src/core/ngx_crypt.c:238: error: Buffer Overrun L3
  Offset: [2, +oo] (⇐ [0, +oo] + 2) Size: [0, +oo] by call to `ngx_encode_base64`.

src/core/ngx_crypt.c:208:11: Assignment
206.     encoded.len = ngx_strlen(encoded.data);
207. 
208.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
               ^
209. 
210.     decoded.data = ngx_pnalloc(pool, len);

src/core/ngx_crypt.c:208:5: Assignment
206.     encoded.len = ngx_strlen(encoded.data);
207. 
208.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
         ^
209. 
210.     decoded.data = ngx_pnalloc(pool, len);

src/core/ngx_crypt.c:210:20: Call
208.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
209. 
210.     decoded.data = ngx_pnalloc(pool, len);
                        ^
211.     if (decoded.data == NULL) {
212.         return NGX_ERROR;

src/core/ngx_palloc.c:157:13: Assignment
  155. 
  156.         do {
  157.             m = p->d.last;
                   ^
  158. 
  159.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:162:17: Assignment
  160.                 p->d.last = m + size;
  161. 
  162.                 return m;
                       ^
  163.             }
  164. 

src/core/ngx_crypt.c:210:5: Assignment
208.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
209. 
210.     decoded.data = ngx_pnalloc(pool, len);
         ^
211.     if (decoded.data == NULL) {
212.         return NGX_ERROR;

src/core/ngx_crypt.c:238:5: Call
236. 
237.     encoded.data = ngx_cpymem(*encrypted, "{SSHA}", sizeof("{SSHA}") - 1);
238.     ngx_encode_base64(&encoded, &decoded);
         ^
239.     encoded.data[encoded.len] = '\0';
240. 

src/core/ngx_string.c:1060:1: <Length trace>
1058. 
1059. 
1060. void
      ^
1061. ngx_encode_base64(ngx_str_t *dst, ngx_str_t *src)
1062. {

src/core/ngx_string.c:1060:1: Parameter `*src->data`
  1058. 
  1059. 
  1060. void
        ^
  1061. ngx_encode_base64(ngx_str_t *dst, ngx_str_t *src)
  1062. {

src/core/ngx_string.c:1069:5: Assignment
  1067. 
  1068.     len = src->len;
  1069.     s = src->data;
            ^
  1070.     d = dst->data;
  1071. 

src/core/ngx_string.c:1075:48: Array access: Offset: [2, +oo] (⇐ [0, +oo] + 2) Size: [0, +oo] by call to `ngx_encode_base64` 
  1073.         *d++ = basis64[(s[0] >> 2) & 0x3f];
  1074.         *d++ = basis64[((s[0] & 3) << 4) | (s[1] >> 4)];
  1075.         *d++ = basis64[((s[1] & 0x0f) << 2) | (s[2] >> 6)];
                                                       ^
  1076.         *d++ = basis64[s[2] & 0x3f];
  1077. 
