src/http/modules/ngx_http_proxy_module.c:1032: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_proxy_module.c:1028:13: Assignment
1026.     } else {
1027.         if (r->valid_location) {
1028.             b->last = ngx_copy(b->last, ctx->vars.uri.data, ctx->vars.uri.len);
                  ^
1029.         }
1030. 

src/http/modules/ngx_http_proxy_module.c:1032:13: Call
1030. 
1031.         if (escape) {
1032.             ngx_escape_uri(b->last, r->uri.data + loc_len,
                  ^
1033.                            r->uri.len - loc_len, NGX_ESCAPE_URI);
1034.             b->last += r->uri.len - loc_len + escape;

src/core/ngx_string.c:1256:1: <Length trace>
1254. 
1255. 
1256. uintptr_t
      ^
1257. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1258. {

src/core/ngx_string.c:1256:1: Parameter `*dst`
  1254. 
  1255. 
  1256. uintptr_t
        ^
  1257. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1258. {

src/core/ngx_string.c:1390:14: Assignment
  1388.     while (size) {
  1389.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1390.             *dst++ = '%';
                     ^
  1391.             *dst++ = hex[*src >> 4];
  1392.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1391:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1389.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1390.             *dst++ = '%';
  1391.             *dst++ = hex[*src >> 4];
                    ^
  1392.             *dst++ = hex[*src & 0xf];
  1393.             src++;

