modules/mappers/mod_rewrite.c:4186: error: BUFFER_OVERRUN_L1
  Offset: -48 Size: 10 by call to `apply_rewrite_rule`.

modules/mappers/mod_rewrite.c:4185:9: Assignment
4183.          *  Apply the current rule.
4184.          */
4185.         ctx->vary = NULL;
              ^
4186.         rc = apply_rewrite_rule(p, ctx);
4187. 

modules/mappers/mod_rewrite.c:4186:14: Call
4184.          */
4185.         ctx->vary = NULL;
4186.         rc = apply_rewrite_rule(p, ctx);
                   ^
4187. 
4188.         if (rc) {

modules/mappers/mod_rewrite.c:3903:1: Parameter `*p->forced_handler`
  3901.  * Apply a single RewriteRule
  3902.  */
  3903. static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
        ^
  3904. {
  3905.     ap_regmatch_t regmatch[AP_MAX_REG_MATCH];

modules/mappers/mod_rewrite.c:4033:9: Call
  4031.     /* non-substitution rules ('RewriteRule <pat> -') end here. */
  4032.     if (p->flags & RULEFLAG_NOSUB) {
  4033.         force_type_handler(p, ctx);
                ^
  4034. 
  4035.         if (p->flags & RULEFLAG_STATUS) {

modules/mappers/mod_rewrite.c:3866:1: Parameter `*p->forced_handler`
    3864. 
    3865. /* check for forced type and handler */
    3866. static APR_INLINE void force_type_handler(rewriterule_entry *p,
          ^
    3867.                                           rewrite_ctx *ctx)
    3868. {

modules/mappers/mod_rewrite.c:3886:20: Call
    3884. 
    3885.     if (p->forced_handler) {
    3886.         expanded = do_expand(p->forced_handler, ctx, p);
                             ^
    3887. 
    3888.         if (*expanded) {

modules/mappers/mod_rewrite.c:2198:1: <Offset trace>
2196.  * were not intended by the administrator.
2197.  */
2198. static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
      ^
2199. {
2200.     result_list *result, *current;

modules/mappers/mod_rewrite.c:2198:1: Parameter `*input`
      2196.  * were not intended by the administrator.
      2197.  */
      2198. static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
            ^
      2199. {
      2200.     result_list *result, *current;

modules/mappers/mod_rewrite.c:2330:13: Assignment
      2328.         /* backreference */
      2329.         else if (apr_isdigit(p[1])) {
      2330.             int n = p[1] - '0';
                        ^
      2331.             backrefinfo *bri = (*p == '$') ? &ctx->briRR : &ctx->briRC;
      2332. 

modules/mappers/mod_rewrite.c:2198:1: <Length trace>
2196.  * were not intended by the administrator.
2197.  */
2198. static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
      ^
2199. {
2200.     result_list *result, *current;

modules/mappers/mod_rewrite.c:2198:1: Parameter `ctx->briRC.regmatch[*]`
      2196.  * were not intended by the administrator.
      2197.  */
      2198. static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
            ^
      2199. {
      2200.     result_list *result, *current;

modules/mappers/mod_rewrite.c:2335:20: Array access: Offset: -48 Size: 10 by call to `apply_rewrite_rule` 
      2333.             /* see ap_pregsub() in server/util.c */
      2334.             if (bri->source && n < AP_MAX_REG_MATCH
      2335.                 && bri->regmatch[n].rm_eo > bri->regmatch[n].rm_so) {
                               ^
      2336.                 span = bri->regmatch[n].rm_eo - bri->regmatch[n].rm_so;
      2337.                 if (entry && (entry->flags & RULEFLAG_ESCAPEBACKREF)) {

