src/http/ngx_http_special_response.c:769: error: Buffer Overrun L3
  Offset added: 55 Size: [0, +oo].

src/http/ngx_http_special_response.c:729:5: <Length trace>
727.     ngx_chain_t   out;
728. 
729.     len = r->headers_out.location->value.len;
         ^
730.     location = r->headers_out.location->value.data;
731. 

src/http/ngx_http_special_response.c:729:5: Assignment
727.     ngx_chain_t   out;
728. 
729.     len = r->headers_out.location->value.len;
         ^
730.     location = r->headers_out.location->value.data;
731. 

src/http/ngx_http_special_response.c:734:5: Assignment
732.     escape = 2 * ngx_escape_uri(NULL, location, len, NGX_ESCAPE_REFRESH);
733. 
734.     size = sizeof(ngx_http_msie_refresh_head) - 1
         ^
735.            + escape + len
736.            + sizeof(ngx_http_msie_refresh_tail) - 1;

src/http/ngx_http_special_response.c:764:9: Call
762.     }
763. 
764.     b = ngx_create_temp_buf(r->pool, size);
             ^
765.     if (b == NULL) {
766.         return NGX_ERROR;

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:127:16: Call
    125. #if !(NGX_DEBUG_PALLOC)
    126.     if (size <= pool->max) {
    127.         return ngx_palloc_small(pool, size, 1);
                        ^
    128.     }
    129. #endif

src/core/ngx_palloc.c:157:9: Assignment
      155. 
      156.     do {
      157.         m = p->d.last;
                   ^
      158. 
      159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
      164.             p->d.last = m + size;
      165. 
      166.             return m;
                       ^
      167.         }
      168. 

src/core/ngx_palloc.c:127:9: Assignment
    125. #if !(NGX_DEBUG_PALLOC)
    126.     if (size <= pool->max) {
    127.         return ngx_palloc_small(pool, size, 1);
                 ^
    128.     }
    129. #endif

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:38:5: Assignment
  36.      */
  37. 
  38.     b->pos = b->start;
          ^
  39.     b->last = b->start;
  40.     b->end = b->last + size;

src/http/ngx_http_special_response.c:769:9: Array access: Offset added: 55 Size: [0, +oo]
767.     }
768. 
769.     p = ngx_cpymem(b->pos, ngx_http_msie_refresh_head,
             ^
770.                    sizeof(ngx_http_msie_refresh_head) - 1);
771. 
