src/http/ngx_http_header_filter_module.c:447: error: Buffer Overrun L3
  Offset added: 9 Size: [0, +oo].

src/http/ngx_http_header_filter_module.c:355:9: <Length trace>
353.         }
354. 
355.         len += sizeof("Location: https://") - 1
             ^
356.                + host.len
357.                + r->headers_out.location->value.len + 2;

src/http/ngx_http_header_filter_module.c:355:9: Assignment
353.         }
354. 
355.         len += sizeof("Location: https://") - 1
             ^
356.                + host.len
357.                + r->headers_out.location->value.len + 2;

src/http/ngx_http_header_filter_module.c:386:9: Assignment
384. 
385.     if (r->headers_out.status == NGX_HTTP_SWITCHING_PROTOCOLS) {
386.         len += sizeof("Connection: upgrade" CRLF) - 1;
             ^
387. 
388.     } else if (r->keepalive) {

src/http/ngx_http_header_filter_module.c:441:9: Call
439.     }
440. 
441.     b = ngx_create_temp_buf(r->pool, len);
             ^
442.     if (b == NULL) {
443.         return NGX_ERROR;

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:127:16: Call
    125. #if !(NGX_DEBUG_PALLOC)
    126.     if (size <= pool->max) {
    127.         return ngx_palloc_small(pool, size, 1);
                        ^
    128.     }
    129. #endif

src/core/ngx_palloc.c:157:9: Assignment
      155. 
      156.     do {
      157.         m = p->d.last;
                   ^
      158. 
      159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
      164.             p->d.last = m + size;
      165. 
      166.             return m;
                       ^
      167.         }
      168. 

src/core/ngx_palloc.c:127:9: Assignment
    125. #if !(NGX_DEBUG_PALLOC)
    126.     if (size <= pool->max) {
    127.         return ngx_palloc_small(pool, size, 1);
                 ^
    128.     }
    129. #endif

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:39:5: Assignment
  37. 
  38.     b->pos = b->start;
  39.     b->last = b->start;
          ^
  40.     b->end = b->last + size;
  41.     b->temporary = 1;

src/http/ngx_http_header_filter_module.c:447:15: Array access: Offset added: 9 Size: [0, +oo]
445. 
446.     /* "HTTP/1.x " */
447.     b->last = ngx_cpymem(b->last, "HTTP/1.1 ", sizeof("HTTP/1.x ") - 1);
                   ^
448. 
449.     /* status line */
