server/apreq_module_cgi.c:558: error: BUFFER_OVERRUN_L1
  Offset: [9, +oo] (⇐ [0, +oo] + 9) Size: 8 by call to `prompt`.

server/apreq_module_cgi.c:558:19: Call
556.             }
557.             name = apr_pstrdup(handle->pool, buf);
558.             val = prompt(handle, name, "parameter");
                       ^
559.             if (val == NULL)
560.                 val = "";

server/apreq_module_cgi.c:142:1: <Offset trace>
140.    
141. */
142. static char *prompt(apreq_handle_t *handle, const char *name,
     ^
143.                     const char *type) {
144.     struct cgi_handle *req = (struct cgi_handle *)handle;

server/apreq_module_cgi.c:142:1: Parameter `type->strlen`
  140.    
  141. */
  142. static char *prompt(apreq_handle_t *handle, const char *name,
       ^
  143.                     const char *type) {
  144.     struct cgi_handle *req = (struct cgi_handle *)handle;

server/apreq_module_cgi.c:142:1: <Length trace>
140.    
141. */
142. static char *prompt(apreq_handle_t *handle, const char *name,
     ^
143.                     const char *type) {
144.     struct cgi_handle *req = (struct cgi_handle *)handle;

server/apreq_module_cgi.c:142:1: Array declaration
  140.    
  141. */
  142. static char *prompt(apreq_handle_t *handle, const char *name,
       ^
  143.                     const char *type) {
  144.     struct cgi_handle *req = (struct cgi_handle *)handle;

server/apreq_module_cgi.c:156:5: Assignment
  154.     cprompt = req->promptstr - 1;
  155.     *buf[0] = plevel = 0;
  156.     start = buf[0];
           ^
  157. 
  158.     while (*(++cprompt) != 0) {

server/apreq_module_cgi.c:165:21: Array access: Offset: [9, +oo] (⇐ [0, +oo] + 9) Size: 8 by call to `prompt` 
  163.             case 't':
  164.                 if (type != NULL) {
  165.                     strcpy(start, type);
                           ^
  166.                     start += strlen(type);
  167.                     curarg[plevel] = 1;
