src/http/ngx_http_special_response.c:684: error: Buffer Overrun L3
  Offset added: 55 Size: [0, +oo].

src/http/ngx_http_special_response.c:645:5: <Length trace>
643.     ngx_chain_t   out;
644. 
645.     len = r->headers_out.location->value.len;
         ^
646.     location = r->headers_out.location->value.data;
647. 

src/http/ngx_http_special_response.c:645:5: Assignment
643.     ngx_chain_t   out;
644. 
645.     len = r->headers_out.location->value.len;
         ^
646.     location = r->headers_out.location->value.data;
647. 

src/http/ngx_http_special_response.c:650:5: Assignment
648.     escape = 2 * ngx_escape_uri(NULL, location, len, NGX_ESCAPE_REFRESH);
649. 
650.     size = sizeof(ngx_http_msie_refresh_head) - 1
         ^
651.            + escape + len
652.            + sizeof(ngx_http_msie_refresh_tail) - 1;

src/http/ngx_http_special_response.c:679:9: Call
677.     }
678. 
679.     b = ngx_create_temp_buf(r->pool, size);
             ^
680.     if (b == NULL) {
681.         return NGX_ERROR;

src/core/ngx_buf.c:11:1: Parameter `size`
   9. 
  10. 
  11. ngx_buf_t *
      ^
  12. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  13. {

src/core/ngx_buf.c:21:16: Call
  19.     }
  20. 
  21.     b->start = ngx_palloc(pool, size);
                     ^
  22.     if (b->start == NULL) {
  23.         return NULL;

src/core/ngx_palloc.c:125:13: Assignment
    123. 
    124.         do {
    125.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                     ^
    126. 
    127.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:130:17: Assignment
    128.                 p->d.last = m + size;
    129. 
    130.                 return m;
                         ^
    131.             }
    132. 

src/core/ngx_buf.c:21:5: Assignment
  19.     }
  20. 
  21.     b->start = ngx_palloc(pool, size);
          ^
  22.     if (b->start == NULL) {
  23.         return NULL;

src/core/ngx_buf.c:37:5: Assignment
  35.      */
  36. 
  37.     b->pos = b->start;
          ^
  38.     b->last = b->start;
  39.     b->end = b->last + size;

src/http/ngx_http_special_response.c:684:9: Array access: Offset added: 55 Size: [0, +oo]
682.     }
683. 
684.     p = ngx_cpymem(b->pos, ngx_http_msie_refresh_head,
             ^
685.                    sizeof(ngx_http_msie_refresh_head) - 1);
686. 
