src/http/ngx_http.c:436: error: Buffer Overrun L3
  Offset: [0, 535] (⇐ [0, 24] + [0, 511]) Size: [0, 4120] by call to `ngx_hash_init`.

src/http/ngx_http.c:430:5: Assignment
428.     hash.hash = &cmcf->headers_in_hash;
429.     hash.key = ngx_hash_key_lc;
430.     hash.max_size = 512;
         ^
431.     hash.bucket_size = ngx_align(64, ngx_cacheline_size);
432.     hash.name = "headers_in_hash";

src/http/ngx_http.c:436:9: Call
434.     hash.temp_pool = NULL;
435. 
436.     if (ngx_hash_init(&hash, headers_in.elts, headers_in.nelts) != NGX_OK) {
             ^
437.         return NGX_ERROR;
438.     }

src/core/ngx_hash.c:251:1: <Offset trace>
249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
250. 
251. ngx_int_t
     ^
252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
253. {

src/core/ngx_hash.c:251:1: Parameter `hinit->max_size`
  249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
  250. 
  251. ngx_int_t
       ^
  252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  253. {

src/core/ngx_hash.c:251:1: <Length trace>
249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
250. 
251. ngx_int_t
     ^
252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
253. {

src/core/ngx_hash.c:251:1: Parameter `hinit->max_size`
  249.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
  250. 
  251. ngx_int_t
       ^
  252. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  253. {

src/core/ngx_hash.c:371:19: Call
  369. 
  370.     } else {
  371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
                         ^
  372.         if (buckets == NULL) {
  373.             ngx_free(test);

src/core/ngx_palloc.c:297:1: Parameter `size`
    295. 
    296. 
    297. void *
         ^
    298. ngx_pcalloc(ngx_pool_t *pool, size_t size)
    299. {

src/core/ngx_palloc.c:302:9: Call
    300.     void *p;
    301. 
    302.     p = ngx_palloc(pool, size);
                 ^
    303.     if (p) {
    304.         ngx_memzero(p, size);

src/core/ngx_palloc.c:127:16: Call
      125. #if !(NGX_DEBUG_PALLOC)
      126.     if (size <= pool->max) {
      127.         return ngx_palloc_small(pool, size, 1);
                          ^
      128.     }
      129. #endif

src/core/ngx_palloc.c:157:9: Assignment
        155. 
        156.     do {
        157.         m = p->d.last;
                     ^
        158. 
        159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
        164.             p->d.last = m + size;
        165. 
        166.             return m;
                         ^
        167.         }
        168. 

src/core/ngx_palloc.c:127:9: Assignment
      125. #if !(NGX_DEBUG_PALLOC)
      126.     if (size <= pool->max) {
      127.         return ngx_palloc_small(pool, size, 1);
                   ^
      128.     }
      129. #endif

src/core/ngx_palloc.c:302:5: Assignment
    300.     void *p;
    301. 
    302.     p = ngx_palloc(pool, size);
             ^
    303.     if (p) {
    304.         ngx_memzero(p, size);

src/core/ngx_palloc.c:307:5: Assignment
    305.     }
    306. 
    307.     return p;
             ^
    308. }
    309. 

src/core/ngx_hash.c:371:9: Assignment
  369. 
  370.     } else {
  371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
               ^
  372.         if (buckets == NULL) {
  373.             ngx_free(test);

src/core/ngx_hash.c:391:9: Array access: Offset: [0, 535] (⇐ [0, 24] + [0, 511]) Size: [0, 4120] by call to `ngx_hash_init` 
  389.         }
  390. 
  391.         buckets[i] = (ngx_hash_elt_t *) elts;
               ^
  392.         elts += test[i];
  393.     }
