src/http/modules/ngx_http_proxy_module.c:3668: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_compile_complex_value`.

src/http/modules/ngx_http_proxy_module.c:3631:9: Assignment
3629.     if (value[1].data[0] == '~') {
3630.         value[1].len--;
3631.         value[1].data++;
              ^
3632. 
3633.         if (ngx_http_proxy_rewrite_regex(cf, pr, &value[1], 1) != NGX_OK) {

src/http/modules/ngx_http_proxy_module.c:3668:9: Call
3666.     ccv.complex_value = &pr->replacement;
3667. 
3668.     if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
              ^
3669.         return NGX_CONF_ERROR;
3670.     }

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:199:9: Call
  197.     sc.root_prefix = ccv->root_prefix;
  198. 
  199.     if (ngx_http_script_compile(&sc) != NGX_OK) {
               ^
  200.         return NGX_ERROR;
  201.     }

src/http/ngx_http_script.c:336:1: Parameter `*sc->source->data`
    334. 
    335. 
    336. ngx_int_t
         ^
    337. ngx_http_script_compile(ngx_http_script_compile_t *sc)
    338. {

src/http/ngx_http_script.c:389:17: Assignment
    387.                 }
    388. 
    389.                 name.data = &sc->source->data[i];
                         ^
    390. 
    391.             } else {

src/http/ngx_http_script.c:429:17: Call
    427.             sc->variables++;
    428. 
    429.             if (ngx_http_script_add_var_code(sc, &name) != NGX_OK) {
                         ^
    430.                 return NGX_ERROR;
    431.             }

src/http/ngx_http_script.c:762:1: Parameter `*name->data`
      760. 
      761. 
      762. static ngx_int_t
           ^
      763. ngx_http_script_add_var_code(ngx_http_script_compile_t *sc, ngx_str_t *name)
      764. {

src/http/ngx_http_script.c:768:13: Call
      766.     ngx_http_script_var_code_t  *code;
      767. 
      768.     index = ngx_http_get_variable_index(sc->cf, name);
                       ^
      769. 
      770.     if (index == NGX_ERROR) {

src/http/ngx_http_variables.c:337:1: Parameter `*name->data`
        335. 
        336. 
        337. ngx_int_t
             ^
        338. ngx_http_get_variable_index(ngx_conf_t *cf, ngx_str_t *name)
        339. {

src/http/ngx_http_variables.c:379:5: Call
        377.     }
        378. 
        379.     ngx_strlow(v->name.data, name->data, name->len);
                 ^
        380. 
        381.     v->set_handler = NULL;

src/core/ngx_string.c:18:1: <Length trace>
16. 
17. 
18. void
    ^
19. ngx_strlow(u_char *dst, u_char *src, size_t n)
20. {

src/core/ngx_string.c:18:1: Parameter `*src`
          16. 
          17. 
          18. void
              ^
          19. ngx_strlow(u_char *dst, u_char *src, size_t n)
          20. {

src/core/ngx_string.c:22:16: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_compile_complex_value` 
          20. {
          21.     while (n) {
          22.         *dst = ngx_tolower(*src);
                             ^
          23.         dst++;
          24.         src++;

