src/http/modules/ngx_http_log_module.c:1156: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [1, +oo] by call to `ngx_http_script_compile`.

src/http/modules/ngx_http_log_module.c:1128:9: Call
1126.     ngx_memzero(log, sizeof(ngx_http_log_t));
1127. 
1128.     n = ngx_http_script_variables_count(&value[1]);
              ^
1129. 
1130.     if (n == 0) {

src/http/ngx_http_script.c:317:1: Parameter `value->len`
  315. 
  316. 
  317. ngx_uint_t
       ^
  318. ngx_http_script_variables_count(ngx_str_t *value)
  319. {

src/http/modules/ngx_http_log_module.c:1137:13: Call
1135. 
1136.     } else {
1137.         if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {
                  ^
1138.             return NGX_CONF_ERROR;
1139.         }

src/core/ngx_conf_file.c:800:1: Parameter `*name->data`
  798. 
  799. 
  800. ngx_int_t
       ^
  801. ngx_conf_full_name(ngx_cycle_t *cycle, ngx_str_t *name, ngx_uint_t conf_prefix)
  802. {

src/core/ngx_conf_file.c:807:12: Call
  805.     prefix = conf_prefix ? &cycle->conf_prefix : &cycle->prefix;
  806. 
  807.     return ngx_get_full_name(cycle->pool, prefix, name);
                  ^
  808. }
  809. 

src/core/ngx_file.c:20:1: Parameter `*name->data`
    18. 
    19. 
    20. ngx_int_t
        ^
    21. ngx_get_full_name(ngx_pool_t *pool, ngx_str_t *prefix, ngx_str_t *name)
    22. {

src/http/modules/ngx_http_log_module.c:1156:13: Call
1154.         sc.complete_values = 1;
1155. 
1156.         if (ngx_http_script_compile(&sc) != NGX_OK) {
                  ^
1157.             return NGX_CONF_ERROR;
1158.         }

src/http/ngx_http_script.c:332:1: <Offset trace>
330. 
331. 
332. ngx_int_t
     ^
333. ngx_http_script_compile(ngx_http_script_compile_t *sc)
334. {

src/http/ngx_http_script.c:332:1: Parameter `sc->source->len`
  330. 
  331. 
  332. ngx_int_t
       ^
  333. ngx_http_script_compile(ngx_http_script_compile_t *sc)
  334. {

src/http/ngx_http_script.c:332:1: <Length trace>
330. 
331. 
332. ngx_int_t
     ^
333. ngx_http_script_compile(ngx_http_script_compile_t *sc)
334. {

src/http/ngx_http_script.c:332:1: Parameter `*sc->source->data`
  330. 
  331. 
  332. ngx_int_t
       ^
  333. ngx_http_script_compile(ngx_http_script_compile_t *sc)
  334. {

src/http/ngx_http_script.c:385:17: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `ngx_http_script_compile` 
  383.                 }
  384. 
  385.                 name.data = &sc->source->data[i];
                       ^
  386. 
  387.             } else {

