src/http/modules/ngx_http_log_module.c:401: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_open_cached_file`.

src/http/modules/ngx_http_log_module.c:382:13: Call
380.         /* test root directory existance */
381. 
382.         if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
                 ^
383.             /* simulate successfull logging */
384.             return len;

src/http/ngx_http_core_module.c:1917:1: Parameter `*path->data`
  1915. 
  1916. 
  1917. u_char *
        ^
  1918. ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path,
  1919.     size_t *root_length, size_t reserved)

src/http/modules/ngx_http_log_module.c:401:13: Call
399. #endif
400. 
401.         if (ngx_open_cached_file(clcf->open_file_cache, &path, &of, r->pool)
                 ^
402.             != NGX_OK)
403.         {

src/core/ngx_open_file_cache.c:139:1: Parameter `*name->data`
  137. 
  138. 
  139. ngx_int_t
       ^
  140. ngx_open_cached_file(ngx_open_file_cache_t *cache, ngx_str_t *name,
  141.     ngx_open_file_info_t *of, ngx_pool_t *pool)

src/core/ngx_open_file_cache.c:159:17: Call
  157.         if (of->test_only) {
  158. 
  159.             if (ngx_file_info_wrapper(name, of, &fi) == NGX_FILE_ERROR) {
                       ^
  160.                 return NGX_ERROR;
  161.             }

src/core/ngx_open_file_cache.c:631:1: Parameter `*name->data`
    629. 
    630. 
    631. static ngx_int_t
         ^
    632. ngx_file_info_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,
    633.     ngx_file_info_t *fi)

src/core/ngx_open_file_cache.c:666:10: Call
    664.     }
    665. 
    666.     fd = ngx_open_file_wrapper(name, of, NGX_FILE_RDONLY|NGX_FILE_NONBLOCK,
                  ^
    667.                                NGX_FILE_OPEN, 0);
    668. 

src/core/ngx_open_file_cache.c:532:1: Parameter `*name->data`
      530. 
      531. 
      532. static ngx_fd_t
           ^
      533. ngx_open_file_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,
      534.     ngx_int_t mode, ngx_int_t create, ngx_int_t access)

src/core/ngx_open_file_cache.c:577:5: Assignment
      575. 
      576.     end = name->data + name->len;
      577.     p = name->data + 1;
               ^
      578. 
      579.     for ( ;; ) {

src/core/ngx_open_file_cache.c:580:14: Call
      578. 
      579.     for ( ;; ) {
      580.         cp = ngx_strlchr(p, end, '/');
                        ^
      581.         if (cp == NULL) {
      582.             break;

src/core/ngx_string.h:65:1: <Length trace>
63. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
64. 
65. static ngx_inline u_char *
    ^
66. ngx_strlchr(u_char *p, u_char *last, u_char c)
67. {

src/core/ngx_string.h:65:1: Parameter `*p`
        63. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
        64. 
        65. static ngx_inline u_char *
            ^
        66. ngx_strlchr(u_char *p, u_char *last, u_char c)
        67. {

src/core/ngx_string.h:70:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_open_cached_file` 
        68.     while (p < last) {
        69. 
        70.         if (*p == c) {
                        ^
        71.             return p;
        72.         }

