src/http/modules/ngx_http_proxy_module.c:3334: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [1, +oo] by call to `ngx_http_compile_complex_value`.

src/http/modules/ngx_http_proxy_module.c:3296:9: Assignment
3294.     if (value[1].data[0] == '~') {
3295.         value[1].len--;
3296.         value[1].data++;
              ^
3297. 
3298.         if (value[1].data[0] == '*') {

src/http/modules/ngx_http_proxy_module.c:3334:9: Call
3332.     ccv.complex_value = &pr->replacement;
3333. 
3334.     if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
              ^
3335.         return NGX_CONF_ERROR;
3336.     }

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:195:9: Call
  193.     sc.root_prefix = ccv->root_prefix;
  194. 
  195.     if (ngx_http_script_compile(&sc) != NGX_OK) {
               ^
  196.         return NGX_ERROR;
  197.     }

src/http/ngx_http_script.c:332:1: <Offset trace>
330. 
331. 
332. ngx_int_t
     ^
333. ngx_http_script_compile(ngx_http_script_compile_t *sc)
334. {

src/http/ngx_http_script.c:332:1: Parameter `sc->source->len`
    330. 
    331. 
    332. ngx_int_t
         ^
    333. ngx_http_script_compile(ngx_http_script_compile_t *sc)
    334. {

src/http/ngx_http_script.c:332:1: <Length trace>
330. 
331. 
332. ngx_int_t
     ^
333. ngx_http_script_compile(ngx_http_script_compile_t *sc)
334. {

src/http/ngx_http_script.c:332:1: Parameter `*sc->source->data`
    330. 
    331. 
    332. ngx_int_t
         ^
    333. ngx_http_script_compile(ngx_http_script_compile_t *sc)
    334. {

src/http/ngx_http_script.c:385:17: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `ngx_http_compile_complex_value` 
    383.                 }
    384. 
    385.                 name.data = &sc->source->data[i];
                         ^
    386. 
    387.             } else {

