src/core/ngx_crypt.c:220: error: Buffer Overrun L3
  Offset: 19 Size: [0, +oo] by call to `ngx_sha1_final`.

src/core/ngx_crypt.c:202:11: Assignment
200.     encoded.len = ngx_strlen(encoded.data);
201. 
202.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
               ^
203. 
204.     decoded.data = ngx_pnalloc(pool, len);

src/core/ngx_crypt.c:202:5: Assignment
200.     encoded.len = ngx_strlen(encoded.data);
201. 
202.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
         ^
203. 
204.     decoded.data = ngx_pnalloc(pool, len);

src/core/ngx_crypt.c:204:20: Call
202.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
203. 
204.     decoded.data = ngx_pnalloc(pool, len);
                        ^
205.     if (decoded.data == NULL) {
206.         return NGX_ERROR;

src/core/ngx_palloc.c:140:16: Call
  138. #if !(NGX_DEBUG_PALLOC)
  139.     if (size <= pool->max) {
  140.         return ngx_palloc_small(pool, size, 0);
                      ^
  141.     }
  142. #endif

src/core/ngx_palloc.c:157:9: Assignment
    155. 
    156.     do {
    157.         m = p->d.last;
                 ^
    158. 
    159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
    164.             p->d.last = m + size;
    165. 
    166.             return m;
                     ^
    167.         }
    168. 

src/core/ngx_palloc.c:140:9: Assignment
  138. #if !(NGX_DEBUG_PALLOC)
  139.     if (size <= pool->max) {
  140.         return ngx_palloc_small(pool, size, 0);
               ^
  141.     }
  142. #endif

src/core/ngx_crypt.c:204:5: Assignment
202.     len = ngx_max(ngx_base64_decoded_length(encoded.len), 20);
203. 
204.     decoded.data = ngx_pnalloc(pool, len);
         ^
205.     if (decoded.data == NULL) {
206.         return NGX_ERROR;

src/core/ngx_crypt.c:220:5: Call
218.     ngx_sha1_update(&sha1, key, ngx_strlen(key));
219.     ngx_sha1_update(&sha1, decoded.data + 20, decoded.len - 20);
220.     ngx_sha1_final(decoded.data, &sha1);
         ^
221. 
222.     /* encode it back to base64 */

src/core/ngx_sha1.c:63:1: <Length trace>
61. 
62. 
63. void
    ^
64. ngx_sha1_final(u_char result[20], ngx_sha1_t *ctx)
65. {

src/core/ngx_sha1.c:63:1: Parameter `*result`
  61. 
  62. 
  63. void
      ^
  64. ngx_sha1_final(u_char result[20], ngx_sha1_t *ctx)
  65. {

src/core/ngx_sha1.c:114:5: Array access: Offset: 19 Size: [0, +oo] by call to `ngx_sha1_final` 
  112.     result[17] = (u_char) (ctx->e >> 16);
  113.     result[18] = (u_char) (ctx->e >> 8);
  114.     result[19] = (u_char) ctx->e;
           ^
  115. 
  116.     ngx_memzero(ctx, sizeof(*ctx));
