char *uwsgi_expand_path(char *dir, int dir_len, char *ptr) {
	if (dir_len > PATH_MAX)
	{
		uwsgi_log("invalid path size: %d (max %d)\n", dir_len, PATH_MAX);
		return NULL;
	}
	char *src = uwsgi_concat2n(dir, dir_len, "", 0);
	char *dst = ptr;
	if (!dst)
		dst = uwsgi_malloc(PATH_MAX + 1);
	if (!realpath(src, dst)) {
		uwsgi_error_realpath(src);
		if (!ptr)
			free(dst);
		free(src);
		return NULL;
	}
	free(src);
	return dst;
}
The software writes data past the end, or before the beginning, of the intended buffer.