src/http/ngx_http_core_module.c:5121: error: Buffer Overrun L3
  Offset: [5, +oo] Size: [1, +oo] by call to `ngx_http_compile_complex_value`.

src/http/ngx_http_core_module.c:5121:17: Call
5119.             }
5120. 
5121.             if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                      ^
5122.                 return NGX_CONF_ERROR;
5123.             }

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_core_module.c:5109:13: Assignment
5107.         if (ngx_strncmp(value[i].data, "from=", 5) == 0) {
5108.             value[i].len -= 5;
5109.             value[i].data += 5;
                  ^
5110. 
5111.             ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));

src/http/ngx_http_core_module.c:5121:17: Call
5119.             }
5120. 
5121.             if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                      ^
5122.                 return NGX_CONF_ERROR;
5123.             }

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:134:13: Call
  132.         && (ccv->conf_prefix || ccv->root_prefix))
  133.     {
  134.         if (ngx_get_full_name(ccv->cf->pool,
                   ^
  135.                               ccv->conf_prefix ? &ccv->cf->cycle->conf_prefix:
  136.                                                  &ccv->cf->cycle->prefix,

src/core/ngx_file.c:20:1: Parameter `*name->data`
    18. 
    19. 
    20. ngx_int_t
        ^
    21. ngx_get_full_name(ngx_pool_t *pool, ngx_str_t *prefix, ngx_str_t *name)
    22. {

src/core/ngx_file.c:49:5: Call
    47. 
    48.     p = ngx_cpymem(n, prefix->data, len);
    49.     ngx_cpystrn(p, name->data, name->len + 1);
            ^
    50. 
    51.     name->len += len;

src/core/ngx_string.c:30:1: <Length trace>
28. 
29. 
30. u_char *
    ^
31. ngx_cpystrn(u_char *dst, u_char *src, size_t n)
32. {

src/core/ngx_string.c:30:1: Parameter `*src`
      28. 
      29. 
      30. u_char *
          ^
      31. ngx_cpystrn(u_char *dst, u_char *src, size_t n)
      32. {

src/core/ngx_string.c:38:16: Array access: Offset: [5, +oo] Size: [1, +oo] by call to `ngx_http_compile_complex_value` 
      36. 
      37.     while (--n) {
      38.         *dst = *src;
                         ^
      39. 
      40.         if (*dst == '\0') {