static ngx_inline u_char *
ngx_strlchr(u_char *p, u_char *last, u_char c)
{
    while (p < last) {
        if (*p == c) {
            return p;
        }
        p++;
    }
    return NULL;
}
['static ssize_t\nngx_http_log_script_write(ngx_http_request_t *r, ngx_http_log_script_t *script,\n    u_char **name, u_char *buf, size_t len)\n{\n    size_t                     root;\n    ssize_t                    n;\n    ngx_str_t                  log, path;\n    ngx_open_file_info_t       of;\n    ngx_http_log_loc_conf_t   *llcf;\n    ngx_http_core_loc_conf_t  *clcf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (!r->root_tested) {\n        if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {\n            return len;\n        }\n        path.data[root] = \'\\0\';\n        ngx_memzero(&of, sizeof(ngx_open_file_info_t));\n        of.valid = clcf->open_file_cache_valid;\n        of.min_uses = clcf->open_file_cache_min_uses;\n        of.test_dir = 1;\n        of.test_only = 1;\n        of.errors = clcf->open_file_cache_errors;\n        of.events = clcf->open_file_cache_events;\n#if (NGX_HAVE_OPENAT)\n        of.disable_symlinks = clcf->disable_symlinks;\n#endif\n        if (ngx_open_cached_file(clcf->open_file_cache, &path, &of, r->pool)\n            != NGX_OK)\n        {\n            if (of.err == 0) {\n                return len;\n            }\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, of.err,\n                          "testing \\"%s\\" existence failed", path.data);\n            return len;\n        }\n        if (!of.is_dir) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, NGX_ENOTDIR,\n                          "testing \\"%s\\" existence failed", path.data);\n            return len;\n        }\n    }\n    if (ngx_http_script_run(r, &log, script->lengths->elts, 1,\n                            script->values->elts)\n        == NULL)\n    {\n        return len;\n    }\n    log.data[log.len - 1] = \'\\0\';\n    *name = log.data;\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http log \\"%s\\"", log.data);\n    llcf = ngx_http_get_module_loc_conf(r, ngx_http_log_module);\n    ngx_memzero(&of, sizeof(ngx_open_file_info_t));\n    of.log = 1;\n    of.valid = llcf->open_file_cache_valid;\n    of.min_uses = llcf->open_file_cache_min_uses;\n    of.directio = NGX_OPEN_FILE_DIRECTIO_OFF;\n#if (NGX_HAVE_OPENAT)\n    of.disable_symlinks = clcf->disable_symlinks;\n#endif\n    if (ngx_open_cached_file(llcf->open_file_cache, &log, &of, r->pool)\n        != NGX_OK)\n    {\n        ngx_log_error(NGX_LOG_CRIT, r->connection->log, ngx_errno,\n                      "%s \\"%s\\" failed", of.failed, log.data);\n        return len;\n    }\n    ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                   "http log #%d", of.fd);\n    n = ngx_write_fd(of.fd, buf, len);\n    return n;\n}', 'u_char *\nngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path,\n    size_t *root_length, size_t reserved)\n{\n    u_char                    *last;\n    size_t                     alias;\n    ngx_http_core_loc_conf_t  *clcf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    alias = clcf->alias;\n    if (alias && !r->valid_location) {\n        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,\n                      "\\"alias\\" cannot be used in location \\"%V\\" "\n                      "where URI was rewritten", &clcf->name);\n        return NULL;\n    }\n    if (clcf->root_lengths == NULL) {\n        *root_length = clcf->root.len;\n        path->len = clcf->root.len + reserved + r->uri.len - alias + 1;\n        path->data = ngx_pnalloc(r->pool, path->len);\n        if (path->data == NULL) {\n            return NULL;\n        }\n        last = ngx_copy(path->data, clcf->root.data, clcf->root.len);\n    } else {\n#if (NGX_PCRE)\n        ngx_uint_t  captures;\n        captures = alias && clcf->regex;\n        reserved += captures ? r->add_uri_to_alias ? r->uri.len + 1 : 1\n                             : r->uri.len - alias + 1;\n#else\n        reserved += r->uri.len - alias + 1;\n#endif\n        if (ngx_http_script_run(r, path, clcf->root_lengths->elts, reserved,\n                                