uintptr_t
ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
{
    ngx_uint_t      n;
    uint32_t       *escape;
    static u_char   hex[] = "0123456789abcdef";
    static uint32_t   uri[] = {
        0xffffffff,
        0x80000029,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   args[] = {
        0xffffffff,
        0x80000829,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   html[] = {
        0xffffffff,
        0x000000ad,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   refresh[] = {
        0xffffffff,
        0x00000085,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   memcached[] = {
        0xffffffff,
        0x00000021,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
    };
    static uint32_t  *map[] =
        { uri, args, html, refresh, memcached, memcached };
    escape = map[type];
    if (dst == NULL) {
        n = 0;
        while (size) {
            if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
                n++;
            }
            src++;
            size--;
        }
        return (uintptr_t) n;
    }
    while (size) {
        if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
            *dst++ = '%';
            *dst++ = hex[*src >> 4];
            *dst++ = hex[*src & 0xf];
            src++;
        } else {
            *dst++ = *src++;
        }
        size--;
    }
    return (uintptr_t) dst;
}
['static ngx_int_t\nngx_http_proxy_create_request(ngx_http_request_t *r)\n{\n    size_t                        len, uri_len, loc_len, body_len;\n    uintptr_t                     escape;\n    ngx_buf_t                    *b;\n    ngx_str_t                     method;\n    ngx_uint_t                    i, unparsed_uri;\n    ngx_chain_t                  *cl, *body;\n    ngx_list_part_t              *part;\n    ngx_table_elt_t              *header;\n    ngx_http_upstream_t          *u;\n    ngx_http_proxy_ctx_t         *ctx;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_engine_t      e, le;\n    ngx_http_proxy_loc_conf_t    *plcf;\n    ngx_http_script_len_code_pt   lcode;\n    u = r->upstream;\n    plcf = ngx_http_get_module_loc_conf(r, ngx_http_proxy_module);\n    if (u->method.len) {\n        method = u->method;\n        method.len++;\n    } else if (plcf->method.len) {\n        method = plcf->method;\n    } else {\n        method = r->method_name;\n        method.len++;\n    }\n    len = method.len + sizeof(ngx_http_proxy_version) - 1 + sizeof(CRLF) - 1;\n    escape = 0;\n    loc_len = 0;\n    unparsed_uri = 0;\n    ctx = ngx_http_get_module_ctx(r, ngx_http_proxy_module);\n    if (plcf->proxy_lengths) {\n        uri_len = ctx->vars.uri.len;\n    } else if (ctx->vars.uri.len == 0 && r->valid_unparsed_uri && r == r->main)\n    {\n        unparsed_uri = 1;\n        uri_len = r->unparsed_uri.len;\n    } else {\n        loc_len = (r->valid_location && ctx->vars.uri.len) ?\n                      plcf->location.len : 0;\n        if (r->quoted_uri || r->internal) {\n            escape = 2 * ngx_escape_uri(NULL, r->uri.data + loc_len,\n                                        r->uri.len - loc_len, NGX_ESCAPE_URI);\n        }\n        uri_len = ctx->vars.uri.len + r->uri.len - loc_len + escape\n                  + sizeof("?") - 1 + r->args.len;\n    }\n    if (uri_len == 0) {\n        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                      "zero length URI to proxy");\n        return NGX_ERROR;\n    }\n    len += uri_len;\n    ngx_http_script_flush_no_cacheable_variables(r, plcf->flushes);\n    if (plcf->body_set_len) {\n        le.ip = plcf->body_set_len->elts;\n        le.request = r;\n        le.flushed = 1;\n        body_len = 0;\n        while (*(uintptr_t *) le.ip) {\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            body_len += lcode(&le);\n        }\n        ctx->internal_body_length = body_len;\n        len += body_len;\n    }\n    le.ip = plcf->headers_set_len->elts;\n    le.request = r;\n    le.flushed = 1;\n    while (*(uintptr_t *) le.ip) {\n        while (*(uintptr_t *) le.ip) {\n            lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            len += lcode(&le);\n        }\n        le.ip += sizeof(uintptr_t);\n    }\n    if (plcf->upstream.pass_request_headers) {\n        part = &r->headers_in.headers.part;\n        header = part->elts;\n        for (i = 0;  ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                header = part->elts;\n                i = 0;\n            }\n            if (ngx_hash_find(&plcf->headers_set_hash, header[i].hash,\n                              header[i].lowcase_key, header[i].key.len))\n            {\n                continue;\n            }\n            len += header[i].key.len + sizeof(": ") - 1\n                + header[i].value.len + sizeof(CRLF) - 1;\n        }\n    }\n    b = ngx_create_temp_buf(r->pool, len);\n    if (b == NULL) {\n        return NGX_ERROR;\n    }\n    cl = ngx_alloc_chain_link(r->pool);\n    if (cl == NULL) {\n        return NGX_ERROR;\n    }\n    cl->buf = b;\n    b->last = ngx_copy(b->last, method.data, method.len);\n    u->uri.data = b->last;\n    if (plcf->proxy_lengths) {\n        b->last = ngx_copy(b->last, ctx->vars.uri.data, ctx->vars.uri.len);\n    } else if (unparsed_uri) {\n        b->last = ngx_copy(b->last, r->unparsed_uri.data, r->unparsed_uri.len);\n    } else {\n        if (r->valid_location) {\n            b->last = ngx_copy(b->last, ctx->vars.uri.data, ctx->vars.uri.len);\n        }\n        if (escape) {\n            ngx_escape_uri(b->last, r->uri.data + loc_len,\n                           r->uri.len - loc_len, NGX_ESCAPE_URI);\n            b->last += r->uri.len - loc_len + escape;\n        } else {\n            b->last = ngx_copy(b->last, r->uri.data + loc_len,\n                               r->uri.len - loc_len);\n        }\n        if (r->args.len > 0) {\n            *b->last++ = \'?