ngx_int_t
ngx_http_script_compile(ngx_http_script_compile_t *sc)
{
    u_char       ch;
    ngx_str_t    name;
    ngx_uint_t   i, bracket;
    if (ngx_http_script_init_arrays(sc) != NGX_OK) {
        return NGX_ERROR;
    }
    for (i = 0; i < sc->source->len;   ) {
        name.len = 0;
        if (sc->source->data[i] == '$') {
            if (++i == sc->source->len) {
                goto invalid_variable;
            }
#if (NGX_PCRE)
            {
            ngx_uint_t  n;
            if (sc->source->data[i] >= '1' && sc->source->data[i] <= '9') {
                n = sc->source->data[i] - '0';
                if (sc->captures_mask & (1 << n)) {
                    sc->dup_capture = 1;
                }
                sc->captures_mask |= 1 << n;
                if (ngx_http_script_add_capture_code(sc, n) != NGX_OK) {
                    return NGX_ERROR;
                }
                i++;
                continue;
            }
            }
#endif
            if (sc->source->data[i] == '{') {
                bracket = 1;
                if (++i == sc->source->len) {
                    goto invalid_variable;
                }
                name.data = &sc->source->data[i];
            } else {
                bracket = 0;
                name.data = &sc->source->data[i];
            }
            for (   ; i < sc->source->len; i++, name.len++) {
                ch = sc->source->data[i];
                if (ch == '}' && bracket) {
                    i++;
                    bracket = 0;
                    break;
                }
                if ((ch >= 'A' && ch <= 'Z')
                    || (ch >= 'a' && ch <= 'z')
                    || (ch >= '0' && ch <= '9')
                    || ch == '_')
                {
                    continue;
                }
                break;
            }
            if (bracket) {
                ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,
                                   "the closing bracket in \"%V\" "
                                   "variable is missing", &name);
                return NGX_ERROR;
            }
            if (name.len == 0) {
                goto invalid_variable;
            }
            sc->variables++;
            if (ngx_http_script_add_var_code(sc, &name) != NGX_OK) {
                return NGX_ERROR;
            }
            continue;
        }
        if (sc->source->data[i] == '?' && sc->compile_args) {
            sc->args = 1;
            sc->compile_args = 0;
            if (ngx_http_script_add_args_code(sc) != NGX_OK) {
                return NGX_ERROR;
            }
            i++;
            continue;
        }
        name.data = &sc->source->data[i];
        while (i < sc->source->len) {
            if (sc->source->data[i] == '$') {
                break;
            }
            if (sc->source->data[i] == '?') {
                sc->args = 1;
                if (sc->compile_args) {
                    break;
                }
            }
            i++;
            name.len++;
        }
        sc->size += name.len;
        if (ngx_http_script_add_copy_code(sc, &name, (i == sc->source->len))
            != NGX_OK)
        {
            return NGX_ERROR;
        }
    }
    return ngx_http_script_done(sc);
invalid_variable:
    ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0, "invalid variable name");
    return NGX_ERROR;
}
['static char *\nngx_http_log_set_log(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_log_loc_conf_t *llcf = conf;\n    ssize_t                     size;\n    ngx_int_t                   gzip;\n    ngx_uint_t                  i, n;\n    ngx_msec_t                  flush;\n    ngx_str_t                  *value, name, s;\n    ngx_http_log_t             *log;\n    ngx_http_log_buf_t         *buffer;\n    ngx_http_log_fmt_t         *fmt;\n    ngx_http_log_main_conf_t   *lmcf;\n    ngx_http_script_compile_t   sc;\n    value = cf->args->elts;\n    if (ngx_strcmp(value[1].data, "off") == 0) {\n        llcf->off = 1;\n        if (cf->args->nelts == 2) {\n            return NGX_CONF_OK;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (llcf->logs == NULL) {\n        llcf->logs = ngx_array_create(cf->pool, 2, sizeof(ngx_http_log_t));\n        if (llcf->logs == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    lmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_log_module);\n    log = ngx_array_push(llcf->logs);\n    if (log == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    ngx_memzero(log, sizeof(ngx_http_log_t));\n    n = ngx_http_script_variables_count(&value[1]);\n    if (n == 0) {\n        log->file = ngx_conf_open_file(cf->cycle, &value[1]);\n        