src/http/modules/ngx_http_fastcgi_module.c:753: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_parse_url`.

src/http/modules/ngx_http_fastcgi_module.c:744:9: Call
742.     ngx_memzero(&url, sizeof(ngx_url_t));
743. 
744.     if (ngx_http_script_run(r, &url.url, flcf->fastcgi_lengths->elts, 0,
             ^
745.                             flcf->fastcgi_values->elts)
746.         == NULL)

src/http/ngx_http_script.c:485:1: Parameter `len`
  483. 
  484. 
  485. u_char *
       ^
  486. ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value,
  487.     void *code_lengths, size_t len, void *code_values)

src/http/ngx_http_script.c:517:19: Call
  515. 
  516.     value->len = len;
  517.     value->data = ngx_pnalloc(r->pool, len);
                         ^
  518.     if (value->data == NULL) {
  519.         return NULL;

src/core/ngx_palloc.c:140:16: Call
    138. #if !(NGX_DEBUG_PALLOC)
    139.     if (size <= pool->max) {
    140.         return ngx_palloc_small(pool, size, 0);
                        ^
    141.     }
    142. #endif

src/core/ngx_palloc.c:157:9: Assignment
      155. 
      156.     do {
      157.         m = p->d.last;
                   ^
      158. 
      159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
      164.             p->d.last = m + size;
      165. 
      166.             return m;
                       ^
      167.         }
      168. 

src/core/ngx_palloc.c:140:9: Assignment
    138. #if !(NGX_DEBUG_PALLOC)
    139.     if (size <= pool->max) {
    140.         return ngx_palloc_small(pool, size, 0);
                 ^
    141.     }
    142. #endif

src/http/ngx_http_script.c:517:5: Assignment
  515. 
  516.     value->len = len;
  517.     value->data = ngx_pnalloc(r->pool, len);
           ^
  518.     if (value->data == NULL) {
  519.         return NULL;

src/http/modules/ngx_http_fastcgi_module.c:753:9: Call
751.     url.no_resolve = 1;
752. 
753.     if (ngx_parse_url(r->pool, &url) != NGX_OK) {
             ^
754.         if (url.err) {
755.             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,

src/core/ngx_inet.c:528:1: Parameter `*u->url.data`
  526. 
  527. 
  528. ngx_int_t
       ^
  529. ngx_parse_url(ngx_pool_t *pool, ngx_url_t *u)
  530. {

src/core/ngx_inet.c:545:12: Call
  543.     }
  544. 
  545.     return ngx_parse_inet_url(pool, u);
                  ^
  546. }
  547. 

src/core/ngx_inet.c:672:13: Assignment
    670. 
    671.         if (uri < port) {
    672.             port = NULL;
                     ^
    673.         }
    674.     }

src/core/ngx_inet.c:677:9: Assignment
    675. 
    676.     if (port) {
    677.         port++;
                 ^
    678. 
    679.         len = last - port;

src/core/ngx_inet.c:681:13: Call
    679.         len = last - port;
    680. 
    681.         n = ngx_atoi(port, len);
                     ^
    682. 
    683.         if (n < 1 || n > 65535) {

src/core/ngx_string.c:901:1: <Length trace>
899. 
900. 
901. ngx_int_t
     ^
902. ngx_atoi(u_char *line, size_t n)
903. {

src/core/ngx_string.c:901:1: Parameter `*line`
      899. 
      900. 
      901. ngx_int_t
           ^
      902. ngx_atoi(u_char *line, size_t n)
      903. {

src/core/ngx_string.c:914:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_parse_url` 
      912. 
      913.     for (value = 0; n--; line++) {
      914.         if (*line < '0' || *line > '9') {
                       ^
      915.             return NGX_ERROR;
      916.         }