ngx_int_t
ngx_http_script_compile(ngx_http_script_compile_t *sc)
{
    u_char       ch;
    ngx_str_t    name;
    ngx_uint_t   i, bracket;
    if (ngx_http_script_init_arrays(sc) != NGX_OK) {
        return NGX_ERROR;
    }
    for (i = 0; i < sc->source->len;   ) {
        name.len = 0;
        if (sc->source->data[i] == '$') {
            if (++i == sc->source->len) {
                goto invalid_variable;
            }
#if (NGX_PCRE)
            {
            ngx_uint_t  n;
            if (sc->source->data[i] >= '1' && sc->source->data[i] <= '9') {
                n = sc->source->data[i] - '0';
                if (sc->captures_mask & (1 << n)) {
                    sc->dup_capture = 1;
                }
                sc->captures_mask |= 1 << n;
                if (ngx_http_script_add_capture_code(sc, n) != NGX_OK) {
                    return NGX_ERROR;
                }
                i++;
                continue;
            }
            }
#endif
            if (sc->source->data[i] == '{') {
                bracket = 1;
                if (++i == sc->source->len) {
                    goto invalid_variable;
                }
                name.data = &sc->source->data[i];
            } else {
                bracket = 0;
                name.data = &sc->source->data[i];
            }
            for (   ; i < sc->source->len; i++, name.len++) {
                ch = sc->source->data[i];
                if (ch == '}' && bracket) {
                    i++;
                    bracket = 0;
                    break;
                }
                if ((ch >= 'A' && ch <= 'Z')
                    || (ch >= 'a' && ch <= 'z')
                    || (ch >= '0' && ch <= '9')
                    || ch == '_')
                {
                    continue;
                }
                break;
            }
            if (bracket) {
                ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,
                                   "the closing bracket in \"%V\" "
                                   "variable is missing", &name);
                return NGX_ERROR;
            }
            if (name.len == 0) {
                goto invalid_variable;
            }
            sc->variables++;
            if (ngx_http_script_add_var_code(sc, &name) != NGX_OK) {
                return NGX_ERROR;
            }
            continue;
        }
        if (sc->source->data[i] == '?' && sc->compile_args) {
            sc->args = 1;
            sc->compile_args = 0;
            if (ngx_http_script_add_args_code(sc) != NGX_OK) {
                return NGX_ERROR;
            }
            i++;
            continue;
        }
        name.data = &sc->source->data[i];
        while (i < sc->source->len) {
            if (sc->source->data[i] == '$') {
                break;
            }
            if (sc->source->data[i] == '?') {
                sc->args = 1;
                if (sc->compile_args) {
                    break;
                }
            }
            i++;
            name.len++;
        }
        sc->size += name.len;
        if (ngx_http_script_add_copy_code(sc, &name, (i == sc->source->len))
            != NGX_OK)
        {
            return NGX_ERROR;
        }
    }
    return ngx_http_script_done(sc);
invalid_variable:
    ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0, "invalid variable name");
    return NGX_ERROR;
}
['static char *\nngx_http_proxy_redirect(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_proxy_loc_conf_t *plcf = conf;\n    u_char                            *p;\n    ngx_str_t                         *value;\n    ngx_http_proxy_rewrite_t          *pr;\n    ngx_http_compile_complex_value_t   ccv;\n    if (plcf->redirect == 0) {\n        return NGX_CONF_OK;\n    }\n    plcf->redirect = 1;\n    value = cf->args->elts;\n    if (cf->args->nelts == 2) {\n        if (ngx_strcmp(value[1].data, "off") == 0) {\n            plcf->redirect = 0;\n            plcf->redirects = NULL;\n            return NGX_CONF_OK;\n        }\n        if (ngx_strcmp(value[1].data, "false") == 0) {\n            ngx_conf_log_error(NGX_LOG_ERR, cf, 0,\n                           "invalid parameter \\"false\\", use \\"off\\" instead");\n            plcf->redirect = 0;\n            plcf->redirects = NULL;\n            return NGX_CONF_OK;\n        }\n        if (ngx_strcmp(value[1].data, "default") != 0) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "invalid parameter \\"%V\\"", &value[1]);\n            return NGX_CONF_ERROR;\n        }\n    }\n    if (plcf->redirects == NULL) {\n        plcf->redirects = ngx_array_create(cf->pool, 1,\n                                           sizeof(ngx_http_proxy_rewrite_t));\n        if (plcf->redirects == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    pr = ngx_array_push(plcf->redirects);\n    if (pr == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    if (ngx_strcmp(value[1].data, "default") == 0) {\n        if (plcf->proxy_lengths) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "\\"proxy_redirect default\\" cannot be used "\n                               "with \\"proxy_pass\\" directive with variables");\n            return NGX_CONF_ERROR;\n        }\n        if (plcf->url.data == NULL) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "\\"proxy_redirect default\\" should be placed "\n                               "after the \\"proxy_pass\\" directive");\n            return NGX_CONF_ERROR;\n        }\n        pr->handler = ngx_http_proxy_rewrite_complex_handler;\n        ngx_memzero(&pr->pattern.complex, sizeof(ngx_http_complex_value_t));\n        ngx_memzero(&pr->replacement, sizeof(ngx_http_complex_value_t));\n        if (plcf->vars.uri.len) {\n            pr->pattern.complex.value = plcf->url;\n            pr->replacement.value = plcf->location;\n        } else {\n            pr->pattern.complex.value.len = plcf->url.len + sizeof("/") - 1;\n            p = ngx_pnalloc(cf->pool, pr->pattern.complex.value.len);\n            if (p == NULL) {\n                return NGX_CONF_ERROR;\n            }\n            pr->pattern.complex.value.data = p;\n            p = ngx_cpymem(p, plcf->url.data, plcf->url.len);\n            *p = \'/\';\n            ngx_str_set(&pr->replacement.value, "/");\n        }\n        return NGX_CONF_OK;\n    }\n    if (value[1].data[0] == \'~\') {\n        value[1].len--;\n        value[1].data++;\n        if (value[1].data[0] == \'*\') {\n            value[1].len--;\n            value[1].data++;\n            if (ngx_http_proxy_rewrite_regex(cf, pr, &value[1], 1) != NGX_OK) {\n                return NGX_CONF_ERROR;\n            }\n        } else {\n            if (ngx_http_proxy_rewrite_regex(cf, pr, &value[1], 0) != NGX_OK) {\n                