349.             src++;