static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
{
    result_list *result, *current;
    result_list sresult[SMALL_EXPANSION];
    unsigned spc = 0;
    apr_size_t span, inputlen, outlen;
    char *p, *c;
    apr_pool_t *pool = ctx->r->pool;
    span = strcspn(input, "\\$%");
    inputlen = strlen(input);
    if (inputlen == span) {
        return apr_pstrmemdup(pool, input, inputlen);
    }
    result = current = &(sresult[spc++]);
    p = input + span;
    current->next = NULL;
    current->string = input;
    current->len = span;
    outlen = span;
    do {
        if (current->len) {
            current->next = (spc < SMALL_EXPANSION)
                            ? &(sresult[spc++])
                            : (result_list *)apr_palloc(pool,
                                                        sizeof(result_list));
            current = current->next;
            current->next = NULL;
            current->len = 0;
        }
        if (*p == '\\') {
            current->len = 1;
            ++outlen;
            if (!p[1]) {
                current->string = p;
                break;
            }
            else {
                current->string = ++p;
                ++p;
            }
        }
        else if (p[1] == '{') {
            char *endp;
            endp = find_closing_curly(p+2);
            if (!endp) {
                current->len = 2;
                current->string = p;
                outlen += 2;
                p += 2;
            }
            else if (*p == '%') {
                p = lookup_variable(apr_pstrmemdup(pool, p+2, endp-p-2), ctx);
                span = strlen(p);
                current->len = span;
                current->string = p;
                outlen += span;
                p = endp + 1;
            }
            else {
                char *key;
                key = find_char_in_curlies(p+2, ':');
                if (!key) {
                    current->len = 2;
                    current->string = p;
                    outlen += 2;
                    p += 2;
                }
                else {
                    char *map, *dflt;
                    map = apr_pstrmemdup(pool, p+2, endp-p-2);
                    key = map + (key-p-2);
                    *key++ = '\0';
                    dflt = find_char_in_curlies(key, '|');
                    if (dflt) {
                        *dflt++ = '\0';
                    }
                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry));
                    if (!key && dflt && *dflt) {
                        key = do_expand(dflt, ctx, entry);
                    }
                    if (key) {
                        span = strlen(key);
                        current->len = span;
                        current->string = key;
                        outlen += span;
                    }
                    p = endp + 1;
                }
            }
        }
        else if (apr_isdigit(p[1])) {
            int n = p[1] - '0';
            backrefinfo *bri = (*p == '$') ? &ctx->briRR : &ctx->briRC;
            if (bri->source && n < AP_MAX_REG_MATCH
                && bri->regmatch[n].rm_eo > bri->regmatch[n].rm_so) {
                span = bri->regmatch[n].rm_eo - bri->regmatch[n].rm_so;
                if (entry && (entry->flags & RULEFLAG_ESCAPEBACKREF)) {
                    char *tmp2, *tmp;
                    tmp = apr_pstrmemdup(pool, bri->source + bri->regmatch[n].rm_so, span);
                    tmp2 = escape_uri(pool, tmp);
                    rewritelog((ctx->r, 5, ctx->perdir, "escaping backreference '%s' to '%s'",
                            tmp, tmp2));
                    current->len = span = strlen(tmp2);
                    current->string = tmp2;
                } else {
                    current->len = span;
                    current->string = bri->source + bri->regmatch[n].rm_so;
                }
                outlen += span;
            }
            p += 2;
        }
        else {
            current->len = 1;
            current->string = p++;
            ++outlen;
        }
        if (*p && (span = strcspn(p, "\\$%")) > 0) {
            if (current->len) {
                current->next = (spc < SMALL_EXPANSION)
                                ? &(sresult[spc++])
                                : (result_list *)apr_palloc(pool,
                                                           sizeof(result_list));
                current = current->next;
                current->next = NULL;
            }
            current->len = span;
            current->string = p;
            p += span;
            outlen += span;
        }
    } while (p < input+inputlen);