clcf->root_values->elts)\n            == NULL)\n        {\n            return NULL;\n        }\n        if (ngx_conf_full_name((ngx_cycle_t *) ngx_cycle, path, 0) != NGX_OK) {\n            return NULL;\n        }\n        *root_length = path->len - reserved;\n        last = path->data + *root_length;\n#if (NGX_PCRE)\n        if (captures) {\n            if (!r->add_uri_to_alias) {\n                *last = \'\\0\';\n                return last;\n            }\n            alias = 0;\n        }\n#endif\n    }\n    last = ngx_cpystrn(last, r->uri.data + alias, r->uri.len - alias + 1);\n    return last;\n}', 'ngx_int_t\nngx_open_cached_file(ngx_open_file_cache_t *cache, ngx_str_t *name,\n    ngx_open_file_info_t *of, ngx_pool_t *pool)\n{\n    time_t                          now;\n    uint32_t                        hash;\n    ngx_int_t                       rc;\n    ngx_file_info_t                 fi;\n    ngx_pool_cleanup_t             *cln;\n    ngx_cached_open_file_t         *file;\n    ngx_pool_cleanup_file_t        *clnf;\n    ngx_open_file_cache_cleanup_t  *ofcln;\n    of->fd = NGX_INVALID_FILE;\n    of->err = 0;\n    if (cache == NULL) {\n        if (of->test_only) {\n            if (ngx_file_info_wrapper(name, of, &fi) == NGX_FILE_ERROR) {\n                return NGX_ERROR;\n            }\n            of->uniq = ngx_file_uniq(&fi);\n            of->mtime = ngx_file_mtime(&fi);\n            of->size = ngx_file_size(&fi);\n            of->fs_size = ngx_file_fs_size(&fi);\n            of->is_dir = ngx_is_dir(&fi);\n            of->is_file = ngx_is_file(&fi);\n            of->is_link = ngx_is_link(&fi);\n            of->is_exec = ngx_is_exec(&fi);\n            return NGX_OK;\n        }\n        cln = ngx_pool_cleanup_add(pool, sizeof(ngx_pool_cleanup_file_t));\n        if (cln == NULL) {\n            return NGX_ERROR;\n        }\n        rc = ngx_open_and_stat_file(name, of, pool->log);\n        if (rc == NGX_OK && !of->is_dir) {\n            cln->handler = ngx_pool_cleanup_file;\n            clnf = cln->data;\n            clnf->fd = of->fd;\n            clnf->name = name->data;\n            clnf->log = pool->log;\n        }\n        return rc;\n    }\n    cln = ngx_pool_cleanup_add(pool, sizeof(ngx_open_file_cache_cleanup_t));\n    if (cln == NULL) {\n        return NGX_ERROR;\n    }\n    now = ngx_time();\n    hash = ngx_crc32_long(name->data, name->len);\n    file = ngx_open_file_lookup(cache, name, hash);\n    if (file) {\n        file->uses++;\n        ngx_queue_remove(&file->queue);\n        if (file->fd == NGX_INVALID_FILE && file->err == 0 && !file->is_dir) {\n            rc = ngx_open_and_stat_file(name, of, pool->log);\n            if (rc != NGX_OK && (of->err == 0 || !of->errors)) {\n                goto failed;\n            }\n            goto add_event;\n        }\n        if (file->use_event\n            || (file->event == NULL\n                && (of->uniq == 0 || of->uniq == file->uniq)\n                && now - file->created < of->valid\n#if (NGX_HAVE_OPENAT)\n                && of->disable_symlinks == file->disable_symlinks\n#endif\n            ))\n        {\n            if (file->err == 0) {\n                of->fd = file->fd;\n                of->uniq = file->uniq;\n                of->mtime = file->mtime;\n                of->size = file->size;\n                of->is_dir = file->is_dir;\n                of->is_file = file->is_file;\n                of->is_link = file->is_link;\n                of->is_exec = file->is_exec;\n                of->is_directio = file->is_directio;\n                if (!file->is_dir) {\n                    file->count++;\n                    ngx_open_file_add_event(cache, file, of, pool->log);\n                }\n            } else {\n                of->err = file->err;\n#if (NGX_HAVE_OPENAT)\n                of->failed = file->disable_symlinks ? ngx_openat_file_n\n                                                    : ngx_open_file_n;\n#else\n                of->failed = ngx_open_file_n;\n#endif\n            }\n            goto found;\n        }\n        