src/http/ngx_http_variables.c:1121: error: Buffer Overrun L2
  Offset: [0, 4048] Size: 2048 by call to `ngx_log_error_core`.

src/http/ngx_http_variables.c:1121:9: Unknown value from: __errno_location
1119. 
1120.     if (ngx_realpath(path.data, real) == NULL) {
1121.         ngx_log_error(NGX_LOG_CRIT, r->connection->log, ngx_errno,
              ^
1122.                       ngx_realpath_n " \"%s\" failed", path.data);
1123.         return NGX_ERROR;

src/http/ngx_http_variables.c:1121:9: Call
1119. 
1120.     if (ngx_realpath(path.data, real) == NULL) {
1121.         ngx_log_error(NGX_LOG_CRIT, r->connection->log, ngx_errno,
              ^
1122.                       ngx_realpath_n " \"%s\" failed", path.data);
1123.         return NGX_ERROR;

src/core/ngx_log.c:67:1: Array declaration
  65. #if (NGX_HAVE_VARIADIC_MACROS)
  66. 
  67. void
      ^
  68. ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
  69.     const char *fmt, ...)

src/core/ngx_log.c:88:5: Assignment
  86.     }
  87. 
  88.     last = errstr + NGX_MAX_ERROR_STR;
          ^
  89. 
  90.     ngx_memcpy(errstr, ngx_cached_err_log_time.data,

src/core/ngx_log.c:133:13: Call
  131.                                            ? " (%d: " : " (%Xd: ", err);
  132. #else
  133.         p = ngx_snprintf(p, last - p, " (%d: ", err);
                   ^
  134. #endif
  135. 

src/core/ngx_string.c:109:1: Parameter `max`
    107. 
    108. 
    109. u_char * ngx_cdecl
         ^
    110. ngx_snprintf(u_char *buf, size_t max, const char *fmt, ...)
    111. {

src/core/ngx_string.c:116:9: Call
    114. 
    115.     va_start(args, fmt);
    116.     p = ngx_vsnprintf(buf, max, fmt, args);
                 ^
    117.     va_end(args);
    118. 

src/core/ngx_string.c:123:1: <Length trace>
121. 
122. 
123. u_char *
     ^
124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
125. {

src/core/ngx_string.c:123:1: Parameter `*buf`
      121. 
      122. 
      123. u_char *
           ^
      124. ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
      125. {

src/core/ngx_string.c:244:25: Array access: Offset: [0, 4048] Size: 2048 by call to `ngx_log_error_core` 
      242.                 if (slen == (size_t) -1) {
      243.                     while (*p && buf < last) {
      244.                         *buf++ = *p++;
                                   ^
      245.                     }
      246. 

