src/http/modules/ngx_http_autoindex_module.c:730: error: Buffer Overrun L3
  Offset added: 16 Size: [0, +oo].

src/http/modules/ngx_http_autoindex_module.c:701:5: <Length trace>
699.     ngx_http_autoindex_entry_t  *entry;
700. 
701.     len = sizeof("[" CRLF CRLF "]") - 1;
         ^
702. 
703.     if (callback) {

src/http/modules/ngx_http_autoindex_module.c:701:5: Assignment
699.     ngx_http_autoindex_entry_t  *entry;
700. 
701.     len = sizeof("[" CRLF CRLF "]") - 1;
         ^
702. 
703.     if (callback) {

src/http/modules/ngx_http_autoindex_module.c:724:9: Call
722.     }
723. 
724.     b = ngx_create_temp_buf(r->pool, len);
             ^
725.     if (b == NULL) {
726.         return NULL;

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:130:13: Assignment
    128. 
    129.         do {
    130.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                     ^
    131. 
    132.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:135:17: Assignment
    133.                 p->d.last = m + size;
    134. 
    135.                 return m;
                         ^
    136.             }
    137. 

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:39:5: Assignment
  37. 
  38.     b->pos = b->start;
  39.     b->last = b->start;
          ^
  40.     b->end = b->last + size;
  41.     b->temporary = 1;

src/http/modules/ngx_http_autoindex_module.c:730:19: Array access: Offset added: 16 Size: [0, +oo]
728. 
729.     if (callback) {
730.         b->last = ngx_cpymem(b->last, "/* callback */" CRLF,
                       ^
731.                              sizeof("/* callback */" CRLF) - 1);
732. 
