src/http/modules/ngx_http_fastcgi_module.c:3073: error: Buffer Overrun L3
  Offset: [0, 535] (⇐ [0, 24] + [0, 511]) Size: [0, 4120] by call to `ngx_http_upstream_hide_headers_hash`.

src/http/modules/ngx_http_fastcgi_module.c:3069:5: Assignment
3067.     ngx_conf_merge_str_value(conf->index, prev->index, "");
3068. 
3069.     hash.max_size = 512;
          ^
3070.     hash.bucket_size = ngx_align(64, ngx_cacheline_size);
3071.     hash.name = "fastcgi_hide_headers_hash";

src/http/modules/ngx_http_fastcgi_module.c:3073:9: Call
3071.     hash.name = "fastcgi_hide_headers_hash";
3072. 
3073.     if (ngx_http_upstream_hide_headers_hash(cf, &conf->upstream,
              ^
3074.              &prev->upstream, ngx_http_fastcgi_hide_headers, &hash)
3075.         != NGX_OK)

src/http/ngx_http_upstream.c:6009:1: Parameter `hash->max_size`
  6007. 
  6008. 
  6009. ngx_int_t
        ^
  6010. ngx_http_upstream_hide_headers_hash(ngx_conf_t *cf,
  6011.     ngx_http_upstream_conf_t *conf, ngx_http_upstream_conf_t *prev,

src/http/ngx_http_upstream.c:6112:9: Call
  6110.     hash->temp_pool = NULL;
  6111. 
  6112.     if (ngx_hash_init(hash, hide_headers.elts, hide_headers.nelts) != NGX_OK) {
                ^
  6113.         return NGX_ERROR;
  6114.     }

src/core/ngx_hash.c:251:1: <Offset trace>
249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
250. 
251. ngx_int_t
     ^
252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
253. {

src/core/ngx_hash.c:251:1: Parameter `hinit->max_size`
    249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
    250. 
    251. ngx_int_t
         ^
    252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
    253. {

src/core/ngx_hash.c:251:1: <Length trace>
249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
250. 
251. ngx_int_t
     ^
252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
253. {

src/core/ngx_hash.c:251:1: Parameter `hinit->max_size`
    249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
    250. 
    251. ngx_int_t
         ^
    252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
    253. {

src/core/ngx_hash.c:371:19: Call
    369. 
    370.     } else {
    371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
                           ^
    372.         if (buckets == NULL) {
    373.             ngx_free(test);

src/core/ngx_palloc.c:297:1: Parameter `size`
      295. 
      296. 
      297. void *
           ^
      298. ngx_pcalloc(ngx_pool_t *pool, size_t size)
      299. {

src/core/ngx_palloc.c:302:9: Call
      300.     void *p;
      301. 
      302.     p = ngx_palloc(pool, size);
                   ^
      303.     if (p) {
      304.         ngx_memzero(p, size);

src/core/ngx_palloc.c:127:16: Call
        125. #if !(NGX_DEBUG_PALLOC)
        126.     if (size <= pool->max) {
        127.         return ngx_palloc_small(pool, size, 1);
                            ^
        128.     }
        129. #endif

src/core/ngx_palloc.c:157:9: Assignment
          155. 
          156.     do {
          157.         m = p->d.last;
                       ^
          158. 
          159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
          164.             p->d.last = m + size;
          165. 
          166.             return m;
                           ^
          167.         }
          168. 

src/core/ngx_palloc.c:127:9: Assignment
        125. #if !(NGX_DEBUG_PALLOC)
        126.     if (size <= pool->max) {
        127.         return ngx_palloc_small(pool, size, 1);
                     ^
        128.     }
        129. #endif

src/core/ngx_palloc.c:302:5: Assignment
      300.     void *p;
      301. 
      302.     p = ngx_palloc(pool, size);
               ^
      303.     if (p) {
      304.         ngx_memzero(p, size);

src/core/ngx_palloc.c:307:5: Assignment
      305.     }
      306. 
      307.     return p;
               ^
      308. }
      309. 

src/core/ngx_hash.c:371:9: Assignment
    369. 
    370.     } else {
    371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
                 ^
    372.         if (buckets == NULL) {
    373.             ngx_free(test);

src/core/ngx_hash.c:391:9: Array access: Offset: [0, 535] (⇐ [0, 24] + [0, 511]) Size: [0, 4120] by call to `ngx_http_upstream_hide_headers_hash` 
    389.         }
    390. 
    391.         buckets[i] = (ngx_hash_elt_t *) elts;
                 ^
    392.         elts += test[i];
    393.     }
