src/http/modules/ngx_http_referer_module.c:280: error: Buffer Overrun L3
  Offset: [0, 2070] (⇐ [0, 24] + [0, 2046]) Size: [0, +oo] by call to `ngx_hash_init`.

src/http/modules/ngx_http_referer_module.c:271:5: Assignment
269. 
270.     hash.key = ngx_hash_key_lc;
271.     hash.max_size = 2048; /* TODO: referer_hash_max_size; */
         ^
272.     hash.bucket_size = 64; /* TODO: referer_hash_bucket_size; */
273.     hash.name = "referers_hash";

src/http/modules/ngx_http_referer_module.c:280:13: Call
278.         hash.temp_pool = NULL;
279. 
280.         if (ngx_hash_init(&hash, conf->keys->keys.elts, conf->keys->keys.nelts)
                 ^
281.             != NGX_OK)
282.         {

src/core/ngx_hash.c:250:1: <Offset trace>
248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
249. 
250. ngx_int_t
     ^
251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
252. {

src/core/ngx_hash.c:250:1: Parameter `hinit->max_size`
  248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
  249. 
  250. ngx_int_t
       ^
  251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  252. {

src/core/ngx_hash.c:250:1: <Length trace>
248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
249. 
250. ngx_int_t
     ^
251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
252. {

src/core/ngx_hash.c:250:1: Parameter `hinit->max_size`
  248.     (sizeof(void *) + ngx_align((name)->key.len + 1, sizeof(void *)))
  249. 
  250. ngx_int_t
       ^
  251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
  252. {

src/core/ngx_hash.c:371:19: Call
  369. 
  370.     } else {
  371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
                         ^
  372.         if (buckets == NULL) {
  373.             ngx_free(test);

src/core/ngx_palloc.c:283:1: Parameter `size`
    281. 
    282. 
    283. void *
         ^
    284. ngx_pcalloc(ngx_pool_t *pool, size_t size)
    285. {

src/core/ngx_palloc.c:288:9: Call
    286.     void *p;
    287. 
    288.     p = ngx_palloc(pool, size);
                 ^
    289.     if (p) {
    290.         ngx_memzero(p, size);

src/core/ngx_palloc.c:125:13: Assignment
      123. 
      124.         do {
      125.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                       ^
      126. 
      127.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:130:17: Assignment
      128.                 p->d.last = m + size;
      129. 
      130.                 return m;
                           ^
      131.             }
      132. 

src/core/ngx_palloc.c:288:5: Assignment
    286.     void *p;
    287. 
    288.     p = ngx_palloc(pool, size);
             ^
    289.     if (p) {
    290.         ngx_memzero(p, size);

src/core/ngx_palloc.c:293:5: Assignment
    291.     }
    292. 
    293.     return p;
             ^
    294. }
    295. 

src/core/ngx_hash.c:371:9: Assignment
  369. 
  370.     } else {
  371.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
               ^
  372.         if (buckets == NULL) {
  373.             ngx_free(test);

src/core/ngx_hash.c:391:9: Array access: Offset: [0, 2070] (⇐ [0, 24] + [0, 2046]) Size: [0, +oo] by call to `ngx_hash_init` 
  389.         }
  390. 
  391.         buckets[i] = (ngx_hash_elt_t *) elts;
               ^
  392.         elts += test[i];
  393. 