u_char *
ngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)
{
    u_char                *p, zero, *last;
    int                    d;
    float                  f, scale;
    size_t                 len, slen;
    int64_t                i64;
    uint64_t               ui64;
    ngx_msec_t             ms;
    ngx_uint_t             width, sign, hex, max_width, frac_width, i;
    ngx_str_t             *v;
    ngx_variable_value_t  *vv;
    if (max == 0) {
        return buf;
    }
    last = buf + max;
    while (*fmt && buf < last) {
        if (*fmt == '%') {
            i64 = 0;
            ui64 = 0;
            zero = (u_char) ((*++fmt == '0') ? '0' : ' ');
            width = 0;
            sign = 1;
            hex = 0;
            max_width = 0;
            frac_width = 0;
            slen = (size_t) -1;
            while (*fmt >= '0' && *fmt <= '9') {
                width = width * 10 + *fmt++ - '0';
            }
            for ( ;; ) {
                switch (*fmt) {
                case 'u':
                    sign = 0;
                    fmt++;
                    continue;
                case 'm':
                    max_width = 1;
                    fmt++;
                    continue;
                case 'X':
                    hex = 2;
                    sign = 0;
                    fmt++;
                    continue;
                case 'x':
                    hex = 1;
                    sign = 0;
                    fmt++;
                    continue;
                case '.':
                    fmt++;
                    while (*fmt >= '0' && *fmt <= '9') {
                        frac_width = frac_width * 10 + *fmt++ - '0';
                    }
                    break;
                case '*':
                    slen = va_arg(args, size_t);
                    fmt++;
                    continue;
                default:
                    break;
                }
                break;
            }
            switch (*fmt) {
            case 'V':
                v = va_arg(args, ngx_str_t *);
                len = v->len;
                len = (buf + len < last) ? len : (size_t) (last - buf);
                buf = ngx_cpymem(buf, v->data, len);
                fmt++;
                continue;
            case 'v':
                vv = va_arg(args, ngx_variable_value_t *);
                len = vv->len;
                len = (buf + len < last) ? len : (size_t) (last - buf);
                buf = ngx_cpymem(buf, vv->data, len);
                fmt++;
                continue;
            case 's':
                p = va_arg(args, u_char *);
                if (slen == (size_t) -1) {
                    while (*p && buf < last) {
                        *buf++ = *p++;
                    }
                } else {
                    len = (buf + slen < last) ? slen : (size_t) (last - buf);
                    buf = ngx_cpymem(buf, p, len);
                }
                fmt++;
                continue;
            case 'O':
                i64 = (int64_t) va_arg(args, off_t);
                sign = 1;
                break;
            case 'P':
                i64 = (int64_t) va_arg(args, ngx_pid_t);
                sign = 1;
                break;
            case 'T':
                i64 = (int64_t) va_arg(args, time_t);
                sign = 1;
                break;
            case 'M':
                ms = (ngx_msec_t) va_arg(args, ngx_msec_t);
                if ((ngx_msec_int_t) ms == -1) {
                    sign = 1;
                    i64 = -1;
                } else {
                    sign = 0;
                    ui64 = (uint64_t) ms;
                }
                break;
            case 'z':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ssize_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, size_t);
                }
                break;
            case 'i':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ngx_int_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, ngx_uint_t);
                }
                if (max_width) {
                    width = NGX_INT_T_LEN;
                }
                break;
            case 'd':
                if (sign) {
                    i64 = (int64_t) va_arg(args, int);
                } else {
                    ui64 = (uint64_t) va_arg(args, u_int);
                }
                break;
            case 'l':
                if (sign) {
                    i64 = (int64_t) va_arg(args, long);
                } else {
                    ui64 = (uint64_t) va_arg(args, u_long);
                }
                break;
