src/http/ngx_http_header_filter_module.c:444: error: Buffer Overrun L3
  Offset added: 9 Size: [0, +oo].

src/http/ngx_http_header_filter_module.c:352:9: <Length trace>
350.         }
351. 
352.         len += sizeof("Location: https://") - 1
             ^
353.                + host.len
354.                + r->headers_out.location->value.len + 2;

src/http/ngx_http_header_filter_module.c:352:9: Assignment
350.         }
351. 
352.         len += sizeof("Location: https://") - 1
             ^
353.                + host.len
354.                + r->headers_out.location->value.len + 2;

src/http/ngx_http_header_filter_module.c:383:9: Assignment
381. 
382.     if (r->headers_out.status == NGX_HTTP_SWITCHING_PROTOCOLS) {
383.         len += sizeof("Connection: upgrade" CRLF) - 1;
             ^
384. 
385.     } else if (r->keepalive) {

src/http/ngx_http_header_filter_module.c:438:9: Call
436.     }
437. 
438.     b = ngx_create_temp_buf(r->pool, len);
             ^
439.     if (b == NULL) {
440.         return NGX_ERROR;

src/core/ngx_buf.c:12:1: Parameter `size`
  10. 
  11. 
  12. ngx_buf_t *
      ^
  13. ngx_create_temp_buf(ngx_pool_t *pool, size_t size)
  14. {

src/core/ngx_buf.c:22:16: Call
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
                     ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_palloc.c:127:13: Assignment
    125. 
    126.         do {
    127.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                     ^
    128. 
    129.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:132:17: Assignment
    130.                 p->d.last = m + size;
    131. 
    132.                 return m;
                         ^
    133.             }
    134. 

src/core/ngx_buf.c:22:5: Assignment
  20.     }
  21. 
  22.     b->start = ngx_palloc(pool, size);
          ^
  23.     if (b->start == NULL) {
  24.         return NULL;

src/core/ngx_buf.c:39:5: Assignment
  37. 
  38.     b->pos = b->start;
  39.     b->last = b->start;
          ^
  40.     b->end = b->last + size;
  41.     b->temporary = 1;

src/http/ngx_http_header_filter_module.c:444:15: Array access: Offset added: 9 Size: [0, +oo]
442. 
443.     /* "HTTP/1.x " */
444.     b->last = ngx_cpymem(b->last, "HTTP/1.1 ", sizeof("HTTP/1.x ") - 1);
                   ^
445. 
446.     /* status line */