ngx_int_t
ngx_atoi(u_char *line, size_t n)
{
    ngx_int_t  value, cutoff, cutlim;
    if (n == 0) {
        return NGX_ERROR;
    }
    cutoff = NGX_MAX_INT_T_VALUE / 10;
    cutlim = NGX_MAX_INT_T_VALUE % 10;
    for (value = 0; n--; line++) {
        if (*line < '0' || *line > '9') {
            return NGX_ERROR;
        }
        if (value >= cutoff && (value > cutoff || *line - '0' > cutlim)) {
            return NGX_ERROR;
        }
        value = value * 10 + (*line - '0');
    }
    return value;
}
['static ngx_int_t\nngx_http_fastcgi_eval(ngx_http_request_t *r, ngx_http_fastcgi_loc_conf_t *flcf)\n{\n    ngx_url_t             url;\n    ngx_http_upstream_t  *u;\n    ngx_memzero(&url, sizeof(ngx_url_t));\n    if (ngx_http_script_run(r, &url.url, flcf->fastcgi_lengths->elts, 0,\n                            flcf->fastcgi_values->elts)\n        == NULL)\n    {\n        return NGX_ERROR;\n    }\n    url.no_resolve = 1;\n    if (ngx_parse_url(r->pool, &url) != NGX_OK) {\n        if (url.err) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "%s in upstream \\"%V\\"", url.err, &url.url);\n        }\n        return NGX_ERROR;\n    }\n    u = r->upstream;\n    u->resolved = ngx_pcalloc(r->pool, sizeof(ngx_http_upstream_resolved_t));\n    if (u->resolved == NULL) {\n        return NGX_ERROR;\n    }\n    if (url.addrs && url.addrs[0].sockaddr) {\n        u->resolved->sockaddr = url.addrs[0].sockaddr;\n        u->resolved->socklen = url.addrs[0].socklen;\n        u->resolved->naddrs = 1;\n        u->resolved->host = url.addrs[0].name;\n    } else {\n        u->resolved->host = url.host;\n    }\n    u->resolved->port = url.port;\n    u->resolved->no_port = url.no_port;\n    return NGX_OK;\n}', 'u_char *\nngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value,\n    void *code_lengths, size_t len, void *code_values)\n{\n    ngx_uint_t                    i;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_len_code_pt   lcode;\n    ngx_http_script_engine_t      e;\n    ngx_http_core_main_conf_t    *cmcf;\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    for (i = 0; i < cmcf->variables.nelts; i++) {\n        if (r->variables[i].no_cacheable) {\n            r->variables[i].valid = 0;\n            r->variables[i].not_found = 0;\n        }\n    }\n    ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n    e.ip = code_lengths;\n    e.request = r;\n    e.flushed = 1;\n    while (*(uintptr_t *) e.ip) {\n        lcode = *(ngx_http_script_len_code_pt *) e.ip;\n        len += lcode(&e);\n    }\n    value->len = len;\n    value->data = ngx_pnalloc(r->pool, len);\n    if (value->data == NULL) {\n        return NULL;\n    }\n    e.ip = code_values;\n    e.pos = value->data;\n    while (*(uintptr_t *) e.ip) {\n        code = *(ngx_http_script_code_pt *) e.ip;\n        code((ngx_http_script_engine_t *) &e);\n    }\n    return e.pos;\n}', 'void *\nngx_pnalloc(ngx_pool_t *pool, size_t size)\n{\n#if !(NGX_DEBUG_PALLOC)\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 0);\n    }\n#endif\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}', 'ngx_int_t\nngx_parse_url(ngx_pool_t *pool, ngx_url_t *u)\n{\n    u_char  *p;\n    size_t   len;\n    p = u->url.data;\n    len = u->url.len;\n    if (len >= 5 && ngx_strncasecmp(p, (u_char *) "unix:", 5) == 0) {\n        return ngx_parse_unix_domain_url(pool, u);\n    }\n    if (len && p[0] == \'[\') {\n        return ngx_parse_inet6_url(pool, u);\n    }\n    return ngx_parse_inet_url(pool, u);\n}', 'static ngx_int_t\nngx_parse_inet_url(ngx_pool_t *pool, ngx_url_t *u)\n{\n    u_char               *p, *host, *port, *last, *uri, *args;\n    size_t                len;\n    ngx_int_t             n;\n    struct sockaddr_in   *sin;\n#if (NGX_HAVE_INET6)\n    struct sockaddr_in6  *sin6;\n#endif\n    u->socklen = sizeof(struct sockaddr_in);\n    sin = (struct sockaddr_in *) &u->sockaddr;\n    sin->sin_family = AF_INET;\n    u->family = AF_INET;\n    host = u->url.data;\n    last = host + u->url.len;\n    port = ngx_strlchr(host, last, \':\');\n    uri = ngx_strlchr(host, last, \'/\');\n    args = ngx_strlchr(host, last, \'?