    c = p = apr_palloc(pool, outlen + 1);
    do {
        if (result->len) {
            ap_assert(c+result->len <= p+outlen);
            memcpy(c, result->string, result->len);
            c += result->len;
        }
        result = result->next;
    } while (result);
    p[outlen] = '\0';
    return p;
}
['static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,\n                              char *perdir)\n{\n    rewriterule_entry *entries;\n    rewriterule_entry *p;\n    int i;\n    int changed;\n    int rc;\n    int s;\n    rewrite_ctx *ctx;\n    ctx = apr_palloc(r->pool, sizeof(*ctx));\n    ctx->perdir = perdir;\n    ctx->r = r;\n    entries = (rewriterule_entry *)rewriterules->elts;\n    changed = 0;\n    loop:\n    for (i = 0; i < rewriterules->nelts; i++) {\n        p = &entries[i];\n        if (r->main != NULL &&\n            (p->flags & RULEFLAG_IGNOREONSUBREQ ||\n             p->flags & RULEFLAG_FORCEREDIRECT    )) {\n            continue;\n        }\n        ctx->vary = NULL;\n        rc = apply_rewrite_rule(p, ctx);\n        if (rc) {\n            if (ctx->vary) {\n                apr_table_merge(r->headers_out, "Vary", ctx->vary);\n            }\n            if (p->flags & RULEFLAG_STATUS) {\n                return ACTION_STATUS;\n            }\n            if (rc != 2) {\n                changed = ((p->flags & RULEFLAG_NOESCAPE)\n                           ? ACTION_NOESCAPE : ACTION_NORMAL);\n            }\n            if (p->flags & RULEFLAG_PASSTHROUGH) {\n                rewritelog((r, 2, perdir, "forcing \'%s\' to get passed through "\n                           "to next API URI-to-filename handler", r->filename));\n                r->filename = apr_pstrcat(r->pool, "passthrough:",\n                                         r->filename, NULL);\n                changed = ACTION_NORMAL;\n                break;\n            }\n            if (p->flags & RULEFLAG_END) {\n                rewritelog((r, 8, perdir, "Rule has END flag, no further rewriting for this request"));\n                apr_pool_userdata_set("1", really_last_key, apr_pool_cleanup_null, r->pool);\n                break;\n            }\n            if (p->flags & (RULEFLAG_PROXY | RULEFLAG_LASTRULE)) {\n                break;\n            }\n            if (p->flags & RULEFLAG_NEWROUND) {\n                goto loop;\n            }\n            if (p->skip > 0) {\n                s = p->skip;\n                while (   i < rewriterules->nelts\n                       && s > 0) {\n                    i++;\n                    s--;\n                }\n            }\n        }\n        else {\n            while (   i < rewriterules->nelts\n                   && p->flags & RULEFLAG_CHAIN) {\n                i++;\n                p = &entries[i];\n            }\n        }\n    }\n    return changed;\n}', 'static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)\n{\n    ap_regmatch_t regmatch[AP_MAX_REG_MATCH];\n    apr_array_header_t *rewriteconds;\n    rewritecond_entry *conds;\n    int i, rc;\n    char *newuri = NULL;\n    request_rec *r = ctx->r;\n    int is_proxyreq = 0;\n    ctx->uri = r->filename;\n    if (ctx->perdir) {\n        apr_size_t dirlen = strlen(ctx->perdir);\n        is_proxyreq = (   r->proxyreq && r->filename\n                       && !strncmp(r->filename, "proxy:", 6));\n        if (r->path_info && *r->path_info) {\n            rewritelog((r, 3, ctx->perdir, "add path info postfix: %s -> %s%s",\n                        ctx->uri, ctx->uri, r->path_info));\n            ctx->uri = apr_pstrcat(r->pool, ctx->uri, r->path_info, NULL);\n        }\n        if (!is_proxyreq && strlen(ctx->uri) >= dirlen &&\n            !strncmp(ctx->uri, ctx->perdir, dirlen)) {\n            rewritelog((r, 3, ctx->perdir, "strip per-dir prefix: %s -> %s",\n                        ctx->uri, ctx->uri + dirlen));\n            ctx->uri = ctx->uri + dirlen;\n        }\n    }\n    rewritelog((r, 3, ctx->perdir, "applying pattern \'%s\' to uri \'%s\'",\n                p->pattern, ctx->uri));\n    rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0);\n    if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) ||\n           (!rc &&  (p->flags & RULEFLAG_NOTMATCH))   ) ) {\n        return 0;\n    }\n    ctx->vary_this = NULL;\n    ctx->briRC.source = NULL;\n    if (p->flags & RULEFLAG_NOTMATCH) {\n        ctx->briRR.source = NULL;\n    }\n    else {\n        ctx->briRR.source = apr_pstrdup(r->pool, ctx->uri);\n        memcpy(ctx->briRR.regmatch, regmatch, sizeof(regmatch));\n    }\n    rewriteconds = p->rewriteconds;\n    conds = (rewritecond_entry *)rewriteconds->elts;\n    for (i = 0; i < rewriteconds->nelts; ++i) {\n        rewritecond_entry *c = &conds[i];\n        