            case 'D':
                if (sign) {
                    i64 = (int64_t) va_arg(args, int32_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, uint32_t);
                }
                break;
            case 'L':
                if (sign) {
                    i64 = va_arg(args, int64_t);
                } else {
                    ui64 = va_arg(args, uint64_t);
                }
                break;
            case 'A':
                if (sign) {
                    i64 = (int64_t) va_arg(args, ngx_atomic_int_t);
                } else {
                    ui64 = (uint64_t) va_arg(args, ngx_atomic_uint_t);
                }
                if (max_width) {
                    width = NGX_ATOMIC_T_LEN;
                }
                break;
            case 'f':
                f = (float) va_arg(args, double);
                if (f < 0) {
                    *buf++ = '-';
                    f = -f;
                }
                ui64 = (int64_t) f;
                buf = ngx_sprintf_num(buf, last, ui64, zero, 0, width);
                if (frac_width) {
                    if (buf < last) {
                        *buf++ = '.';
                    }
                    scale = 1.0;
                    for (i = 0; i < frac_width; i++) {
                        scale *= 10.0;
                    }
                    ui64 = (uint64_t) ((f - (int64_t) ui64) * scale);
                    buf = ngx_sprintf_num(buf, last, ui64, '0', 0, frac_width);
                }
                fmt++;
                continue;
#if !(NGX_WIN32)
            case 'r':
                i64 = (int64_t) va_arg(args, rlim_t);
                sign = 1;
                break;
#endif
            case 'p':
                ui64 = (uintptr_t) va_arg(args, void *);
                hex = 2;
                sign = 0;
                zero = '0';
                width = NGX_PTR_SIZE * 2;
                break;
            case 'c':
                d = va_arg(args, int);
                *buf++ = (u_char) (d & 0xff);
                fmt++;
                continue;
            case 'Z':
                *buf++ = '\0';
                fmt++;
                continue;
            case 'N':
#if (NGX_WIN32)
                *buf++ = CR;
#endif
                *buf++ = LF;
                fmt++;
                continue;
            case '%':
                *buf++ = '%';
                fmt++;
                continue;
            default:
                *buf++ = *fmt++;
                continue;
            }
            if (sign) {
                if (i64 < 0) {
                    *buf++ = '-';
                    ui64 = (uint64_t) -i64;
                } else {
                    ui64 = (uint64_t) i64;
                }
            }
            buf = ngx_sprintf_num(buf, last, ui64, zero, hex, width);
            fmt++;
        } else {
            *buf++ = *fmt++;
        }
    }
    return buf;
}
['static ngx_int_t\nngx_http_variable_realpath_root(ngx_http_request_t *r,\n    ngx_http_variable_value_t *v, uintptr_t data)\n{\n    size_t                     len;\n    ngx_str_t                  path;\n    ngx_http_core_loc_conf_t  *clcf;\n    u_char                     real[NGX_MAX_PATH];\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->root_lengths == NULL) {\n        path = clcf->root;\n    } else {\n        if (ngx_http_script_run(r, &path, clcf->root_lengths->elts, 1,\n                                clcf->root_values->elts)\n            == NULL)\n        {\n            return NGX_ERROR;\n        }\n        path.data[path.len - 1] = \'\\0\';\n        if (ngx_conf_full_name((ngx_cycle_t *) ngx_cycle, &path, 0) != NGX_OK) {\n            return NGX_ERROR;\n        }\n    }\n    if (ngx_realpath(path.data, real) == NULL) {\n        ngx_log_error(NGX_LOG_CRIT, r->connection->log, ngx_errno,\n                      ngx_realpath_n " \\"%s\\" failed", path.data);\n        return NGX_ERROR;\n    }\n    len = ngx_strlen(real);\n    v->data = ngx_pnalloc(r->pool, len);\n    if (v->data == NULL) {\n        return NGX_ERROR;\n    }\n    v->len = len;\n    v->valid = 1;\n    v->no_cacheable = 0;\n    v->not_found = 0;\n    ngx_memcpy(v->data, real, len);\n    return NGX_OK;\n}', 'void\nngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,\n    const char *fmt, ...)