if (log->file == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    } else {\n        if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n        log->script = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_script_t));\n        if (log->script == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n        sc.cf = cf;\n        sc.source = &value[1];\n        sc.lengths = &log->script->lengths;\n        sc.values = &log->script->values;\n        sc.variables = n;\n        sc.complete_lengths = 1;\n        sc.complete_values = 1;\n        if (ngx_http_script_compile(&sc) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    if (cf->args->nelts >= 3) {\n        name = value[2];\n        if (ngx_strcmp(name.data, "combined") == 0) {\n            lmcf->combined_used = 1;\n        }\n    } else {\n        ngx_str_set(&name, "combined");\n        lmcf->combined_used = 1;\n    }\n    fmt = lmcf->formats.elts;\n    for (i = 0; i < lmcf->formats.nelts; i++) {\n        if (fmt[i].name.len == name.len\n            && ngx_strcasecmp(fmt[i].name.data, name.data) == 0)\n        {\n            log->format = &fmt[i];\n            break;\n        }\n    }\n    if (log->format == NULL) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "unknown log format \\"%V\\"", &name);\n        return NGX_CONF_ERROR;\n    }\n    size = 0;\n    flush = 0;\n    gzip = 0;\n    for (i = 3; i < cf->args->nelts; i++) {\n        if (ngx_strncmp(value[i].data, "buffer=", 7) == 0) {\n            s.len = value[i].len - 7;\n            s.data = value[i].data + 7;\n            size = ngx_parse_size(&s);\n            if (size == NGX_ERROR || size == 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid buffer size \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "flush=", 6) == 0) {\n            s.len = value[i].len - 6;\n            s.data = value[i].data + 6;\n            flush = ngx_parse_time(&s, 0);\n            if (flush == (ngx_msec_t) NGX_ERROR || flush == 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid flush time \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "gzip", 4) == 0\n            && (value[i].len == 4 || value[i].data[4] == \'=\'))\n        {\n#if (NGX_ZLIB)\n            if (size == 0) {\n                size = 64 * 1024;\n            }\n            if (value[i].len == 4) {\n                gzip = Z_BEST_SPEED;\n                continue;\n            }\n            s.len = value[i].len - 5;\n            s.data = value[i].data + 5;\n            gzip = ngx_atoi(s.data, s.len);\n            if (gzip < 1 || gzip > 9) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid compression level \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "nginx was built without zlib support");\n            return NGX_CONF_ERROR;\n#endif\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[i]);\n        return NGX_CONF_ERROR;\n    }\n    if (flush && size == 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "no buffer is defined for access_log \\"%V\\"",\n                           &value[1]);\n        return NGX_CONF_ERROR;\n    }\n    if (size) {\n        if (log->script) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "buffered logs cannot have variables in name");\n            return NGX_CONF_ERROR;\n        }\n        if (log->file->data) {\n            buffer = log->file->data;\n            if (buffer->last - buffer->start != size\n                || buffer->flush != flush\n                || buffer->gzip != gzip)\n            {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "access_log \\"%V\\" already defined "\n                                   "with conflicting parameters",\n                                   &value[1]);\n                return NGX_CONF_ERROR;\n            }\n            return NGX_CONF_OK;\n        }\n        buffer = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_buf_t));\n        if (buffer == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        buffer->start = ngx_pnalloc(cf->pool, size);\n        if (buffer->start == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        buffer->pos = buffer->start;\n        buffer->last = buffer->start + size;\n        if (flush) {\n            buffer->event = ngx_pcalloc(cf->pool, sizeof(ngx_event_t));\n            if (buffer->event == NULL) {\n                return NGX_CONF_ERROR;\n            }\n            buffer->event->data = log->file;\n            buffer->event->handler = ngx_http_log_flush_handler;\n            buffer->event->log = &cf->cycle->new_log;\n            buffer->flush = flush;\n        }\n        buffer->gzip = gzip;\n        log->file->flush = ngx_http_log_flush;\n        