u_char *
ngx_cpystrn(u_char *dst, u_char *src, size_t n)
{
    if (n == 0) {
        return dst;
    }
    while (--n) {
        *dst = *src;
        if (*dst == '\0') {
            return dst;
        }
        dst++;
        src++;
    }
    *dst = '\0';
    return dst;
}
['static char *\nngx_http_disable_symlinks(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)\n{\n    ngx_http_core_loc_conf_t *clcf = conf;\n    ngx_str_t                         *value;\n    ngx_uint_t                         i;\n    ngx_http_compile_complex_value_t   ccv;\n    if (clcf->disable_symlinks != NGX_CONF_UNSET_UINT) {\n        return "is duplicate";\n    }\n    value = cf->args->elts;\n    for (i = 1; i < cf->args->nelts; i++) {\n        if (ngx_strcmp(value[i].data, "off") == 0) {\n            clcf->disable_symlinks = NGX_DISABLE_SYMLINKS_OFF;\n            continue;\n        }\n        if (ngx_strcmp(value[i].data, "if_not_owner") == 0) {\n            clcf->disable_symlinks = NGX_DISABLE_SYMLINKS_NOTOWNER;\n            continue;\n        }\n        if (ngx_strcmp(value[i].data, "on") == 0) {\n            clcf->disable_symlinks = NGX_DISABLE_SYMLINKS_ON;\n            continue;\n        }\n        if (ngx_strncmp(value[i].data, "from=", 5) == 0) {\n            value[i].len -= 5;\n            value[i].data += 5;\n            ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));\n            ccv.cf = cf;\n            ccv.value = &value[i];\n            ccv.complex_value = ngx_palloc(cf->pool,\n                                           sizeof(ngx_http_complex_value_t));\n            if (ccv.complex_value == NULL) {\n                return NGX_CONF_ERROR;\n            }\n            if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {\n                return NGX_CONF_ERROR;\n            }\n            clcf->disable_symlinks_from = ccv.complex_value;\n            continue;\n        }\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "invalid parameter \\"%V\\"", &value[i]);\n        return NGX_CONF_ERROR;\n    }\n    if (clcf->disable_symlinks == NGX_CONF_UNSET_UINT) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "\\"%V\\" must have \\"off\\", \\"on\\" "\n                           "or \\"if_not_owner\\" parameter",\n                           &cmd->name);\n        return NGX_CONF_ERROR;\n    }\n    if (cf->args->nelts == 2) {\n        clcf->disable_symlinks_from = NULL;\n        return NGX_CONF_OK;\n    }\n    if (clcf->disable_symlinks_from == NGX_CONF_UNSET_PTR) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "duplicate parameters \\"%V %V\\"",\n                           &value[1], &value[2]);\n        return NGX_CONF_ERROR;\n    }\n    if (clcf->disable_symlinks == NGX_DISABLE_SYMLINKS_OFF) {\n        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,\n                           "\\"from=\\" cannot be used with \\"off\\" parameter");\n        return NGX_CONF_ERROR;\n    }\n    return NGX_CONF_OK;\n}', "ngx_int_t\nngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)\n{\n    ngx_str_t                  *v;\n    ngx_uint_t                  i, n, nv, nc;\n    ngx_array_t                 flushes, lengths, values, *pf, *pl, *pv;\n    ngx_http_script_compile_t   sc;\n    v = ccv->value;\n    nv = 0;\n    nc = 0;\n    for (i = 0; i < v->len; i++) {\n        if (v->data[i] == '$') {\n            if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {\n                nc++;\n            } else {\n                nv++;\n            }\n        }\n    }\n    if ((v->len == 0 || v->data[0] != '$')\n        && (ccv->conf_prefix || ccv->root_prefix))\n    {\n        if (ngx_get_full_name(ccv->cf->pool,\n                              ccv->conf_prefix ? &ccv->cf->cycle->conf_prefix:\n                                                 &ccv->cf->cycle->prefix,\n                              v)\n            != NGX_OK)\n        {\n            return NGX_ERROR;\n        }\n        ccv->conf_prefix = 0;\n        ccv->root_prefix = 0;\n    }\n    ccv->complex_value->value = *v;\n    ccv->complex_value->flushes = NULL;\n    ccv->complex_value->lengths = NULL;\n    ccv->complex_value->values = NULL;\n    if (nv == 0 && nc == 0) {\n        return NGX_OK;\n    }\n    n = nv + 1;\n    if (ngx_array_init(&flushes, ccv->cf->pool, n, sizeof(ngx_uint_t))\n        != NGX_OK)\n    {\n        return NGX_ERROR;\n    }\n    n = nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                  + sizeof(ngx_http_script_var_code_t))\n        + sizeof(uintptr_t);\n    if (ngx_array_init(&lengths, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    n = (nv * (2 * sizeof(ngx_http_script_copy_code_t)\n                   + sizeof(ngx_http_script_var_code_t))\n                + sizeof(uintptr_t)\n                + v->len\n                + sizeof(uintptr_t) - 1)\n            & ~(sizeof(uintptr_t) - 1);\n    if (ngx_array_init(&values, ccv->cf->pool, n, 1) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    pf = &flushes;\n    pl = &lengths;\n    pv = &values;\n    ngx_memzero(&sc, sizeof(ngx_http_script_compile_t));\n    sc.cf = ccv->cf;\n    sc.source = v;\n    sc.flushes = &pf;\n    sc.lengths = &pl;\n    sc.values = &pv;\n    sc.complete_lengths = 1;\n    sc.complete_values = 1;\n    sc.zero = ccv->zero;\n    sc.conf_prefix = ccv->conf_prefix;\n    sc.root_prefix = ccv->root_prefix;\n    if (ngx_http_script_compile(&sc) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (flushes.nelts) {\n        ccv->complex_value->flushes = flushes.elts;\n        ccv->complex_value->flushes[flushes.nelts] = (ngx_uint_t) -1;\n    }\n    ccv->complex_value->lengths = lengths.elts;\n    ccv->complex_value->values = values.elts;\n    return NGX_OK;\n}", 'ngx_int_t\nngx_get_full_name(ngx_pool_t *pool, ngx_str_t *prefix, ngx_str_t *name)\n{\n    size_t      len;\n    u_char     *p, *n;\n    ngx_int_t   rc;\n    rc = ngx_test_full_name(name);\n    if (rc == NGX_OK) {\n        return rc;\n    }\n    len = prefix->len;\n#if (NGX_WIN32)\n    if (rc == 2) {\n        len = rc;\n    }\n#endif\n    n = ngx_pnalloc(pool, len + name->len + 1);\n    if (n == NULL) {\n        return NGX_ERROR;\n    }\n    p = ngx_cpymem(n, prefix->data, len);\n    ngx_cpystrn(p, name->data, name->len + 1);\n    name->len += len;\n    name->data = n;\n    return NGX_OK;\n}', "u_char *\nngx_cpystrn(u_char *dst, u_char *src, size_t n)\n{\n    if (n == 0) {\n        return dst;\n    }\n    while (--n) {\n        *dst = *src;\n        if (*dst == '\\0') {\n            return dst;\n        }\n        dst++;\n        src++;\n    }\n    *dst = '\\0';\n    return dst;\n}"]