\n#else\nvoid\nngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,\n    const char *fmt, va_list args)\n#endif\n{\n#if (NGX_HAVE_VARIADIC_MACROS)\n    va_list  args;\n#endif\n    u_char   errstr[NGX_MAX_ERROR_STR], *p, *last;\n    if (log->file->fd == NGX_INVALID_FILE) {\n        return;\n    }\n    last = errstr + NGX_MAX_ERROR_STR;\n    ngx_memcpy(errstr, ngx_cached_err_log_time.data,\n               ngx_cached_err_log_time.len);\n    p = errstr + ngx_cached_err_log_time.len;\n    p = ngx_snprintf(p, last - p, " [%s] ", err_levels[level]);\n    p = ngx_snprintf(p, last - p, "%P#" NGX_TID_T_FMT ": ",\n                    ngx_log_pid, ngx_log_tid);\n    if (log->connection) {\n        p = ngx_snprintf(p, last - p, "*%uA ", log->connection);\n    }\n#if (NGX_HAVE_VARIADIC_MACROS)\n    va_start(args, fmt);\n    p = ngx_vsnprintf(p, last - p, fmt, args);\n    va_end(args);\n#else\n    p = ngx_vsnprintf(p, last - p, fmt, args);\n#endif\n    if (err) {\n        if (p > last - 50) {\n            p = last - 50;\n            *p++ = \'.\';\n            *p++ = \'.\';\n            *p++ = \'.\';\n        }\n#if (NGX_WIN32)\n        p = ngx_snprintf(p, last - p, ((unsigned) err < 0x80000000)\n                                           ? " (%d: " : " (%Xd: ", err);\n#else\n        p = ngx_snprintf(p, last - p, " (%d: ", err);\n#endif\n        p = ngx_strerror_r(err, p, last - p);\n        if (p < last) {\n            *p++ = \')\';\n        }\n    }\n    if (level != NGX_LOG_DEBUG && log->handler) {\n        p = log->handler(log, p, last - p);\n    }\n    if (p > last - NGX_LINEFEED_SIZE) {\n        p = last - NGX_LINEFEED_SIZE;\n    }\n    ngx_linefeed(p);\n    (void) ngx_write_fd(log->file->fd, errstr, p - errstr);\n}', 'u_char * ngx_cdecl\nngx_snprintf(u_char *buf, size_t max, const char *fmt, ...)\n{\n    u_char   *p;\n    va_list   args;\n    va_start(args, fmt);\n    p = ngx_vsnprintf(buf, max, fmt, args);\n    va_end(args);\n    return p;\n}', "u_char *\nngx_vsnprintf(u_char *buf, size_t max, const char *fmt, va_list args)\n{\n    u_char                *p, zero, *last;\n    int                    d;\n    float                  f, scale;\n    size_t                 len, slen;\n    int64_t                i64;\n    uint64_t               ui64;\n    ngx_msec_t             ms;\n    ngx_uint_t             width, sign, hex, max_width, frac_width, i;\n    ngx_str_t             *v;\n    ngx_variable_value_t  *vv;\n    if (max == 0) {\n        return buf;\n    }\n    last = buf + max;\n    while (*fmt && buf < last) {\n        if (*fmt == '%') {\n            i64 = 0;\n            ui64 = 0;\n            zero = (u_char) ((*++fmt == '0') ? '0' : ' ');\n            width = 0;\n            sign = 1;\n            hex = 0;\n            max_width = 0;\n            frac_width = 0;\n            slen = (size_t) -1;\n            while (*fmt >= '0' && *fmt <= '9') {\n                width = width * 10 + *fmt++ - '0';\n            }\n            for ( ;; ) {\n                switch (*fmt) {\n                case 'u':\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case 'm':\n                    max_width = 1;\n                    fmt++;\n                    continue;\n                case 'X':\n                    hex = 2;\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case 'x':\n                    hex = 1;\n                    sign = 0;\n                    fmt++;\n                    continue;\n                case '.':\n                    fmt++;\n                    while (*fmt >= '0' && *fmt <= '9') {\n                        frac_width = frac_width * 10 + *fmt++ - '0';\n                    }\n                    break;\n                case '*':\n                    slen = va_arg(args, size_t);\n                    fmt++;\n                    continue;\n                default:\n                    break;\n                }\n                break;\n            }\n            switch (*fmt) {\n            case 'V':\n                v = va_arg(args, ngx_str_t *);\n                len = v->len;\n                len = (buf + len < last) ? len : (size_t) (last - buf);\n                buf = ngx_cpymem(buf, v->data, len);\n                fmt++;\n                continue;\n            case 'v':\n                vv = va_arg(args, ngx_variable_value_t *);\n                len = vv->len;\n                len = (buf + len < last) ? len : (size_t) (last - buf);\n                buf = ngx_cpymem(buf, vv->data, len);\n                fmt++;\n                continue;\n            case 's':\n                p = va_arg(args, u_char *);\n                if (slen == (size_t) -1) {\n                    while (*p && buf < last) {\n                        *buf++ = *p++;\n                    }\n                } else {\n                    len = (buf + slen < last) ? slen : (size_t) (last - buf);\n                    buf = ngx_cpymem(buf, p, len);\n                }\n                