log->file->data = buffer;\n    }\n    return NGX_CONF_OK;\n}', "ngx_uint_t\nngx_http_script_variables_count(ngx_str_t *value)\n{\n    ngx_uint_t  i, n;\n    for (n = 0, i = 0; i < value->len; i++) {\n        if (value->data[i] == '$') {\n            n++;\n        }\n    }\n    return n;\n}", 'ngx_int_t\nngx_conf_full_name(ngx_cycle_t *cycle, ngx_str_t *name, ngx_uint_t conf_prefix)\n{\n    ngx_str_t  *prefix;\n    prefix = conf_prefix ? &cycle->conf_prefix : &cycle->prefix;\n    return ngx_get_full_name(cycle->pool, prefix, name);\n}', 'ngx_int_t\nngx_get_full_name(ngx_pool_t *pool, ngx_str_t *prefix, ngx_str_t *name)\n{\n    size_t      len;\n    u_char     *p, *n;\n    ngx_int_t   rc;\n    rc = ngx_test_full_name(name);\n    if (rc == NGX_OK) {\n        return rc;\n    }\n    len = prefix->len;\n#if (NGX_WIN32)\n    if (rc == 2) {\n        len = rc;\n    }\n#endif\n    n = ngx_pnalloc(pool, len + name->len + 1);\n    if (n == NULL) {\n        return NGX_ERROR;\n    }\n    p = ngx_cpymem(n, prefix->data, len);\n    ngx_cpystrn(p, name->data, name->len + 1);\n    name->len += len;\n    name->data = n;\n    return NGX_OK;\n}', 'ngx_int_t\nngx_http_script_compile(ngx_http_script_compile_t *sc)\n{\n    u_char       ch;\n    ngx_str_t    name;\n    ngx_uint_t   i, bracket;\n    if (ngx_http_script_init_arrays(sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    for (i = 0; i < sc->source->len;   ) {\n        name.len = 0;\n        if (sc->source->data[i] == \'$\') {\n            if (++i == sc->source->len) {\n                goto invalid_variable;\n            }\n#if (NGX_PCRE)\n            {\n            ngx_uint_t  n;\n            if (sc->source->data[i] >= \'1\' && sc->source->data[i] <= \'9\') {\n                n = sc->source->data[i] - \'0\';\n                if (sc->captures_mask & (1 << n)) {\n                    sc->dup_capture = 1;\n                }\n                sc->captures_mask |= 1 << n;\n                if (ngx_http_script_add_capture_code(sc, n) != NGX_OK) {\n                    return NGX_ERROR;\n                }\n                i++;\n                continue;\n            }\n            }\n#endif\n            if (sc->source->data[i] == \'{\') {\n                bracket = 1;\n                if (++i == sc->source->len) {\n                    goto invalid_variable;\n                }\n                name.data = &sc->source->data[i];\n            } else {\n                bracket = 0;\n                name.data = &sc->source->data[i];\n            }\n            for (   ; i < sc->source->len; i++, name.len++) {\n                ch = sc->source->data[i];\n                if (ch == \'}\' && bracket) {\n                    i++;\n                    bracket = 0;\n                    break;\n                }\n                if ((ch >= \'A\' && ch <= \'Z\')\n                    || (ch >= \'a\' && ch <= \'z\')\n                    || (ch >= \'0\' && ch <= \'9\')\n                    || ch == \'_\')\n                {\n                    continue;\n                }\n                break;\n            }\n            if (bracket) {\n                ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0,\n                                   "the closing bracket in \\"%V\\" "\n                                   "variable is missing", &name);\n                return NGX_ERROR;\n            }\n            if (name.len == 0) {\n                goto invalid_variable;\n            }\n            sc->variables++;\n            if (ngx_http_script_add_var_code(sc, &name) != NGX_OK) {\n                return NGX_ERROR;\n            }\n            continue;\n        }\n        if (sc->source->data[i] == \'?\' && sc->compile_args) {\n            sc->args = 1;\n            sc->compile_args = 0;\n            if (ngx_http_script_add_args_code(sc) != NGX_OK) {\n                return NGX_ERROR;\n            }\n            i++;\n            continue;\n        }\n        name.data = &sc->source->data[i];\n        while (i < sc->source->len) {\n            if (sc->source->data[i] == \'$\') {\n                break;\n            }\n            if (sc->source->data[i] == \'?\') {\n                sc->args = 1;\n                if (sc->compile_args) {\n                    break;\n                }\n            }\n            i++;\n            name.len++;\n        }\n        sc->size += name.len;\n        if (ngx_http_script_add_copy_code(sc, &name, (i == sc->source->len))\n            != NGX_OK)\n        {\n            return NGX_ERROR;\n        }\n    }\n    return ngx_http_script_done(sc);\ninvalid_variable:\n    ngx_conf_log_error(NGX_LOG_EMERG, sc->cf, 0, "invalid variable name");\n    return NGX_ERROR;\n}']