ngx_log_debug4(NGX_LOG_DEBUG_CORE, pool->log, 0,\n                       "retest open file: %s, fd:%d, c:%d, e:%d",\n                       file->name, file->fd, file->count, file->err);\n        if (file->is_dir) {\n            of->test_dir = 1;\n        }\n        of->fd = file->fd;\n        of->uniq = file->uniq;\n        rc = ngx_open_and_stat_file(name, of, pool->log);\n        if (rc != NGX_OK && (of->err == 0 || !of->errors)) {\n            goto failed;\n        }\n        if (of->is_dir) {\n            if (file->is_dir || file->err) {\n                goto update;\n            }\n        } else if (of->err == 0) {\n            if (file->is_dir || file->err) {\n                goto add_event;\n            }\n            if (of->uniq == file->uniq) {\n                if (file->event) {\n                    file->use_event = 1;\n                }\n                of->is_directio = file->is_directio;\n                goto update;\n            }\n        } else {\n            if (file->err || file->is_dir) {\n                goto update;\n            }\n        }\n        if (file->count == 0) {\n            ngx_open_file_del_event(file);\n            if (ngx_close_file(file->fd) == NGX_FILE_ERROR) {\n                ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,\n                              ngx_close_file_n " \\"%V\\" failed", name);\n            }\n            goto add_event;\n        }\n        ngx_rbtree_delete(&cache->rbtree, &file->node);\n        cache->current--;\n        file->close = 1;\n        goto create;\n    }\n    rc = ngx_open_and_stat_file(name, of, pool->log);\n    if (rc != NGX_OK && (of->err == 0 || !of->errors)) {\n        goto failed;\n    }\ncreate:\n    if (cache->current >= cache->max) {\n        ngx_expire_old_cached_files(cache, 0, pool->log);\n    }\n    file = ngx_alloc(sizeof(ngx_cached_open_file_t), pool->log);\n    if (file == NULL) {\n        goto failed;\n    }\n    file->name = ngx_alloc(name->len + 1, pool->log);\n    if (file->name == NULL) {\n        ngx_free(file);\n        file = NULL;\n        goto failed;\n    }\n    ngx_cpystrn(file->name, name->data, name->len + 1);\n    file->node.key = hash;\n    ngx_rbtree_insert(&cache->rbtree, &file->node);\n    cache->current++;\n    file->uses = 1;\n    file->count = 0;\n    file->use_event = 0;\n    file->event = NULL;\nadd_event:\n    ngx_open_file_add_event(cache, file, of, pool->log);\nupdate:\n    file->fd = of->fd;\n    file->err = of->err;\n#if (NGX_HAVE_OPENAT)\n    file->disable_symlinks = of->disable_symlinks;\n#endif\n    if (of->err == 0) {\n        file->uniq = of->uniq;\n        file->mtime = of->mtime;\n        file->size = of->size;\n        file->close = 0;\n        file->is_dir = of->is_dir;\n        file->is_file = of->is_file;\n        file->is_link = of->is_link;\n        file->is_exec = of->is_exec;\n        file->is_directio = of->is_directio;\n        if (!of->is_dir) {\n            file->count++;\n        }\n    }\n    file->created = now;\nfound:\n    file->accessed = now;\n    ngx_queue_insert_head(&cache->expire_queue, &file->queue);\n    ngx_log_debug5(NGX_LOG_DEBUG_CORE, pool->log, 0,\n                   "cached open file: %s, fd:%d, c:%d, e:%d, u:%d",\n                   file->name, file->fd, file->count, file->err, file->uses);\n    if (of->err == 0) {\n        if (!of->is_dir) {\n            cln->handler = ngx_open_file_cleanup;\n            ofcln = cln->data;\n            ofcln->cache = cache;\n            ofcln->file = file;\n            ofcln->min_uses = of->min_uses;\n            ofcln->log = pool->log;\n        }\n        return NGX_OK;\n    }\n    return NGX_ERROR;\nfailed:\n    if (file) {\n        ngx_rbtree_delete(&cache->rbtree, &file->node);\n        cache->current--;\n        if (file->count == 0) {\n            if (file->fd != NGX_INVALID_FILE) {\n                if (ngx_close_file(file->fd) == NGX_FILE_ERROR) {\n                    ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,\n                                  ngx_close_file_n " \\"%s\\" failed",\n                                  file->name);\n                }\n            }\n            ngx_free(file->name);\n            ngx_free(file);\n        } else {\n            file->close = 1;\n        }\n    }\n    if (of->fd != NGX_INVALID_FILE) {\n        if (ngx_close_file(of->fd) == NGX_FILE_ERROR) {\n            ngx_log_error(NGX_LOG_ALERT, pool->log, ngx_errno,\n                          ngx_close_file_n " \\"%V\\" failed", name);\n        }\n    }\n    return NGX_ERROR;\n}', 'static ngx_int_t\nngx_file_info_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,\n    ngx_file_info_t *fi)\n{\n    ngx_int_t  rc;\n#if !