src/http/modules/ngx_http_ssi_filter_module.c:2171: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_ssi_filter_module.c:2084:1: Global `ngx_http_ssi_none.len`
2082. 
2083. 
2084. static ngx_int_t
      ^
2085. ngx_http_ssi_echo(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,
2086.     ngx_str_t **params)

src/http/modules/ngx_http_ssi_filter_module.c:2166:17: Call
2164. 
2165.         if (len) {
2166.             p = ngx_pnalloc(r->pool, value->len + len);
                      ^
2167.             if (p == NULL) {
2168.                 return NGX_HTTP_SSI_ERROR;

src/core/ngx_palloc.c:156:13: Assignment
  154. 
  155.         do {
  156.             m = p->d.last;
                   ^
  157. 
  158.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:161:17: Assignment
  159.                 p->d.last = m + size;
  160. 
  161.                 return m;
                       ^
  162.             }
  163. 

src/http/modules/ngx_http_ssi_filter_module.c:2166:13: Assignment
2164. 
2165.         if (len) {
2166.             p = ngx_pnalloc(r->pool, value->len + len);
                  ^
2167.             if (p == NULL) {
2168.                 return NGX_HTTP_SSI_ERROR;

src/http/modules/ngx_http_ssi_filter_module.c:2171:20: Call
2169.             }
2170. 
2171.             (void) ngx_escape_uri(p, value->data, value->len, NGX_ESCAPE_HTML);
                         ^
2172.         }
2173. 

src/core/ngx_string.c:1299:1: <Length trace>
1297. 
1298. 
1299. uintptr_t
      ^
1300. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1301. {

src/core/ngx_string.c:1299:1: Parameter `*dst`
  1297. 
  1298. 
  1299. uintptr_t
        ^
  1300. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1301. {

src/core/ngx_string.c:1433:14: Assignment
  1431.     while (size) {
  1432.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1433.             *dst++ = '%';
                     ^
  1434.             *dst++ = hex[*src >> 4];
  1435.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1434:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1432.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1433.             *dst++ = '%';
  1434.             *dst++ = hex[*src >> 4];
                    ^
  1435.             *dst++ = hex[*src & 0xf];
  1436.             src++;