fmt++;\n                continue;\n            case 'O':\n                i64 = (int64_t) va_arg(args, off_t);\n                sign = 1;\n                break;\n            case 'P':\n                i64 = (int64_t) va_arg(args, ngx_pid_t);\n                sign = 1;\n                break;\n            case 'T':\n                i64 = (int64_t) va_arg(args, time_t);\n                sign = 1;\n                break;\n            case 'M':\n                ms = (ngx_msec_t) va_arg(args, ngx_msec_t);\n                if ((ngx_msec_int_t) ms == -1) {\n                    sign = 1;\n                    i64 = -1;\n                } else {\n                    sign = 0;\n                    ui64 = (uint64_t) ms;\n                }\n                break;\n            case 'z':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ssize_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, size_t);\n                }\n                break;\n            case 'i':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ngx_int_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, ngx_uint_t);\n                }\n                if (max_width) {\n                    width = NGX_INT_T_LEN;\n                }\n                break;\n            case 'd':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, int);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, u_int);\n                }\n                break;\n            case 'l':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, long);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, u_long);\n                }\n                break;\n            case 'D':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, int32_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, uint32_t);\n                }\n                break;\n            case 'L':\n                if (sign) {\n                    i64 = va_arg(args, int64_t);\n                } else {\n                    ui64 = va_arg(args, uint64_t);\n                }\n                break;\n            case 'A':\n                if (sign) {\n                    i64 = (int64_t) va_arg(args, ngx_atomic_int_t);\n                } else {\n                    ui64 = (uint64_t) va_arg(args, ngx_atomic_uint_t);\n                }\n                if (max_width) {\n                    width = NGX_ATOMIC_T_LEN;\n                }\n                break;\n            case 'f':\n                f = (float) va_arg(args, double);\n                if (f < 0) {\n                    *buf++ = '-';\n                    f = -f;\n                }\n                ui64 = (int64_t) f;\n                buf = ngx_sprintf_num(buf, last, ui64, zero, 0, width);\n                if (frac_width) {\n                    if (buf < last) {\n                        *buf++ = '.';\n                    }\n                    scale = 1.0;\n                    for (i = 0; i < frac_width; i++) {\n                        scale *= 10.0;\n                    }\n                    ui64 = (uint64_t) ((f - (int64_t) ui64) * scale);\n                    buf = ngx_sprintf_num(buf, last, ui64, '0', 0, frac_width);\n                }\n                fmt++;\n                continue;\n#if !(NGX_WIN32)\n            case 'r':\n                i64 = (int64_t) va_arg(args, rlim_t);\n                sign = 1;\n                break;\n#endif\n            case 'p':\n                ui64 = (uintptr_t) va_arg(args, void *);\n                hex = 2;\n                sign = 0;\n                zero = '0';\n                width = NGX_PTR_SIZE * 2;\n                break;\n            case 'c':\n                d = va_arg(args, int);\n                *buf++ = (u_char) (d & 0xff);\n                fmt++;\n                continue;\n            case 'Z':\n                *buf++ = '\\0';\n                fmt++;\n                continue;\n            case 'N':\n#if (NGX_WIN32)\n                *buf++ = CR;\n#endif\n                *buf++ = LF;\n                fmt++;\n                continue;\n            case '%':\n                *buf++ = '%';\n                fmt++;\n                continue;\n            default:\n                *buf++ = *fmt++;\n                continue;\n            }\n            if (sign) {\n                if (i64 < 0) {\n                    *buf++ = '-';\n                    ui64 = (uint64_t) -i64;\n                } else {\n                    ui64 = (uint64_t) i64;\n                }\n            }\n            buf = ngx_sprintf_num(buf, last, ui64, zero, hex, width);\n            fmt++;\n        } else {\n            *buf++ = *fmt++;\n        }\n    }\n    return buf;\n}"]