rc = apply_rewrite_cond(c, ctx);\n        if (c->flags & CONDFLAG_NOVARY) {\n            ctx->vary_this = NULL;\n        }\n        if (c->flags & CONDFLAG_ORNEXT) {\n            if (!rc) {\n                ctx->vary_this = NULL;\n                continue;\n            }\n            else {\n                while (   i < rewriteconds->nelts\n                       && c->flags & CONDFLAG_ORNEXT) {\n                    c = &conds[++i];\n                }\n            }\n        }\n        else if (!rc) {\n            return 0;\n        }\n        if (ctx->vary_this) {\n            ctx->vary = ctx->vary\n                        ? apr_pstrcat(r->pool, ctx->vary, ", ", ctx->vary_this,\n                                      NULL)\n                        : ctx->vary_this;\n            ctx->vary_this = NULL;\n        }\n    }\n    if (!(p->flags & RULEFLAG_NOSUB)) {\n        newuri = do_expand(p->output, ctx, p);\n        rewritelog((r, 2, ctx->perdir, "rewrite \'%s\' -> \'%s\'", ctx->uri,\n                    newuri));\n    }\n    do_expand_env(p->env, ctx);\n    do_expand_cookie(p->cookie, ctx);\n    if (p->flags & RULEFLAG_NOSUB) {\n        force_type_handler(p, ctx);\n        if (p->flags & RULEFLAG_STATUS) {\n            rewritelog((r, 2, ctx->perdir, "forcing responsecode %d for %s",\n                        p->forced_responsecode, r->filename));\n            r->status = p->forced_responsecode;\n        }\n        return 2;\n    }\n    r->filename = newuri;\n    if (ctx->perdir && (p->flags & RULEFLAG_DISCARDPATHINFO)) {\n        r->path_info = NULL;\n    }\n    splitout_queryargs(r, p->flags & RULEFLAG_QSAPPEND, p->flags & RULEFLAG_QSDISCARD);\n    if (   ctx->perdir && !is_proxyreq && *r->filename != \'/\'\n        && !is_absolute_uri(r->filename, NULL)) {\n        rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",\n                    r->filename, ctx->perdir, r->filename));\n        r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL);\n    }\n    if (p->flags & RULEFLAG_PROXY) {\n        if (ctx->perdir && (p->flags & RULEFLAG_NOESCAPE) == 0) {\n            char *old_filename = r->filename;\n            r->filename = ap_escape_uri(r->pool, r->filename);\n            rewritelog((r, 2, ctx->perdir, "escaped URI in per-dir context "\n                        "for proxy, %s -> %s", old_filename, r->filename));\n        }\n        fully_qualify_uri(r);\n        rewritelog((r, 2, ctx->perdir, "forcing proxy-throughput with %s",\n                    r->filename));\n        r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL);\n        return 1;\n    }\n    if (p->flags & RULEFLAG_FORCEREDIRECT) {\n        fully_qualify_uri(r);\n        rewritelog((r, 2, ctx->perdir, "explicitly forcing redirect with %s",\n                    r->filename));\n        r->status = p->forced_responsecode;\n        return 1;\n    }\n    reduce_uri(r);\n    if (is_absolute_uri(r->filename, NULL)) {\n        rewritelog((r, 2, ctx->perdir, "implicitly forcing redirect (rc=%d) "\n                    "with %s", p->forced_responsecode, r->filename));\n        r->status = p->forced_responsecode;\n        return 1;\n    }\n    force_type_handler(p, ctx);\n    return 1;\n}', 'static APR_INLINE void force_type_handler(rewriterule_entry *p,\n                                          rewrite_ctx *ctx)\n{\n    char *expanded;\n    if (p->forced_mimetype) {\n        expanded = do_expand(p->forced_mimetype, ctx, p);\n        if (*expanded) {\n            ap_str_tolower(expanded);\n            rewritelog((ctx->r, 2, ctx->perdir, "remember %s to have MIME-type "\n                        "\'%s\'", ctx->r->filename, expanded));\n            apr_table_setn(ctx->r->notes, REWRITE_FORCED_MIMETYPE_NOTEVAR,\n                           expanded);\n        }\n    }\n    if (p->forced_handler) {\n        expanded = do_expand(p->forced_handler, ctx, p);\n        if (*expanded) {\n            ap_str_tolower(expanded);\n            rewritelog((ctx->r, 2, ctx->perdir, "remember %s to have "\n                        "Content-handler \'%s\'", ctx->r->filename, expanded));\n            apr_table_setn(ctx->r->notes, REWRITE_FORCED_HANDLER_NOTEVAR,\n                           expanded);\n        }\n    }\n}', 'static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)\n{\n    result_list *result, *current;\n    result_list sresult[SMALL_EXPANSION];\n    unsigned spc = 0;\n    apr_size_t span, inputlen, outlen;\n    char *p, *c;\n    apr_pool_t *pool = ctx->r->pool;\n    span = strcspn(input, "\\\\$%");\n    inputlen = strlen(input);\n    if (inputlen == span) {\n        return apr_pstrmemdup(pool, input, inputlen);\n    }\n    result = current = &(sresult[spc++]);\n    p = input + span;\n    current->next = NULL;\n    current->string = input;\n    current->len = span;\n    outlen = span;\n    do {\n        if (current->len) {\n            current->next = (spc < SMALL_EXPANSION)\n                            ? &(sresult[spc++])\n                            : (result_list *)apr_palloc(pool,\n                                                        sizeof(result_list));\n            current = current->next;\n            current->next = NULL;\n            current->len = 0;\n        }\n        if (*p == \'\\\\\') {\n            current->len = 1;\n            ++outlen;\n            if (!p[1]) {\n                current->string = p;\n                break;\n            }\n            else {\n                current->string = ++p;\n                ++p;\n            }\n        }\n        else if (p[1] == \'{\') {\n            char *endp;\n            endp = find_closing_curly(p+2);\n            if (!endp) {\n                current->len = 2;\n                current->string = p;\n                outlen += 2;\n                p += 2;\n            }\n            else if (*p == \'%\') {\n                p = lookup_variable(apr_pstrmemdup(pool, p+2, endp-p-2), ctx);\n                span = strlen(p);\n                current->len = span;\n                current->string = p;\n                outlen += span;\n                p = endp + 1;\n            }\n            else {\n                char *key;\n                key = find_char_in_curlies(p+2, \':\');\n                if (!key) {\n                    current->len = 2;\n                    current->string = p;\n                    outlen += 2;\n                    p += 2;\n                }\n                else {\n                    char *map, *dflt;\n                    map = apr_pstrmemdup(pool, p+2, endp-p-2);\n                    key = map + (key-p-2);\n                    *key++ = \'\\0\';\n                    dflt = find_char_in_curlies(key, \'|\');\n                    if (dflt) {\n                        *dflt++ = \'\\0\';\n                    }\n                    key = lookup_map(ctx->r, map, do_expand(key, ctx, entry));\n                    if (!key && dflt && *dflt) {\n                        key = do_expand(dflt, ctx, entry);\n                    }\n                    if (key) {\n                        span = strlen(key);\n                        current->len = span;\n                        current->string = key;\n                        outlen += span;\n                    }\n                    p = endp + 1;\n                }\n            }\n        }\n        else if (apr_isdigit(p[1])) {\n            int n = p[1] - \'0\';\n            backrefinfo *bri = (*p == \'$\') ? &ctx->briRR : &ctx->briRC;\n            if (bri->source && n < AP_MAX_REG_MATCH\n                && bri->regmatch[n].rm_eo > bri->regmatch[n].rm_so) {\n                span = bri->regmatch[n].rm_eo - bri->regmatch[n].rm_so;\n                if (entry && (entry->flags & RULEFLAG_ESCAPEBACKREF)) {\n                    char *tmp2, *tmp;\n                    tmp = apr_pstrmemdup(pool, bri->source + bri->regmatch[n].rm_so, span);\n                    tmp2 = escape_uri(pool, tmp);\n                    rewritelog((ctx->r, 5, ctx->perdir, "escaping backreference \'%s\' to \'%s\'",\n                            tmp, tmp2));\n                    current->len = span = strlen(tmp2);\n                    current->string = tmp2;\n                } else {\n                    current->len = span;\n                    current->string = bri->source + bri->regmatch[n].rm_so;\n                }\n                outlen += span;\n            }\n            p += 2;\n        }\n        else {\n            current->len = 1;\n            current->string = p++;\n            ++outlen;\n        }\n        if (*p && (span = strcspn(p, "\\\\$%")) > 0) {\n            if (current->len) {\n                current->next = (spc < SMALL_EXPANSION)\n                                ? &(sresult[spc++])\n                                : (result_list *)apr_palloc(pool,\n                                                           sizeof(result_list));\n                current = current->next;\n                current->next = NULL;\n            }\n            current->len = span;\n            current->string = p;\n            p += span;\n            outlen += span;\n        }\n    } while (p < input+inputlen);\n    c = p = apr_palloc(pool, outlen + 1);\n    do {\n        if (result->len) {\n            ap_assert(c+result->len <= p+outlen);\n            memcpy(c, result->string, result->len);\n            c += result->len;\n        }\n        result = result->next;\n    } while (result);\n    p[outlen] = \'\\0\';\n    return p;\n}']