src/http/modules/ngx_http_log_module.c:1359: error: Buffer Overrun L3
  Offset: [3, +oo] (⇐ 3 + [0, +oo]) Size: [1, +oo] by call to `ngx_http_compile_complex_value`.

src/http/modules/ngx_http_log_module.c:1205:5: Assignment
1203.     flush = 0;
1204.     gzip = 0;
1205.     filter.len = 0;
          ^
1206. 
1207.     for (i = 3; i < cf->args->nelts; i++) {

src/http/modules/ngx_http_log_module.c:1359:13: Call
1357.         ccv.complex_value = log->filter;
1358. 
1359.         if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                  ^
1360.             return NGX_CONF_ERROR;
1361.         }

src/http/ngx_http_script.c:107:1: <Offset trace>
105. 
106. 
107. ngx_int_t
     ^
108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
109. {

src/http/ngx_http_script.c:107:1: Parameter `ccv->value->len`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:107:1: <Length trace>
105. 
106. 
107. ngx_int_t
     ^
108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
109. {

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:121:13: Array access: Offset: [3, +oo] (⇐ 3 + [0, +oo]) Size: [1, +oo] by call to `ngx_http_compile_complex_value` 
  119. 
  120.     for (i = 0; i < v->len; i++) {
  121.         if (v->data[i] == '$') {
                   ^
  122.             if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {
  123.                 nc++;

