src/http/ngx_http_variables.c:1796: error: Buffer Overrun S2
  Offset: [`re->variables->capture` + 1, `re->variables->capture` + 1] Size: [0, +oo].

src/http/ngx_http_variables.c:1753:1: <Offset trace>
1751. 
1752. 
1753. ngx_int_t
      ^
1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
1755. {

src/http/ngx_http_variables.c:1753:1: Parameter `re->variables->capture`
1751. 
1752. 
1753. ngx_int_t
      ^
1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
1755. {

src/http/ngx_http_variables.c:1792:9: Assignment
1790.     for (i = 0; i < re->nvariables; i++) {
1791. 
1792.         n = re->variables[i].capture;
              ^
1793.         index = re->variables[i].index;
1794.         vv = &r->variables[index];

src/http/ngx_http_variables.c:1753:1: <Length trace>
1751. 
1752. 
1753. ngx_int_t
      ^
1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
1755. {

src/http/ngx_http_variables.c:1753:1: Parameter `*r->captures`
1751. 
1752. 
1753. ngx_int_t
      ^
1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
1755. {

src/http/ngx_http_variables.c:1796:19: Array access: Offset: [re->variables->capture + 1, re->variables->capture + 1] Size: [0, +oo]
1794.         vv = &r->variables[index];
1795. 
1796.         vv->len = r->captures[n + 1] - r->captures[n];
                        ^
1797.         vv->valid = 1;
1798.         vv->no_cacheable = 0;

ngx_int_t
ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
{
    ngx_int_t                   rc, index;
    ngx_uint_t                  i, n, len;
    ngx_http_variable_value_t  *vv;
    ngx_http_core_main_conf_t  *cmcf;
    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);
    if (re->ncaptures) {
        len = cmcf->ncaptures;
        if (r->captures == NULL) {
            r->captures = ngx_palloc(r->pool, len * sizeof(int));
            if (r->captures == NULL) {
                return NGX_ERROR;
            }
        }
    } else {
        len = 0;
    }
    rc = ngx_regex_exec(re->regex, s, r->captures, len);
    if (rc == NGX_REGEX_NO_MATCHED) {
        return NGX_DECLINED;
    }
    if (rc < 0) {
        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
                      ngx_regex_exec_n " failed: %i on \"%V\" using \"%V\"",
                      rc, s, &re->name);
        return NGX_ERROR;
    }
    for (i = 0; i < re->nvariables; i++) {
        n = re->variables[i].capture;
        index = re->variables[i].index;
        vv = &r->variables[index];
        vv->len = r->captures[n + 1] - r->captures[n];
        vv->valid = 1;
        vv->no_cacheable = 0;
        vv->not_found = 0;
        vv->data = &s->data[r->captures[n]];
#if (NGX_DEBUG)
        {
        ngx_http_variable_t  *v;
        v = cmcf->variables.elts;
        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                       "http regex set $%V to \"%*s\"",
                       &v[index].name, vv->len, vv->data);
        }
#endif
    }
    r->ncaptures = rc * 2;
    r->captures_data = s->data;
    return NGX_OK;
}
['ngx_int_t\nngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)\n{\n    ngx_int_t                   rc, index;\n    ngx_uint_t                  i, n, len;\n    ngx_http_variable_value_t  *vv;\n    ngx_http_core_main_conf_t  *cmcf;\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    if (re->ncaptures) {\n        len = cmcf->ncaptures;\n        if (r->captures == NULL) {\n            r->captures = ngx_palloc(r->pool, len * sizeof(int));\n            if (r->captures == NULL) {\n                return NGX_ERROR;\n            }\n        }\n    } else {\n        len = 0;\n    }\n    rc = ngx_regex_exec(re->regex, s, r->captures, len);\n    if (rc == NGX_REGEX_NO_MATCHED) {\n        return NGX_DECLINED;\n    }\n    if (rc < 0) {\n        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,\n                      ngx_regex_exec_n " failed: %i on \\"%V\\" using \\"%V\\"",\n                      rc, s, &re->name);\n        return NGX_ERROR;\n    }\n    for (i = 0; i < re->nvariables; i++) {\n        n = re->variables[i].capture;\n        index = re->variables[i].index;\n        vv = &r->variables[index];\n        vv->len = r->captures[n + 1] - r->captures[n];\n        vv->valid = 1;\n        vv->no_cacheable = 0;\n        vv->not_found = 0;\n        vv->data = &s->data[r->captures[n]];\n#if (NGX_DEBUG)\n        {\n        ngx_http_variable_t  *v;\n        v = cmcf->variables.elts;\n        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http regex set $%V to \\"%*s\\"",\n                       &v[index].name, vv->len, vv->data);\n        }\n#endif\n    }\n    r->ncaptures = rc * 2;\n    r->captures_data = s->data;\n    return NGX_OK;\n}']