src/http/modules/ngx_http_fastcgi_module.c:2257: error: Buffer Overrun L3
  Offset: [0, 534] (⇐ [0, 24] + [0, 510]) Size: [0, +oo] by call to `ngx_http_upstream_hide_headers_hash`.

src/http/modules/ngx_http_fastcgi_module.c:2253:5: Assignment
2251.     ngx_conf_merge_str_value(conf->index, prev->index, "");
2252. 
2253.     hash.max_size = 512;
          ^
2254.     hash.bucket_size = ngx_align(64, ngx_cacheline_size);
2255.     hash.name = "fastcgi_hide_headers_hash";

src/http/modules/ngx_http_fastcgi_module.c:2257:9: Call
2255.     hash.name = "fastcgi_hide_headers_hash";
2256. 
2257.     if (ngx_http_upstream_hide_headers_hash(cf, &conf->upstream,
              ^
2258.              &prev->upstream, ngx_http_fastcgi_hide_headers, &hash)
2259.         != NGX_OK)

src/http/ngx_http_upstream.c:4333:1: Parameter `hash->max_size`
  4331. 
  4332. 
  4333. ngx_int_t
        ^
  4334. ngx_http_upstream_hide_headers_hash(ngx_conf_t *cf,
  4335.     ngx_http_upstream_conf_t *conf, ngx_http_upstream_conf_t *prev,

src/http/ngx_http_upstream.c:4441:12: Call
  4439.     hash->temp_pool = NULL;
  4440. 
  4441.     return ngx_hash_init(hash, hide_headers.elts, hide_headers.nelts);
                   ^
  4442. }
  4443. 

src/core/ngx_hash.c:250:1: <Offset trace>
248.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
249. 
250. ngx_int_t
     ^
251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
252. {

src/core/ngx_hash.c:250:1: Parameter `hinit->max_size`
    248.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
    249. 
    250. ngx_int_t
         ^
    251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
    252. {

src/core/ngx_hash.c:250:1: <Length trace>
248.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
249. 
250. ngx_int_t
     ^
251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
252. {

src/core/ngx_hash.c:250:1: Parameter `hinit->max_size`
    248.     (sizeof(void *) + ngx_align((name)->key.len + 2, sizeof(void *)))
    249. 
    250. ngx_int_t
         ^
    251. ngx_hash_init(ngx_hash_init_t *hinit, ngx_hash_key_t *names, ngx_uint_t nelts)
    252. {

src/core/ngx_hash.c:363:19: Call
    361. 
    362.     } else {
    363.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
                           ^
    364.         if (buckets == NULL) {
    365.             ngx_free(test);

src/core/ngx_palloc.c:299:1: Parameter `size`
      297. 
      298. 
      299. void *
           ^
      300. ngx_pcalloc(ngx_pool_t *pool, size_t size)
      301. {

src/core/ngx_palloc.c:304:9: Call
      302.     void *p;
      303. 
      304.     p = ngx_palloc(pool, size);
                   ^
      305.     if (p) {
      306.         ngx_memzero(p, size);

src/core/ngx_palloc.c:126:13: Assignment
        124. 
        125.         do {
        126.             m = ngx_align_ptr(p->d.last, NGX_ALIGNMENT);
                         ^
        127. 
        128.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:131:17: Assignment
        129.                 p->d.last = m + size;
        130. 
        131.                 return m;
                             ^
        132.             }
        133. 

src/core/ngx_palloc.c:304:5: Assignment
      302.     void *p;
      303. 
      304.     p = ngx_palloc(pool, size);
               ^
      305.     if (p) {
      306.         ngx_memzero(p, size);

src/core/ngx_palloc.c:309:5: Assignment
      307.     }
      308. 
      309.     return p;
               ^
      310. }
      311. 

src/core/ngx_hash.c:363:9: Assignment
    361. 
    362.     } else {
    363.         buckets = ngx_pcalloc(hinit->pool, size * sizeof(ngx_hash_elt_t *));
                 ^
    364.         if (buckets == NULL) {
    365.             ngx_free(test);

src/core/ngx_hash.c:383:9: Array access: Offset: [0, 534] (⇐ [0, 24] + [0, 510]) Size: [0, +oo] by call to `ngx_http_upstream_hide_headers_hash` 
    381.         }
    382. 
    383.         buckets[i] = (ngx_hash_elt_t *) elts;
                 ^
    384.         elts += test[i];
    385. 