\');\n    if (args) {\n        if (uri == NULL || args < uri) {\n            uri = args;\n        }\n    }\n    if (uri) {\n        if (u->listen || !u->uri_part) {\n            u->err = "invalid host";\n            return NGX_ERROR;\n        }\n        u->uri.len = last - uri;\n        u->uri.data = uri;\n        last = uri;\n        if (uri < port) {\n            port = NULL;\n        }\n    }\n    if (port) {\n        port++;\n        len = last - port;\n        n = ngx_atoi(port, len);\n        if (n < 1 || n > 65535) {\n            u->err = "invalid port";\n            return NGX_ERROR;\n        }\n        u->port = (in_port_t) n;\n        sin->sin_port = htons((in_port_t) n);\n        u->port_text.len = len;\n        u->port_text.data = port;\n        last = port - 1;\n    } else {\n        if (uri == NULL) {\n            if (u->listen) {\n                n = ngx_atoi(host, last - host);\n                if (n != NGX_ERROR) {\n                    if (n < 1 || n > 65535) {\n                        u->err = "invalid port";\n                        return NGX_ERROR;\n                    }\n                    u->port = (in_port_t) n;\n                    sin->sin_port = htons((in_port_t) n);\n                    u->port_text.len = last - host;\n                    u->port_text.data = host;\n                    u->wildcard = 1;\n                    return NGX_OK;\n                }\n            }\n        }\n        u->no_port = 1;\n        u->port = u->default_port;\n        sin->sin_port = htons(u->default_port);\n    }\n    len = last - host;\n    if (len == 0) {\n        u->err = "no host";\n        return NGX_ERROR;\n    }\n    u->host.len = len;\n    u->host.data = host;\n    if (u->listen && len == 1 && *host == \'*\') {\n        sin->sin_addr.s_addr = INADDR_ANY;\n        u->wildcard = 1;\n        return NGX_OK;\n    }\n    sin->sin_addr.s_addr = ngx_inet_addr(host, len);\n    if (sin->sin_addr.s_addr != INADDR_NONE) {\n        if (sin->sin_addr.s_addr == INADDR_ANY) {\n            u->wildcard = 1;\n        }\n        u->naddrs = 1;\n        u->addrs = ngx_pcalloc(pool, sizeof(ngx_addr_t));\n        if (u->addrs == NULL) {\n            return NGX_ERROR;\n        }\n        sin = ngx_pcalloc(pool, sizeof(struct sockaddr_in));\n        if (sin == NULL) {\n            return NGX_ERROR;\n        }\n        ngx_memcpy(sin, u->sockaddr, sizeof(struct sockaddr_in));\n        u->addrs[0].sockaddr = (struct sockaddr *) sin;\n        u->addrs[0].socklen = sizeof(struct sockaddr_in);\n        p = ngx_pnalloc(pool, u->host.len + sizeof(":65535") - 1);\n        if (p == NULL) {\n            return NGX_ERROR;\n        }\n        u->addrs[0].name.len = ngx_sprintf(p, "%V:%d",\n                                           &u->host, u->port) - p;\n        u->addrs[0].name.data = p;\n        return NGX_OK;\n    }\n    if (u->no_resolve) {\n        return NGX_OK;\n    }\n    if (ngx_inet_resolve_host(pool, u) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    u->family = u->addrs[0].sockaddr->sa_family;\n    u->socklen = u->addrs[0].socklen;\n    ngx_memcpy(u->sockaddr, u->addrs[0].sockaddr, u->addrs[0].socklen);\n    switch (u->family) {\n#if (NGX_HAVE_INET6)\n    case AF_INET6:\n        sin6 = (struct sockaddr_in6 *) &u->sockaddr;\n        if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {\n            u->wildcard = 1;\n        }\n        break;\n#endif\n    default:\n        sin = (struct sockaddr_in *) &u->sockaddr;\n        if (sin->sin_addr.s_addr == INADDR_ANY) {\n            u->wildcard = 1;\n        }\n        break;\n    }\n    return NGX_OK;\n}', "ngx_int_t\nngx_atoi(u_char *line, size_t n)\n{\n    ngx_int_t  value, cutoff, cutlim;\n    if (n == 0) {\n        return NGX_ERROR;\n    }\n    cutoff = NGX_MAX_INT_T_VALUE / 10;\n    cutlim = NGX_MAX_INT_T_VALUE % 10;\n    for (value = 0; n--; line++) {\n        if (*line < '0' || *line > '9') {\n            return NGX_ERROR;\n        }\n        if (value >= cutoff && (value > cutoff || *line - '0' > cutlim)) {\n            return NGX_ERROR;\n        }\n        value = value * 10 + (*line - '0');\n    }\n    return value;\n}"]