ngx_int_t
ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
{
    ngx_str_t                  *v;
    ngx_uint_t                  i, n, nv, nc;
    ngx_array_t                 flushes, lengths, values, *pf, *pl, *pv;
    ngx_http_script_compile_t   sc;
    v = ccv->value;
    nv = 0;
    nc = 0;
    for (i = 0; i < v->len; i++) {
        if (v->data[i] == '$') {
            if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {
                nc++;
            } else {
                nv++;
            }
        }
    }
    if ((v->len == 0 || v->data[0] != '$')
        && (ccv->conf_prefix || ccv->root_prefix))
    {
        if (ngx_conf_full_name(ccv->cf->cycle, v, ccv->conf_prefix) != NGX_OK) {
            return NGX_ERROR;
        }
        ccv->conf_prefix = 0;
        ccv->root_prefix = 0;
    }
    ccv->complex_value->value = *v;
    ccv->complex_value->flushes = NULL;
    ccv->complex_value->lengths = NULL;
    ccv->complex_value->values = NULL;
    if (nv == 0 && nc == 0) {
        return NGX_OK;
    }
    n = nv + 1;
    if (ngx_array_init(&flushes, ccv->cf->pool, n, sizeof(ngx_uint_t))
        != NGX_OK)
    {
        return NGX_ERROR;
    }
    n = nv * (2 * sizeof(ngx_http_script_copy_code_t)
                  + sizeof(ngx_http_script_var_code_t))
        + sizeof(uintptr_t);
    if (ngx_array_init(&lengths, ccv->cf->pool, n, 1) != NGX_OK) {
        return NGX_ERROR;
    }
    n = (nv * (2 * sizeof(ngx_http_script_copy_code_t)
                   + sizeof(ngx_http_script_var_code_t))
                + sizeof(uintptr_t)
                + v->len
                + sizeof(uintptr_t) - 1)
            & ~(sizeof(uintptr_t) - 1);
    if (ngx_array_init(&values, ccv->cf->pool, n, 1) != NGX_OK) {
        return NGX_ERROR;
    }
    pf = &flushes;
    pl = &lengths;
    pv = &values;
    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));
    sc.cf = ccv->cf;
    sc.source = v;
    sc.flushes = &pf;
    sc.lengths = &pl;
    sc.values = &pv;
    sc.complete_lengths = 1;
    sc.complete_values = 1;
    sc.zero = ccv->zero;
    sc.conf_prefix = ccv->conf_prefix;
    sc.root_prefix = ccv->root_prefix;
    if (ngx_http_script_compile(&sc) != NGX_OK) {
        return NGX_ERROR;
    }
    if (flushes.nelts) {
        ccv->complex_value->flushes = flushes.elts;
        ccv->complex_value->flushes[flushes.nelts] = (ngx_uint_t) -1;
    }
    ccv->complex_value->lengths = lengths.elts;
    ccv->complex_value->values = values.elts;
    return NGX_OK;
}
['static char *\nngx_http_log_set_log(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_log_loc_conf_t *llcf = conf;\n    ssize_t                            size;\n    ngx_int_t                          gzip;\n    ngx_uint_t                         i, n;\n    ngx_msec_t                         flush;\n    ngx_str_t                         *value, name, s, filter;\n    ngx_http_log_t                    *log;\n    ngx_http_log_buf_t                *buffer;\n    ngx_http_log_fmt_t                *fmt;\n    ngx_http_log_main_conf_t          *lmcf;\n    ngx_http_script_compile_t          sc;\n    ngx_http_compile_complex_value_t   ccv;\n    value = cf->args->elts;\n    if (ngx_strcmp(value[1].data, "off") == 0) {\n        llcf->off = 1;\n        if (cf->args->nelts == 2) {\n            return NGX_CONF_OK;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (llcf->logs == NULL) {\n        llcf->logs = ngx_array_create(cf->pool, 2, sizeof(ngx_http_log_t));\n        if (llcf->logs == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    lmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_log_module);\n    log = ngx_array_push(llcf->logs);\n    if (log == NULL) {\n        return NGX_CONF_ERROR;\n    }\n    ngx_memzero(log, sizeof(ngx_http_log_t));\n    n = ngx_http_script_variables_count(&value[1]);\n    if (n == 0) {\n        log->file = ngx_conf_open_file(cf->cycle, &value[1]);\n        if (log->file == NULL) {\n            return NGX_CONF_ERROR;\n        }\n    } else {\n        if (ngx_conf_full_name(cf->cycle, &value[1], 0) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n        log->script = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_script_t));\n        if (log->script == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n        sc.cf = cf;\n        sc.source = &value[1];\n        sc.lengths = &log->script->lengths;\n        sc.values = &log->script->values;\n        sc.variables = n;\n        sc.complete_lengths = 1;\n        sc.complete_values = 1;\n        if (ngx_http_script_compile(&sc) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    if (cf->args->nelts >= 3) {\n        name = value[2];\n        if (ngx_strcmp(name.data, "combined") == 0) {\n            lmcf->combined_used = 1;\n        }\n    } else {\n        ngx_str_set(&name, "combined");\n        lmcf->combined_used = 1;\n    }\n    fmt = lmcf->formats.elts;\n    for (i = 0; i < lmcf->formats.nelts; i++) {\n        if (fmt[i].name.len == name.len\n            && ngx_strcasecmp(fmt[i].name.data, name.data) == 0)\n        {\n            log->format = &fmt[i];\n            break;\n        }\n    }\n    if (log->format == NULL) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "unknown log format \\"%V\\"", &name);\n        return NGX_CONF_ERROR;\n    }\n    size = 0;\n    flush = 0;\n    gzip = 0;\n    filter.len = 0;\n    for (i = 3; i < cf->args->nelts; i++) {\n        if (ngx_strncmp(value[i].data, "buffer=", 7) == 0) {\n            s.len = value[i].len - 7;\n            s.data = value[i].data + 7;\n            size = ngx_parse_size(&s);\n            if (size == NGX_ERROR || size == 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid buffer size \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "flush=", 6) == 0) {\n            s.len = value[i].len - 6;\n            s.data = value[i].data + 6;\n            flush = ngx_parse_time(&s, 0);\n            if (flush == (ngx_msec_t) NGX_ERROR || flush == 0) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid flush time \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "gzip", 4) == 0\n            && (value[i].len == 4 || value[i].data[4] == \'=\'))\n        {\n#if (NGX_ZLIB)\n            if (size == 0) {\n                size = 64 * 1024;\n            }\n            if (value[i].len == 4) {\n                gzip = Z_BEST_SPEED;\n                continue;\n            }\n            s.len = value[i].len - 5;\n            s.data = value[i].data + 5;\n            gzip = ngx_atoi(s.data, s.len);\n            if (gzip < 1 || gzip > 9) {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "invalid compression level \\"%V\\"", &s);\n                return NGX_CONF_ERROR;\n            }\n            continue;\n#else\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "nginx was built without zlib support");\n            return NGX_CONF_ERROR;\n#endif\n        }\n        if (ngx_strncmp(value[i].data, "if=", 3) == 0) {\n            filter.len = value[i].len - 3;\n            filter.data = value[i].data + 3;\n            continue;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[i]);\n        return NGX_CONF_ERROR;\n    }\n    if (flush && size == 0) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "no buffer is defined for access_log \\"%V\\"",\n                           &value[1]);\n        return NGX_CONF_ERROR;\n    }\n    if (size) {\n        if (log->script) {\n            ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                               "buffered logs cannot have variables in name");\n            return NGX_CONF_ERROR;\n        }\n        if (log->file->data) {\n            buffer = log->file->data;\n            if (buffer->last - buffer->start != size\n                || buffer->flush != flush\n                || buffer->gzip != gzip)\n            {\n                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                                   "access_log \\"%V\\" already defined "\n                                   "with conflicting parameters",\n                                   &value[1]);\n                return NGX_CONF_ERROR;\n            }\n            return NGX_CONF_OK;\n        }\n        buffer = ngx_pcalloc(cf->pool, sizeof(ngx_http_log_buf_t));\n        if (buffer == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        buffer->start = ngx_pnalloc(cf->pool, size);\n        if (buffer->start == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        buffer->pos = buffer->start;\n        buffer->last = buffer->start + size;\n        if (flush) {\n            buffer->event = ngx_pcalloc(cf->pool, sizeof(ngx_event_t));\n            if (buffer->event == NULL) {\n                return NGX_CONF_ERROR;\n            }\n            buffer->event->data = log->file;\n            buffer->event->handler = ngx_http_log_flush_handler;\n            buffer->event->log = &cf->cycle->new_log;\n            buffer->flush = flush;\n        }\n        buffer->gzip = gzip;\n        log->file->flush = ngx_http_log_flush;\n        log->file->data = buffer;\n    }\n    if (filter.len) {\n        log->filter = ngx_palloc(cf->pool, sizeof(ngx_http_complex_value_t));\n        if (log->filter == NULL) {\n            return NGX_CONF_ERROR;\n        }\n        ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));\n        ccv.cf = cf;\n        ccv.value = &filter;\n        ccv.complex_value = log->filter;\n        if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {\n            return NGX_CONF_ERROR;\n        }\n    }\n    return NGX_CONF_OK;\n}', "ngx_int_t\nngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)\n{\n    ngx_str_t                  *v;\n    ngx_uint_t                  i, n, nv, nc;\n    ngx_array_t                 flushes, lengths, values, *pf, *pl, *pv;\n    ngx_http_script_compile_t   sc;\n    v = ccv->value;\n    nv = 0;\n    nc = 0;\n    for (i = 0; i < v->len; i++) {\n        if (v->data[i] == '$') {\n            if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {\n                nc++;\n            } else {\n                nv++;\n            }\n        }\n    }\n    if ((v->len == 0 || v->data[0] != '$')\n        && (ccv->conf_prefix || ccv->root_prefix))\n    {\n        if (ngx_conf_full_name(ccv->cf->cycle, v, ccv->conf_prefix) != NGX_OK) {\n            return NGX_ERROR;\n        }\n        ccv->conf_prefix = 0;\n        ccv->root_prefix = 0;\n    }\n    ccv->complex_value->value = *v;\n    ccv->complex_value->flushes = NULL;\n    ccv->complex_value->lengths = NULL;\n    ccv->complex_value->values = NULL;\n    if (nv == 0 && nc == 0) {\n        return NGX_OK;\n    }\n    n = nv + 1;\n    if (ngx_array_init(&flushes, ccv->cf->pool, n, sizeof(ngx_uint_t))\n        != NGX_OK)\n    {\n        return NGX_ERROR;\n    }\n    n = nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                  + sizeof(ngx_http_script_var_code_t))\n        + sizeof(uintptr_t);\n    if (ngx_array_init(&lengths, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    n = (nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                   + sizeof(ngx_http_script_var_code_t))\n                + sizeof(uintptr_t)\n                + v->len\n                + sizeof(uintptr_t) - 1)\n            & ~(sizeof(uintptr_t) - 1);\n    if (ngx_array_init(&values, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    pf = &flushes;\n    pl = &lengths;\n    pv = &values;\n    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n    sc.cf = ccv->cf;\n    sc.source = v;\n    sc.flushes = &pf;\n    sc.lengths = &pl;\n    sc.values = &pv;\n    sc.complete_lengths = 1;\n    sc.complete_values = 1;\n    sc.zero = ccv->zero;\n    sc.conf_prefix = ccv->conf_prefix;\n    sc.root_prefix = ccv->root_prefix;\n    if (ngx_http_script_compile(&sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (flushes.nelts) {\n        ccv->complex_value->flushes = flushes.elts;\n        ccv->complex_value->flushes[flushes.nelts] = (ngx_uint_t) -1;\n    }\n    ccv->complex_value->lengths = lengths.elts;\n    ccv->complex_value->values = values.elts;\n    return NGX_OK;\n}"]