src/http/modules/ngx_http_proxy_module.c:2378: error: Buffer Overrun S2
  Offset added: [max(1, `prefix`), `prefix`] Size: [0, +oo].

src/http/modules/ngx_http_proxy_module.c:2347:1: <Offset trace>
2345. #if (NGX_PCRE)
2346. 
2347. static ngx_int_t
      ^
2348. ngx_http_proxy_rewrite_redirect_regex(ngx_http_request_t *r, ngx_table_elt_t *h,
2349.     size_t prefix, ngx_http_proxy_redirect_t *pr)

src/http/modules/ngx_http_proxy_module.c:2347:1: Parameter `prefix`
2345. #if (NGX_PCRE)
2346. 
2347. static ngx_int_t
      ^
2348. ngx_http_proxy_rewrite_redirect_regex(ngx_http_request_t *r, ngx_table_elt_t *h,
2349.     size_t prefix, ngx_http_proxy_redirect_t *pr)

src/http/modules/ngx_http_proxy_module.c:2362:9: <Length trace>
2360.     }
2361. 
2362.     if (ngx_http_complex_value(r, &pr->replacement, &replacement) != NGX_OK) {
              ^
2363.         return NGX_ERROR;
2364.     }

src/http/modules/ngx_http_proxy_module.c:2362:9: Call
2360.     }
2361. 
2362.     if (ngx_http_complex_value(r, &pr->replacement, &replacement) != NGX_OK) {
              ^
2363.         return NGX_ERROR;
2364.     }

src/http/ngx_http_script.c:56:1: Parameter `value->len`
  54. 
  55. 
  56. ngx_int_t
      ^
  57. ngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val,
  58.     ngx_str_t *value)

src/http/modules/ngx_http_proxy_module.c:2371:5: Assignment
2369.     }
2370. 
2371.     len = prefix + replacement.len;
          ^
2372. 
2373.     data = ngx_pnalloc(r->pool, len);

src/http/modules/ngx_http_proxy_module.c:2373:12: Call
2371.     len = prefix + replacement.len;
2372. 
2373.     data = ngx_pnalloc(r->pool, len);
                 ^
2374.     if (data == NULL) {
2375.         return NGX_ERROR;

src/core/ngx_palloc.c:156:13: Assignment
  154. 
  155.         do {
  156.             m = p->d.last;
                   ^
  157. 
  158.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:161:17: Assignment
  159.                 p->d.last = m + size;
  160. 
  161.                 return m;
                       ^
  162.             }
  163. 

src/http/modules/ngx_http_proxy_module.c:2373:5: Assignment
2371.     len = prefix + replacement.len;
2372. 
2373.     data = ngx_pnalloc(r->pool, len);
          ^
2374.     if (data == NULL) {
2375.         return NGX_ERROR;

src/http/modules/ngx_http_proxy_module.c:2378:5: Array access: Offset added: [max(1, prefix), prefix] Size: [0, +oo]
2376.     }
2377. 
2378.     ngx_memcpy(data, h->value.data, prefix);
          ^
2379.     ngx_memcpy(data + prefix, replacement.data, replacement.len);
2380. 

static ngx_int_t
ngx_http_proxy_rewrite_redirect_regex(ngx_http_request_t *r, ngx_table_elt_t *h,
    size_t prefix, ngx_http_proxy_redirect_t *pr)
{
    size_t      len;
    u_char     *data;
    ngx_str_t   redirect, replacement;
    redirect.len = h->value.len - prefix;
    redirect.data = h->value.data + prefix;
    if (ngx_http_regex_exec(r, pr->redirect.regex, &redirect) != NGX_OK) {
        return NGX_DECLINED;
    }
    if (ngx_http_complex_value(r, &pr->replacement, &replacement) != NGX_OK) {
        return NGX_ERROR;
    }
    if (!prefix) {
        h->value = replacement;
        return NGX_OK;
    }
    len = prefix + replacement.len;
    data = ngx_pnalloc(r->pool, len);
    if (data == NULL) {
        return NGX_ERROR;
    }
    ngx_memcpy(data, h->value.data, prefix);
    ngx_memcpy(data + prefix, replacement.data, replacement.len);
    h->value.len = len;
    h->value.data = data;
    return NGX_OK;
}
['static ngx_int_t\nngx_http_proxy_rewrite_redirect_regex(ngx_http_request_t *r, ngx_table_elt_t *h,\n    size_t prefix, ngx_http_proxy_redirect_t *pr)\n{\n    size_t      len;\n    u_char     *data;\n    ngx_str_t   redirect, replacement;\n    redirect.len = h->value.len - prefix;\n    redirect.data = h->value.data + prefix;\n    if (ngx_http_regex_exec(r, pr->redirect.regex, &redirect) != NGX_OK) {\n        return NGX_DECLINED;\n    }\n    if (ngx_http_complex_value(r, &pr->replacement, &replacement) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (!prefix) {\n        h->value = replacement;\n        return NGX_OK;\n    }\n    len = prefix + replacement.len;\n    data = ngx_pnalloc(r->pool, len);\n    if (data == NULL) {\n        return NGX_ERROR;\n    }\n    ngx_memcpy(data, h->value.data, prefix);\n    ngx_memcpy(data + prefix, replacement.data, replacement.len);\n    h->value.len = len;\n    h->value.data = data;\n    return NGX_OK;\n}', 'ngx_int_t\nngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val,\n    ngx_str_t *value)\n{\n    size_t                        len;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_len_code_pt   lcode;\n    ngx_http_script_engine_t      e;\n    if (val->lengths == NULL) {\n        *value = val->value;\n        return NGX_OK;\n    }\n    ngx_http_script_flush_complex_value(r, val);\n    ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n    e.ip = val->lengths;\n    e.request = r;\n    e.flushed = 1;\n    len = 0;\n    while (*(uintptr_t *) e.ip) {\n        lcode = *(ngx_http_script_len_code_pt *) e.ip;\n        len += lcode(&e);\n    }\n    value->len = len;\n    value->data = ngx_pnalloc(r->pool, len);\n    if (value->data == NULL) {\n        return NGX_ERROR;\n    }\n    e.ip = val->values;\n    e.pos = value->data;\n    e.buf = *value;\n    while (*(uintptr_t *) e.ip) {\n        code = *(ngx_http_script_code_pt *) e.ip;\n        code((ngx_http_script_engine_t *) &e);\n    }\n    *value = e.buf;\n    return NGX_OK;\n}', 'void *\nngx_pnalloc(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    if (size <= pool->max) {\n        p = pool->current;\n        do {\n            m = p->d.last;\n            if ((size_t) (p->d.end - m) >= size) {\n                p->d.last = m + size;\n                return m;\n            }\n            p = p->d.next;\n        } while (p);\n        return ngx_palloc_block(pool, size);\n    }\n    return ngx_palloc_large(pool, size);\n}']