return NGX_CONF_ERROR;\n            }\n        }\n    } else {\n        ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));\n        ccv.cf = cf;\n        ccv.value = &value[1];\n        ccv.complex_value = &pr->pattern.complex;\n        if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n        pr->handler = ngx_http_proxy_rewrite_complex_handler;\n    }\n    ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));\n    ccv.cf = cf;\n    ccv.value = &value[2];\n    ccv.complex_value = &pr->replacement;\n    if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {\n        return NGX_CONF_ERROR;\n    }\n    return NGX_CONF_OK;\n}', "ngx_int_t\nngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)\n{\n    ngx_str_t                  *v;\n    ngx_uint_t                  i, n, nv, nc;\n    ngx_array_t                 flushes, lengths, values, *pf, *pl, *pv;\n    ngx_http_script_compile_t   sc;\n    v = ccv->value;\n    nv = 0;\n    nc = 0;\n    for (i = 0; i < v->len; i++) {\n        if (v->data[i] == '$') {\n            if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {\n                nc++;\n            } else {\n                nv++;\n            }\n        }\n    }\n    if ((v->len == 0 || v->data[0] != '$')\n        && (ccv->conf_prefix || ccv->root_prefix))\n    {\n        if (ngx_conf_full_name(ccv->cf->cycle, v, ccv->conf_prefix) != NGX_OK) {\n            return NGX_ERROR;\n        }\n        ccv->conf_prefix = 0;\n        ccv->root_prefix = 0;\n    }\n    ccv->complex_value->value = *v;\n    ccv->complex_value->flushes = NULL;\n    ccv->complex_value->lengths = NULL;\n    ccv->complex_value->values = NULL;\n    if (nv == 0 && nc == 0) {\n        return NGX_OK;\n    }\n    n = nv + 1;\n    if (ngx_array_init(&flushes, ccv->cf->pool, n, sizeof(ngx_uint_t))\n        != NGX_OK)\n    {\n        return NGX_ERROR;\n    }\n    n = nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                  + sizeof(ngx_http_script_var_code_t))\n        + sizeof(uintptr_t);\n    if (ngx_array_init(&lengths, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    n = (nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                   + sizeof(ngx_http_script_var_code_t))\n                + sizeof(uintptr_t)\n                + v->len\n                + sizeof(uintptr_t) - 1)\n            & ~(sizeof(uintptr_t) - 1);\n    if (ngx_array_init(&values, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    pf = &flushes;\n    pl = &lengths;\n    pv = &values;\n    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n    sc.cf = ccv->cf;\n    sc.source = v;\n    sc.flushes = &pf;\n    sc.lengths = &pl;\n    sc.values = &pv;\n    sc.complete_lengths = 1;\n    sc.complete_values = 1;\n    sc.zero = ccv->zero;\n    sc.conf_prefix = ccv->conf_prefix;\n    sc.root_prefix = ccv->root_prefix;\n    if (ngx_http_script_compile(&sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (flushes.nelts) {\n        ccv->complex_value->flushes = flushes.elts;\n        ccv->complex_value->flushes[flushes.nelts] = (ngx_uint_t) -1;\n    }\n    ccv->complex_value->lengths = lengths.elts;\n    ccv->complex_value->values = values.elts;\n    return NGX_OK;\n}", 'ngx_int_t\nngx_http_script_compile(ngx_http_script_compile_t *sc)\n{\n    u_char       ch;\n    ngx_str_t    name;\n    ngx_uint_t   i, bracket;\n    if (ngx_http_script_init_arrays(sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    for (i = 0; i < sc->source->len;   ) {\n        name.len = 0;\n        if (sc->source->data[i] == \'$\') {\n            if (++i == sc->source->len) {\n                goto invalid_variable;\n            }\n#if (NGX_PCRE)\n            {\n            ngx_uint_t  n;\n            if (sc->source->data[i] >= \'1\' && sc->source->data[i] <= \'9\') {\n                n = sc->source->data[i] - \'0\';\n                if (sc->captures_mask & (1 << n)) {\n                    sc->dup_capture = 1;\n                }\n                sc->captures_mask |= 1 << n;\n                if (ngx_http_script_add_capture_code(sc, n) != NGX_OK) {\n                    return NGX_ERROR;\n                }\n                i++;\n                continue;\n            }\n            }\n#endif\n            if (sc->source->data[i] == \'{\') {\n                bracket = 1;\n                if (++i == sc->source->len) {\n                    goto invalid_variable;\n                }\n                name.data = &sc->source->data[i];\n            } else {\n                bracket = 0;\n                name.data = &sc->source->data[i];\n            }\n            for (   ; i < sc->source->len; i++, name.len++) {\n                ch = sc->source->data[i];\n                if (ch == \'}\' && bracket) {\n                    i++;\n                    bracket = 0;\n                    break;\n                }\n                if ((ch >= \'A\' && ch <= \'Z\')\n                    || (ch >= \'a\' && ch <= \'z\')\n                    || (ch >= \'0\' && ch <= \'9\')\n                    || ch == \'_\')\n                {\n                    continue;\n                }\n                break;\n            }\n            if (bracket) {\n                ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,\n                                   "the closing bracket in \\"%V\\" "\n                                   "variable is missing", &name);\n                return NGX_ERROR;\n            }\n            if (name.len == 0) {\n                goto invalid_variable;\n            }\n            sc->variables++;\n            if (ngx_http_script_add_var_code(sc, &name) != NGX_OK) {\n                return NGX_ERROR;\n            }\n            continue;\n        }\n        if (sc->source->data[i] == \'?\' && sc->compile_args) {\n            sc->args = 1;\n            sc->compile_args = 0;\n            if (ngx_http_script_add_args_code(sc) != NGX_OK) {\n                return NGX_ERROR;\n            }\n            i++;\n            continue;\n        }\n        name.data = &sc->source->data[i];\n        while (i < sc->source->len) {\n            if (sc->source->data[i] == \'$\') {\n                break;\n            }\n            if (sc->source->data[i] == \'?\') {\n                sc->args = 1;\n                if (sc->compile_args) {\n                    break;\n                }\n            }\n            i++;\n            name.len++;\n        }\n        sc->size += name.len;\n        if (ngx_http_script_add_copy_code(sc, &name, (i == sc->source->len))\n            != NGX_OK)\n        {\n            return NGX_ERROR;\n        }\n    }\n    return ngx_http_script_done(sc);\ninvalid_variable:\n    ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0, "invalid variable name");\n    return NGX_ERROR;\n}']