src/http/modules/ngx_http_ssi_filter_module.c:2330: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_ssi_filter_module.c:2243:1: Global `ngx_http_ssi_none.len`
2241. 
2242. 
2243. static ngx_int_t
      ^
2244. ngx_http_ssi_echo(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,
2245.     ngx_str_t **params)

src/http/modules/ngx_http_ssi_filter_module.c:2325:17: Call
2323. 
2324.         if (len) {
2325.             p = ngx_pnalloc(r->pool, value->len + len);
                      ^
2326.             if (p == NULL) {
2327.                 return NGX_HTTP_SSI_ERROR;

src/core/ngx_palloc.c:140:16: Call
  138. #if !(NGX_DEBUG_PALLOC)
  139.     if (size <= pool->max) {
  140.         return ngx_palloc_small(pool, size, 0);
                      ^
  141.     }
  142. #endif

src/core/ngx_palloc.c:157:9: Assignment
    155. 
    156.     do {
    157.         m = p->d.last;
                 ^
    158. 
    159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
    164.             p->d.last = m + size;
    165. 
    166.             return m;
                     ^
    167.         }
    168. 

src/core/ngx_palloc.c:140:9: Assignment
  138. #if !(NGX_DEBUG_PALLOC)
  139.     if (size <= pool->max) {
  140.         return ngx_palloc_small(pool, size, 0);
               ^
  141.     }
  142. #endif

src/http/modules/ngx_http_ssi_filter_module.c:2325:13: Assignment
2323. 
2324.         if (len) {
2325.             p = ngx_pnalloc(r->pool, value->len + len);
                  ^
2326.             if (p == NULL) {
2327.                 return NGX_HTTP_SSI_ERROR;

src/http/modules/ngx_http_ssi_filter_module.c:2330:20: Call
2328.             }
2329. 
2330.             (void) ngx_escape_uri(p, value->data, value->len, NGX_ESCAPE_HTML);
                         ^
2331.         }
2332. 

src/core/ngx_string.c:1424:1: <Length trace>
1422. 
1423. 
1424. uintptr_t
      ^
1425. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1426. {

src/core/ngx_string.c:1424:1: Parameter `*dst`
  1422. 
  1423. 
  1424. uintptr_t
        ^
  1425. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1426. {

src/core/ngx_string.c:1578:14: Assignment
  1576.     while (size) {
  1577.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1578.             *dst++ = '%';
                     ^
  1579.             *dst++ = hex[*src >> 4];
  1580.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1579:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1577.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1578.             *dst++ = '%';
  1579.             *dst++ = hex[*src >> 4];
                    ^
  1580.             *dst++ = hex[*src & 0xf];
  1581.             src++;