\';\n            b->last = ngx_copy(b->last, r->args.data, r->args.len);\n        }\n    }\n    u->uri.len = b->last - u->uri.data;\n    b->last = ngx_cpymem(b->last, ngx_http_proxy_version,\n                         sizeof(ngx_http_proxy_version) - 1);\n    ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n    e.ip = plcf->headers_set->elts;\n    e.pos = b->last;\n    e.request = r;\n    e.flushed = 1;\n    le.ip = plcf->headers_set_len->elts;\n    while (*(uintptr_t *) le.ip) {\n        lcode = *(ngx_http_script_len_code_pt *) le.ip;\n        (void) lcode(&le);\n        if (*(ngx_http_script_len_code_pt *) le.ip) {\n            for (len = 0; *(uintptr_t *) le.ip; len += lcode(&le)) {\n                lcode = *(ngx_http_script_len_code_pt *) le.ip;\n            }\n            e.skip = (len == sizeof(CRLF) - 1) ? 1 : 0;\n        } else {\n            e.skip = 0;\n        }\n        le.ip += sizeof(uintptr_t);\n        while (*(uintptr_t *) e.ip) {\n            code = *(ngx_http_script_code_pt *) e.ip;\n            code((ngx_http_script_engine_t *) &e);\n        }\n        e.ip += sizeof(uintptr_t);\n    }\n    b->last = e.pos;\n    if (plcf->upstream.pass_request_headers) {\n        part = &r->headers_in.headers.part;\n        header = part->elts;\n        for (i = 0;  ; i++) {\n            if (i >= part->nelts) {\n                if (part->next == NULL) {\n                    break;\n                }\n                part = part->next;\n                header = part->elts;\n                i = 0;\n            }\n            if (ngx_hash_find(&plcf->headers_set_hash, header[i].hash,\n                              header[i].lowcase_key, header[i].key.len))\n            {\n                continue;\n            }\n            b->last = ngx_copy(b->last, header[i].key.data, header[i].key.len);\n            *b->last++ = \':\'; *b->last++ = \' \';\n            b->last = ngx_copy(b->last, header[i].value.data,\n                               header[i].value.len);\n            *b->last++ = CR; *b->last++ = LF;\n            ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                           "http proxy header: \\"%V: %V\\"",\n                           &header[i].key, &header[i].value);\n        }\n    }\n    *b->last++ = CR; *b->last++ = LF;\n    if (plcf->body_set) {\n        e.ip = plcf->body_set->elts;\n        e.pos = b->last;\n        while (*(uintptr_t *) e.ip) {\n            code = *(ngx_http_script_code_pt *) e.ip;\n            code((ngx_http_script_engine_t *) &e);\n        }\n        b->last = e.pos;\n    }\n    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http proxy header:\\n\\"%*s\\"",\n                   (size_t) (b->last - b->pos), b->pos);\n    if (plcf->body_set == NULL && plcf->upstream.pass_request_body) {\n        body = u->request_bufs;\n        u->request_bufs = cl;\n        while (body) {\n            b = ngx_alloc_buf(r->pool);\n            if (b == NULL) {\n                return NGX_ERROR;\n            }\n            ngx_memcpy(b, body->buf, sizeof(ngx_buf_t));\n            cl->next = ngx_alloc_chain_link(r->pool);\n            if (cl->next == NULL) {\n                return NGX_ERROR;\n            }\n            cl = cl->next;\n            cl->buf = b;\n            body = body->next;\n        }\n        b->flush = 1;\n    } else {\n        u->request_bufs = cl;\n    }\n    cl->next = NULL;\n    return NGX_OK;\n}', 'uintptr_t\nngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)\n{\n    ngx_uint_t      n;\n    uint32_t       *escape;\n    static u_char   hex[] = "0123456789abcdef";\n    static uint32_t   uri[] = {\n        0xffffffff,\n        0x80000029,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   args[] = {\n        0xffffffff,\n        0x80000829,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   html[] = {\n        0xffffffff,\n        0x000000ad,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   refresh[] = {\n        0xffffffff,\n        0x00000085,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   memcached[] = {\n        0xffffffff,\n        0x00000021,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n    };\n    static uint32_t  *map[] =\n        { uri, args, html, refresh, memcached, memcached };\n    escape = map[type];\n    if (dst == NULL) {\n        n = 0;\n        while (size) {\n            if (escape[*src >> 5] & (1 << (*src & 0x1f))) {\n                n++;\n            }\n            src++;\n            size--;\n        }\n        return (uintptr_t) n;\n    }\n    while (size) {\n        if (escape[*src >> 5] & (1 << (*src & 0x1f))) {\n            *dst++ = \'%\';\n            *dst++ = hex[*src >> 4];\n            *dst++ = hex[*src & 0xf];\n            src++;\n        } else {\n            *dst++ = *src++;\n        }\n        size--;\n    }\n    return (uintptr_t) dst;\n}']