src/http/modules/ngx_http_proxy_module.c:2458: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_regex_exec`.

src/http/modules/ngx_http_proxy_module.c:2458:9: Call
2456.     pattern.data = h->value.data + prefix;
2457. 
2458.     if (ngx_http_regex_exec(r, pr->pattern.regex, &pattern) != NGX_OK) {
              ^
2459.         return NGX_DECLINED;
2460.     }

src/http/ngx_http_variables.c:1853:1: <Offset trace>
1851. 
1852. 
1853. ngx_int_t
      ^
1854. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
1855. {

src/http/ngx_http_variables.c:1853:1: Parameter `re->variables->capture`
  1851. 
  1852. 
  1853. ngx_int_t
        ^
  1854. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
  1855. {

src/http/ngx_http_variables.c:1892:9: Assignment
  1890.     for (i = 0; i < re->nvariables; i++) {
  1891. 
  1892.         n = re->variables[i].capture;
                ^
  1893.         index = re->variables[i].index;
  1894.         vv = &r->variables[index];

src/http/ngx_http_variables.c:1853:1: <Length trace>
1851. 
1852. 
1853. ngx_int_t
      ^
1854. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
1855. {

src/http/ngx_http_variables.c:1853:1: Parameter `*r->captures`
  1851. 
  1852. 
  1853. ngx_int_t
        ^
  1854. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
  1855. {

src/http/ngx_http_variables.c:1896:19: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_regex_exec` 
  1894.         vv = &r->variables[index];
  1895. 
  1896.         vv->len = r->captures[n + 1] - r->captures[n];
                          ^
  1897.         vv->valid = 1;
  1898.         vv->no_cacheable = 0;

ngx_int_t
ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
{
    ngx_int_t                   rc, index;
    ngx_uint_t                  i, n, len;
    ngx_http_variable_value_t  *vv;
    ngx_http_core_main_conf_t  *cmcf;
    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);
    if (re->ncaptures) {
        len = cmcf->ncaptures;
        if (r->captures == NULL) {
            r->captures = ngx_palloc(r->pool, len * sizeof(int));
            if (r->captures == NULL) {
                return NGX_ERROR;
            }
        }
    } else {
        len = 0;
    }
    rc = ngx_regex_exec(re->regex, s, r->captures, len);
    if (rc == NGX_REGEX_NO_MATCHED) {
        return NGX_DECLINED;
    }
    if (rc < 0) {
        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
                      ngx_regex_exec_n " failed: %i on \"%V\" using \"%V\"",
                      rc, s, &re->name);
        return NGX_ERROR;
    }
    for (i = 0; i < re->nvariables; i++) {
        n = re->variables[i].capture;
        index = re->variables[i].index;
        vv = &r->variables[index];
        vv->len = r->captures[n + 1] - r->captures[n];
        vv->valid = 1;
        vv->no_cacheable = 0;
        vv->not_found = 0;
        vv->data = &s->data[r->captures[n]];
#if (NGX_DEBUG)
        {
        ngx_http_variable_t  *v;
        v = cmcf->variables.elts;
        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                       "http regex set $%V to \"%*s\"",
                       &v[index].name, vv->len, vv->data);
        }
#endif
    }
    r->ncaptures = rc * 2;
    r->captures_data = s->data;
    return NGX_OK;
}
['static ngx_int_t\nngx_http_proxy_rewrite_regex_handler(ngx_http_request_t *r, ngx_table_elt_t *h,\n    size_t prefix, size_t len, ngx_http_proxy_rewrite_t *pr)\n{\n    ngx_str_t  pattern, replacement;\n    pattern.len = len;\n    pattern.data = h->value.data + prefix;\n    if (ngx_http_regex_exec(r, pr->pattern.regex, &pattern) != NGX_OK) {\n        return NGX_DECLINED;\n    }\n    if (ngx_http_complex_value(r, &pr->replacement, &replacement) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (prefix == 0 && h->value.len == len) {\n        h->value = replacement;\n        return NGX_OK;\n    }\n    return ngx_http_proxy_rewrite(r, h, prefix, len, &replacement);\n}', 'ngx_int_t\nngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)\n{\n    ngx_int_t                   rc, index;\n    ngx_uint_t                  i, n, len;\n    ngx_http_variable_value_t  *vv;\n    ngx_http_core_main_conf_t  *cmcf;\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    if (re->ncaptures) {\n        len = cmcf->ncaptures;\n        if (r->captures == NULL) {\n            r->captures = ngx_palloc(r->pool, len * sizeof(int));\n            if (r->captures == NULL) {\n                return NGX_ERROR;\n            }\n        }\n    } else {\n        len = 0;\n    }\n    rc = ngx_regex_exec(re->regex, s, r->captures, len);\n    if (rc == NGX_REGEX_NO_MATCHED) {\n        return NGX_DECLINED;\n    }\n    if (rc < 0) {\n        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,\n                      ngx_regex_exec_n " failed: %i on \\"%V\\" using \\"%V\\"",\n                      rc, s, &re->name);\n        return NGX_ERROR;\n    }\n    for (i = 0; i < re->nvariables; i++) {\n        n = re->variables[i].capture;\n        index = re->variables[i].index;\n        vv = &r->variables[index];\n        vv->len = r->captures[n + 1] - r->captures[n];\n        vv->valid = 1;\n        vv->no_cacheable = 0;\n        vv->not_found = 0;\n        vv->data = &s->data[r->captures[n]];\n#if (NGX_DEBUG)\n        {\n        ngx_http_variable_t  *v;\n        v = cmcf->variables.elts;\n        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http regex set $%V to \\"%*s\\"",\n                       &v[index].name, vv->len, vv->data);\n        }\n#endif\n    }\n    r->ncaptures = rc * 2;\n    r->captures_data = s->data;\n    return NGX_OK;\n}']