src/http/modules/ngx_http_ssi_filter_module.c:2179: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_ssi_filter_module.c:2091:1: Global `ngx_http_ssi_none.len`
2089. 
2090. 
2091. static ngx_int_t
      ^
2092. ngx_http_ssi_echo(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,
2093.     ngx_str_t **params)

src/http/modules/ngx_http_ssi_filter_module.c:2174:17: Call
2172. 
2173.         if (len) {
2174.             p = ngx_pnalloc(r->pool, value->len + len);
                      ^
2175.             if (p == NULL) {
2176.                 return NGX_HTTP_SSI_ERROR;

src/core/ngx_palloc.c:156:13: Assignment
  154. 
  155.         do {
  156.             m = p->d.last;
                   ^
  157. 
  158.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:161:17: Assignment
  159.                 p->d.last = m + size;
  160. 
  161.                 return m;
                       ^
  162.             }
  163. 

src/http/modules/ngx_http_ssi_filter_module.c:2174:13: Assignment
2172. 
2173.         if (len) {
2174.             p = ngx_pnalloc(r->pool, value->len + len);
                  ^
2175.             if (p == NULL) {
2176.                 return NGX_HTTP_SSI_ERROR;

src/http/modules/ngx_http_ssi_filter_module.c:2179:20: Call
2177.             }
2178. 
2179.             (void) ngx_escape_uri(p, value->data, value->len, NGX_ESCAPE_HTML);
                         ^
2180. 
2181.             value->len += len;

src/core/ngx_string.c:1256:1: <Length trace>
1254. 
1255. 
1256. uintptr_t
      ^
1257. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1258. {

src/core/ngx_string.c:1256:1: Parameter `*dst`
  1254. 
  1255. 
  1256. uintptr_t
        ^
  1257. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1258. {

src/core/ngx_string.c:1390:14: Assignment
  1388.     while (size) {
  1389.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1390.             *dst++ = '%';
                     ^
  1391.             *dst++ = hex[*src >> 4];
  1392.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1391:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1389.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1390.             *dst++ = '%';
  1391.             *dst++ = hex[*src >> 4];
                    ^
  1392.             *dst++ = hex[*src & 0xf];
  1393.             src++;