(NGX_HAVE_OPENAT)\n    rc = ngx_file_info(name->data, fi);\n    if (rc == NGX_FILE_ERROR) {\n        of->err = ngx_errno;\n        of->failed = ngx_file_info_n;\n        return NGX_FILE_ERROR;\n    }\n    return rc;\n#else\n    ngx_fd_t  fd;\n    if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_OFF) {\n        rc = ngx_file_info(name->data, fi);\n        if (rc == NGX_FILE_ERROR) {\n            of->err = ngx_errno;\n            of->failed = ngx_file_info_n;\n            return NGX_FILE_ERROR;\n        }\n        return rc;\n    }\n    fd = ngx_open_file_wrapper(name, of, NGX_FILE_RDONLY|NGX_FILE_NONBLOCK,\n                               NGX_FILE_OPEN, 0);\n    if (fd == NGX_FILE_ERROR) {\n        return NGX_FILE_ERROR;\n    }\n    if (ngx_fd_info(fd, fi) == NGX_FILE_ERROR) {\n        of->err = ngx_errno;\n        of->failed = ngx_fd_info_n;\n        ngx_close_file(fd);\n        return NGX_FILE_ERROR;\n    }\n    ngx_close_file(fd);\n    return NGX_OK;\n#endif\n}', 'static ngx_fd_t\nngx_open_file_wrapper(ngx_str_t *name, ngx_open_file_info_t *of,\n    ngx_int_t mode, ngx_int_t create, ngx_int_t access)\n{\n    ngx_fd_t  fd;\n#if !(NGX_HAVE_OPENAT)\n    fd = ngx_open_file(name->data, mode, create, access);\n    if (fd == NGX_FILE_ERROR) {\n        of->err = ngx_errno;\n        of->failed = ngx_open_file_n;\n        return NGX_FILE_ERROR;\n    }\n    return fd;\n#else\n    u_char    *p, *cp, *end;\n    ngx_fd_t   at_fd;\n    if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_OFF) {\n        fd = ngx_open_file(name->data, mode, create, access);\n        if (fd == NGX_FILE_ERROR) {\n            of->err = ngx_errno;\n            of->failed = ngx_open_file_n;\n            return NGX_FILE_ERROR;\n        }\n        return fd;\n    }\n    at_fd = ngx_openat_file(AT_FDCWD, "/", NGX_FILE_RDONLY|NGX_FILE_NONBLOCK,\n                            NGX_FILE_OPEN, 0);\n    if (at_fd == NGX_FILE_ERROR) {\n        of->err = ngx_errno;\n        of->failed = ngx_openat_file_n;\n        return NGX_FILE_ERROR;\n    }\n    end = name->data + name->len;\n    p = name->data + 1;\n    for ( ;; ) {\n        cp = ngx_strlchr(p, end, \'/\');\n        if (cp == NULL) {\n            break;\n        }\n        *cp = \'\\0\';\n        if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_NOTOWNER) {\n            fd = ngx_openat_file_owner(at_fd, p,\n                                       NGX_FILE_RDONLY|NGX_FILE_NONBLOCK,\n                                       NGX_FILE_OPEN, 0);\n        } else {\n            fd = ngx_openat_file(at_fd, p,\n                           NGX_FILE_RDONLY|NGX_FILE_NONBLOCK|NGX_FILE_NOFOLLOW,\n                           NGX_FILE_OPEN, 0);\n        }\n        *cp = \'/\';\n        ngx_close_file(at_fd);\n        if (fd == NGX_FILE_ERROR) {\n            of->err = ngx_errno;\n            of->failed = ngx_openat_file_n;\n            return NGX_FILE_ERROR;\n        }\n        p = cp + 1;\n        at_fd = fd;\n    }\n    if (of->disable_symlinks == NGX_DISABLE_SYMLINKS_NOTOWNER) {\n        fd = ngx_openat_file_owner(at_fd, p, mode, create, access);\n    } else {\n        fd = ngx_openat_file(at_fd, p, mode|NGX_FILE_NOFOLLOW, create, access);\n    }\n    if (fd == NGX_FILE_ERROR) {\n        of->err = ngx_errno;\n        of->failed = ngx_openat_file_n;\n    }\n    ngx_close_file(at_fd);\n    return fd;\n#endif\n}', 'static ngx_inline u_char *\nngx_strlchr(u_char *p, u_char *last, u_char c)\n{\n    while (p < last) {\n        if (*p == c) {\n            return p;\n        }\n        p++;\n    }\n    return NULL;\n}']