src/http/ngx_http_variables.c:1791: error: Buffer Overrun L3
  Offset: 0 Size: [0, 2] by call to `ngx_hash_init`.

src/http/ngx_http_variables.c:1730:13: Assignment
1728.         if (ngx_strncmp(v[i].name.data, "http_", 5) == 0) {
1729.             v[i].get_handler = ngx_http_variable_unknown_header_in;
1730.             v[i].data = (uintptr_t) &v[i].name;
                  ^
1731. 
1732.             continue;

src/http/ngx_http_variables.c:1785:5: Assignment
1783.     hash.hash = &cmcf->variables_hash;
1784.     hash.key = ngx_hash_key;
1785.     hash.max_size = cmcf->variables_hash_max_size;
          ^
1786.     hash.bucket_size = cmcf->variables_hash_bucket_size;
1787.     hash.name = "variables_hash";

src/http/ngx_http_variables.c:1791:9: Call
1789.     hash.temp_pool = NULL;
1790. 
1791.     if (ngx_hash_init(&hash, cmcf->variables_keys->keys.elts,
              ^
1792.                       cmcf->variables_keys->keys.nelts)
1793.         != NGX_OK)

src/core/ngx_hash.c:250:1: <Offset trace>
248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
249. 
250. ngx_int_t
     ^
251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
252. {

src/core/ngx_hash.c:250:1: Parameter `hinit->max_size`
  248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
  249. 
  250. ngx_int_t
       ^
  251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  252. {

src/core/ngx_hash.c:250:1: <Length trace>
248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
249. 
250. ngx_int_t
     ^
251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
252. {

src/core/ngx_hash.c:250:1: Parameter `hinit->max_size`
  248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
  249. 
  250. ngx_int_t
       ^
  251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  252. {

src/core/ngx_hash.c:278:12: Call
  276.     }
  277. 
  278.     test = ngx_alloc(hinit->max_size * sizeof(u_short), hinit->pool->log);
                  ^
  279.     if (test == NULL) {
  280.         return NGX_ERROR;

src/os/unix/ngx_alloc.c:16:1: Parameter `size`
    14. 
    15. 
    16. void *
        ^
    17. ngx_alloc(size_t size, ngx_log_t *log)
    18. {

src/os/unix/ngx_alloc.c:21:9: Array declaration
    19.     void  *p;
    20. 
    21.     p = malloc(size);
                ^
    22.     if (p == NULL) {
    23.         ngx_log_error(NGX_LOG_EMERG, log, ngx_errno,

src/os/unix/ngx_alloc.c:21:5: Assignment
    19.     void  *p;
    20. 
    21.     p = malloc(size);
            ^
    22.     if (p == NULL) {
    23.         ngx_log_error(NGX_LOG_EMERG, log, ngx_errno,

src/os/unix/ngx_alloc.c:29:5: Assignment
    27.     ngx_log_debug2(NGX_LOG_DEBUG_ALLOC, log, 0, "malloc: %p:%uz", p, size);
    28. 
    29.     return p;
            ^
    30. }
    31. 

src/core/ngx_hash.c:278:5: Assignment
  276.     }
  277. 
  278.     test = ngx_alloc(hinit->max_size * sizeof(u_short), hinit->pool->log);
           ^
  279.     if (test == NULL) {
  280.         return NGX_ERROR;

src/core/ngx_hash.c:335:9: Array access: Offset: 0 Size: [0, 2] by call to `ngx_hash_init` 
  333. 
  334.     for (i = 0; i < size; i++) {
  335.         test[i] = sizeof(void *);
               ^
  336.     }
  337. 
