src/http/ngx_http_request_body.c:468: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_create_temp_file`.

src/http/ngx_http_request_body.c:443:14: Call
441. 
442.     if (rb->temp_file == NULL) {
443.         tf = ngx_pcalloc(r->pool, sizeof(ngx_temp_file_t));
                  ^
444.         if (tf == NULL) {
445.             return NGX_ERROR;

src/core/ngx_palloc.c:302:9: Call
  300.     void *p;
  301. 
  302.     p = ngx_palloc(pool, size);
               ^
  303.     if (p) {
  304.         ngx_memzero(p, size);

src/core/ngx_palloc.c:131:12: Call
    129. #endif
    130. 
    131.     return ngx_palloc_large(pool, size);
                    ^
    132. }
    133. 

src/core/ngx_palloc.c:220:9: Call
      218.     ngx_pool_large_t  *large;
      219. 
      220.     p = ngx_alloc(size, pool->log);
                   ^
      221.     if (p == NULL) {
      222.         return NULL;

src/os/unix/ngx_alloc.c:17:1: Parameter `log->next->disk_full_time`
        15. 
        16. 
        17. void *
            ^
        18. ngx_alloc(size_t size, ngx_log_t *log)
        19. {

src/http/ngx_http_request_body.c:468:17: Call
466.             /* empty body with r->request_body_in_file_only */
467. 
468.             if (ngx_create_temp_file(&tf->file, tf->path, tf->pool,
                     ^
469.                                      tf->persistent, tf->clean, tf->access)
470.                 != NGX_OK)

src/core/ngx_file.c:140:1: Parameter `path->level[*]`
  138. 
  139. 
  140. ngx_int_t
       ^
  141. ngx_create_temp_file(ngx_file_t *file, ngx_path_t *path, ngx_pool_t *pool,
  142.     ngx_uint_t persistent, ngx_uint_t clean, ngx_uint_t access)

src/core/ngx_file.c:233:13: Call
  231.         }
  232. 
  233.         if (ngx_create_path(file, path) == NGX_ERROR) {
                   ^
  234.             return NGX_ERROR;
  235.         }

src/core/ngx_file.c:265:1: <Offset trace>
263. 
264. 
265. ngx_int_t
     ^
266. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
267. {

src/core/ngx_file.c:265:1: Parameter `path->level[*]`
    263. 
    264. 
    265. ngx_int_t
         ^
    266. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
    267. {

src/core/ngx_file.c:279:9: Assignment
    277.         }
    278. 
    279.         pos += path->level[i] + 1;
                 ^
    280. 
    281.         file->name.data[pos] = '\0';

src/core/ngx_file.c:265:1: <Length trace>
263. 
264. 
265. ngx_int_t
     ^
266. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
267. {

src/core/ngx_file.c:265:1: Parameter `*file->name.data`
    263. 
    264. 
    265. ngx_int_t
         ^
    266. ngx_create_path(ngx_file_t *file, ngx_path_t *path)
    267. {

src/core/ngx_file.c:296:9: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_create_temp_file` 
    294.         }
    295. 
    296.         file->name.data[pos] = '/';
                 ^
    297.     }
    298. 