void
ngx_strlow(u_char *dst, u_char *src, size_t n)
{
    while (n) {
        *dst = ngx_tolower(*src);
        dst++;
        src++;
        n--;
    }
}
['static char *\nngx_http_proxy_cookie_domain(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_proxy_loc_conf_t *plcf = conf;\n    ngx_str_t                         *value;\n    ngx_http_proxy_rewrite_t          *pr;\n    ngx_http_compile_complex_value_t   ccv;\n    if (plcf->cookie_domains == NULL) {\n        return NGX_CONF_OK;\n    }\n    value = cf->args->elts;\n    if (cf->args->nelts == 2) {\n        if (ngx_strcmp(value[1].data, "off") == 0) {\n            plcf->cookie_domains = NULL;\n            return NGX_CONF_OK;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[1]);\n        return NGX_CONF_ERROR;\n    }\n    if (plcf->cookie_domains == NGX_CONF_UNSET_PTR) {\n        plcf->cookie_domains = ngx_array_create(cf->pool, 1,\n                                     sizeof(ngx_http_proxy_rewrite_t));\n        if (plcf->cookie_domains == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    pr = ngx_array_push(plcf->cookie_domains);\n    if (pr == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    if (value[1].data[0] == \'~\') {\n        value[1].len--;\n        value[1].data++;\n        if (ngx_http_proxy_rewrite_regex(cf, pr, &value[1], 1) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n    } else {\n        if (value[1].data[0] == \'.\') {\n            value[1].len--;\n            value[1].data++;\n        }\n        ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));\n        ccv.cf = cf;\n        ccv.value = &value[1];\n        ccv.complex_value = &pr->pattern.complex;\n        if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n        pr->handler = ngx_http_proxy_rewrite_domain_handler;\n        if (value[2].data[0] == \'.\') {\n            value[2].len--;\n            value[2].data++;\n        }\n    }\n    ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));\n    ccv.cf = cf;\n    ccv.value = &value[2];\n    ccv.complex_value = &pr->replacement;\n    if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {\n        return NGX_CONF_ERROR;\n    }\n    return NGX_CONF_OK;\n}', 'ngx_int_t\nngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)\n{\n    ngx_str_t                  *v;\n    ngx_uint_t                  i, n, nv, nc;\n    ngx_array_t                 flushes, lengths, values, *pf, *pl, *pv;\n    ngx_http_script_compile_t   sc;\n    v = ccv->value;\n    if (v->len == 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, ccv->cf, 0, "empty parameter");\n        return NGX_ERROR;\n    }\n    nv = 0;\n    nc = 0;\n    for (i = 0; i < v->len; i++) {\n        if (v->data[i] == \'$\') {\n            if (v->data[i + 1] >= \'1\' && v->data[i + 1] <= \'9\') {\n                nc++;\n            } else {\n                nv++;\n            }\n        }\n    }\n    if (v->data[0] != \'$\' && (ccv->conf_prefix || ccv->root_prefix)) {\n        if (ngx_conf_full_name(ccv->cf->cycle, v, ccv->conf_prefix) != NGX_OK) {\n            return NGX_ERROR;\n        }\n        ccv->conf_prefix = 0;\n        ccv->root_prefix = 0;\n    }\n    ccv->complex_value->value = *v;\n    ccv->complex_value->flushes = NULL;\n    ccv->complex_value->lengths = NULL;\n    ccv->complex_value->values = NULL;\n    if (nv == 0 && nc == 0) {\n        return NGX_OK;\n    }\n    n = nv + 1;\n    if (ngx_array_init(&flushes, ccv->cf->pool, n, sizeof(ngx_uint_t))\n        != NGX_OK)\n    {\n        return NGX_ERROR;\n    }\n    n = nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                  + sizeof(ngx_http_script_var_code_t))\n        + sizeof(uintptr_t);\n    if (ngx_array_init(&lengths, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    n = (nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                   + sizeof(ngx_http_script_var_code_t))\n                + sizeof(uintptr_t)\n                + v->len\n                + sizeof(uintptr_t) - 1)\n            & ~(sizeof(uintptr_t) - 1);\n    if (ngx_array_init(&values, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    pf = &flushes;\n    pl = &lengths;\n    pv = &values;\n    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n    sc.cf = ccv->cf;\n    sc.source = v;\n    sc.flushes = &pf;\n    sc.lengths = &pl;\n    sc.values = &pv;\n    sc.complete_lengths = 1;\n    sc.complete_values = 1;\n    sc.zero = ccv->zero;\n    sc.conf_prefix = ccv->conf_prefix;\n    sc.root_prefix = ccv->root_prefix;\n    if (ngx_http_script_compile(&sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (flushes.nelts) {\n        ccv->complex_value->flushes = flushes.elts;\n        ccv->complex_value->flushes[flushes.nelts] = (ngx_uint_t) -1;\n    }\n    ccv->complex_value->lengths = lengths.elts;\n    ccv->complex_value->values = values.elts;\n    return NGX_OK;\n}', 'ngx_int_t\nngx_http_script_compile(ngx_http_script_compile_t *sc)\n{\n    u_char       ch;\n    ngx_str_t    name;\n    ngx_uint_t   i, bracket;\n    if (ngx_http_script_init_arrays(sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    for (i = 0; i < sc->source->len;   ) {\n        name.len = 0;\n        if (sc->source->data[i] == \'$\') {\n            if (++i == sc->source->len) {\n                goto invalid_variable;\n            }\n#if (NGX_PCRE)\n            {\n            ngx_uint_t  n;\n            if (sc->source->data[i] >= \'1\' && sc->source->data[i] <= \'9\') {\n                n = sc->source->data[i] - \'0\';\n                if (sc->captures_mask & (1 << n)) {\n                    sc->dup_capture = 1;\n                }\n                sc->captures_mask |= 1 << n;\n                if (ngx_http_script_add_capture_code(sc, n) != NGX_OK) {\n                    return NGX_ERROR;\n                }\n                i++;\n                continue;\n            }\n            }\n#endif\n            if (sc->source->data[i] == \'{\') {\n                bracket = 1;\n                if (++i == sc->source->len) {\n                    goto invalid_variable;\n                }\n                name.data = &sc->source->data[i];\n            } else {\n                bracket = 0;\n                name.data = &sc->source->data[i];\n            }\n            for (   ; i < sc->source->len; i++, name.len++) {\n                ch = sc->source->data[i];\n                if (ch == \'}\' && bracket) {\n                    i++;\n                    bracket = 0;\n                    break;\n                }\n                if ((ch >= \'A\' && ch <= \'Z\')\n                    || (ch >= \'a\' && ch <= \'z\')\n                    || (ch >= \'0\' && ch <= \'9\')\n                    || ch == \'_\')\n                {\n                    continue;\n                }\n                break;\n            }\n            if (bracket) {\n                ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,\n                                   "the closing bracket in \\"%V\\" "\n                                   "variable is missing", &name);\n                return NGX_ERROR;\n            }\n            if (name.len == 0) {\n                goto invalid_variable;\n            }\n            sc->variables++;\n            if (ngx_http_script_add_var_code(sc, &name) != NGX_OK) {\n                return NGX_ERROR;\n            }\n            continue;\n        }\n        if (sc->source->data[i] == \'?\' && sc->compile_args) {\n            sc->args = 1;\n            sc->compile_args = 0;\n            if (ngx_http_script_add_args_code(sc) != NGX_OK) {\n                return NGX_ERROR;\n            }\n            i++;\n            continue;\n        }\n        name.data = &sc->source->data[i];\n        while (i < sc->source->len) {\n            if (sc->source->data[i] == \'$\') {\n                break;\n            }\n            if (sc->source->data[i] == \'?\') {\n                sc->args = 1;\n                if (sc->compile_args) {\n                    break;\n                }\n            }\n            i++;\n            name.len++;\n        }\n        sc->size += name.len;\n        if (ngx_http_script_add_copy_code(sc, &name, (i == sc->source->len))\n            != NGX_OK)\n        {\n            return NGX_ERROR;\n        }\n    }\n    return ngx_http_script_done(sc);\ninvalid_variable:\n    ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0, "invalid variable name");\n    return NGX_ERROR;\n}', 'static ngx_int_t\nngx_http_script_add_var_code(ngx_http_script_compile_t *sc, ngx_str_t *name)\n{\n    ngx_int_t                    index, *p;\n    ngx_http_script_var_code_t  *code;\n    index = ngx_http_get_variable_index(sc->cf, name);\n    if (index == NGX_ERROR) {\n        return NGX_ERROR;\n    }\n    if (sc->flushes) {\n        p = ngx_array_push(*sc->flushes);\n        if (p == NULL) {\n            return NGX_ERROR;\n        }\n        *p = index;\n    }\n    code = ngx_http_script_add_code(*sc->lengths,\n                                    sizeof(ngx_http_script_var_code_t), NULL);\n    if (code == NULL) {\n        return NGX_ERROR;\n    }\n    code->code = (ngx_http_script_code_pt) ngx_http_script_copy_var_len_code;\n    code->index = (uintptr_t) index;\n    code = ngx_http_script_add_code(*sc->values,\n                                    sizeof(ngx_http_script_var_code_t),\n                                    &sc->main);\n    if (code == NULL) {\n        return NGX_ERROR;\n    }\n    code->code = ngx_http_script_copy_var_code;\n    code->index = (uintptr_t) index;\n    return NGX_OK;\n}', 'ngx_int_t\nngx_http_get_variable_index(ngx_conf_t *cf, ngx_str_t *name)\n{\n    ngx_uint_t                  i;\n    ngx_http_variable_t        *v;\n    ngx_http_core_main_conf_t  *cmcf;\n    cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);\n    v = cmcf->variables.elts;\n    if (v == NULL) {\n        if (ngx_array_init(&cmcf->variables, cf->pool, 4,\n                           sizeof(ngx_http_variable_t))\n            != NGX_OK)\n        {\n            return NGX_ERROR;\n        }\n    } else {\n        for (i = 0; i < cmcf->variables.nelts; i++) {\n            if (name->len != v[i].name.len\n                || ngx_strncasecmp(name->data, v[i].name.data, name->len) != 0)\n            {\n                continue;\n            }\n            return i;\n        }\n    }\n    v = ngx_array_push(&cmcf->variables);\n    if (v == NULL) {\n        return NGX_ERROR;\n    }\n    v->name.len = name->len;\n    v->name.data = ngx_pnalloc(cf->pool, name->len);\n    if (v->name.data == NULL) {\n        return NGX_ERROR;\n    }\n    ngx_strlow(v->name.data, name->data, name->len);\n    v->set_handler = NULL;\n    v->get_handler = NULL;\n    v->data = 0;\n    v->flags = 0;\n    v->index = cmcf->variables.nelts - 1;\n    return cmcf->variables.nelts - 1;\n}', 'void\nngx_strlow(u_char *dst, u_char *src, size_t n)\n{\n    while (n) {\n        *dst = ngx_tolower(*src);\n        dst++;\n        src++;\n        n--;\n    }\n}']