src/http/ngx_http_request.c:1715: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_regex_exec`.

src/http/ngx_http_request.c:1693:12: Call
1691.     }
1692. 
1693.     cscf = ngx_hash_find_combined(&r->virtual_names->names,
                 ^
1694.                                   ngx_hash_key(host, len), host, len);
1695. 

src/core/ngx_hash.c:216:17: Call
  214. 
  215.     if (hash->hash.buckets) {
  216.         value = ngx_hash_find(&hash->hash, key, name, len);
                       ^
  217. 
  218.         if (value) {

src/http/ngx_http_request.c:1715:17: Call
1713.         for (i = 0; i < r->virtual_names->nregex; i++) {
1714. 
1715.             n = ngx_http_regex_exec(r, sn[i].regex, &name);
                      ^
1716. 
1717.             if (n == NGX_OK) {

src/http/ngx_http_variables.c:1753:1: <Offset trace>
1751. 
1752. 
1753. ngx_int_t
      ^
1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
1755. {

src/http/ngx_http_variables.c:1753:1: Parameter `re->variables->capture`
  1751. 
  1752. 
  1753. ngx_int_t
        ^
  1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
  1755. {

src/http/ngx_http_variables.c:1792:9: Assignment
  1790.     for (i = 0; i < re->nvariables; i++) {
  1791. 
  1792.         n = re->variables[i].capture;
                ^
  1793.         index = re->variables[i].index;
  1794.         vv = &r->variables[index];

src/http/ngx_http_variables.c:1753:1: <Length trace>
1751. 
1752. 
1753. ngx_int_t
      ^
1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
1755. {

src/http/ngx_http_variables.c:1753:1: Parameter `*r->captures`
  1751. 
  1752. 
  1753. ngx_int_t
        ^
  1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
  1755. {

src/http/ngx_http_variables.c:1796:19: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_regex_exec` 
  1794.         vv = &r->variables[index];
  1795. 
  1796.         vv->len = r->captures[n + 1] - r->captures[n];
                          ^
  1797.         vv->valid = 1;
  1798.         vv->no_cacheable = 0;

ngx_int_t
ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
{
    ngx_int_t                   rc, index;
    ngx_uint_t                  i, n, len;
    ngx_http_variable_value_t  *vv;
    ngx_http_core_main_conf_t  *cmcf;
    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);
    if (re->ncaptures) {
        len = cmcf->ncaptures;
        if (r->captures == NULL) {
            r->captures = ngx_palloc(r->pool, len * sizeof(int));
            if (r->captures == NULL) {
                return NGX_ERROR;
            }
        }
    } else {
        len = 0;
    }
    rc = ngx_regex_exec(re->regex, s, r->captures, len);
    if (rc == NGX_REGEX_NO_MATCHED) {
        return NGX_DECLINED;
    }
    if (rc < 0) {
        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
                      ngx_regex_exec_n " failed: %i on \"%V\" using \"%V\"",
                      rc, s, &re->name);
        return NGX_ERROR;
    }
    for (i = 0; i < re->nvariables; i++) {
        n = re->variables[i].capture;
        index = re->variables[i].index;
        vv = &r->variables[index];
        vv->len = r->captures[n + 1] - r->captures[n];
        vv->valid = 1;
        vv->no_cacheable = 0;
        vv->not_found = 0;
        vv->data = &s->data[r->captures[n]];
#if (NGX_DEBUG)
        {
        ngx_http_variable_t  *v;
        v = cmcf->variables.elts;
        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                       "http regex set $%V to \"%*s\"",
                       &v[index].name, vv->len, vv->data);
        }
#endif
    }
    r->ncaptures = rc * 2;
    r->captures_data = s->data;
    return NGX_OK;
}
['static ngx_int_t\nngx_http_find_virtual_server(ngx_http_request_t *r, u_char *host, size_t len)\n{\n    ngx_http_core_loc_conf_t  *clcf;\n    ngx_http_core_srv_conf_t  *cscf;\n    if (r->virtual_names == NULL) {\n        return NGX_DECLINED;\n    }\n    cscf = ngx_hash_find_combined(&r->virtual_names->names,\n                                  ngx_hash_key(host, len), host, len);\n    if (cscf) {\n        goto found;\n    }\n#if (NGX_PCRE)\n    if (len && r->virtual_names->nregex) {\n        ngx_int_t                n;\n        ngx_uint_t               i;\n        ngx_str_t                name;\n        ngx_http_server_name_t  *sn;\n        name.len = len;\n        name.data = host;\n        sn = r->virtual_names->regex;\n        for (i = 0; i < r->virtual_names->nregex; i++) {\n            n = ngx_http_regex_exec(r, sn[i].regex, &name);\n            if (n == NGX_OK) {\n                cscf = sn[i].server;\n                goto found;\n            }\n            if (n == NGX_DECLINED) {\n                continue;\n            }\n            return NGX_ERROR;\n        }\n    }\n#endif\n    return NGX_OK;\nfound:\n    r->srv_conf = cscf->ctx->srv_conf;\n    r->loc_conf = cscf->ctx->loc_conf;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    r->connection->log->file = clcf->error_log->file;\n    if (!(r->connection->log->log_level & NGX_LOG_DEBUG_CONNECTION)) {\n        r->connection->log->log_level = clcf->error_log->log_level;\n    }\n    return NGX_OK;\n}', 'void *\nngx_hash_find_combined(ngx_hash_combined_t *hash, ngx_uint_t key, u_char *name,\n    size_t len)\n{\n    void  *value;\n    if (hash->hash.buckets) {\n        value = ngx_hash_find(&hash->hash, key, name, len);\n        if (value) {\n            return value;\n        }\n    }\n    if (len == 0) {\n        return NULL;\n    }\n    if (hash->wc_head && hash->wc_head->hash.buckets) {\n        value = ngx_hash_find_wc_head(hash->wc_head, name, len);\n        if (value) {\n            return value;\n        }\n    }\n    if (hash->wc_tail && hash->wc_tail->hash.buckets) {\n        value = ngx_hash_find_wc_tail(hash->wc_tail, name, len);\n        if (value) {\n            return value;\n        }\n    }\n    return NULL;\n}', 'ngx_int_t\nngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)\n{\n    ngx_int_t                   rc, index;\n    ngx_uint_t                  i, n, len;\n    ngx_http_variable_value_t  *vv;\n    ngx_http_core_main_conf_t  *cmcf;\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    if (re->ncaptures) {\n        len = cmcf->ncaptures;\n        if (r->captures == NULL) {\n            r->captures = ngx_palloc(r->pool, len * sizeof(int));\n            if (r->captures == NULL) {\n                return NGX_ERROR;\n            }\n        }\n    } else {\n        len = 0;\n    }\n    rc = ngx_regex_exec(re->regex, s, r->captures, len);\n    if (rc == NGX_REGEX_NO_MATCHED) {\n        return NGX_DECLINED;\n    }\n    if (rc < 0) {\n        ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,\n                      ngx_regex_exec_n " failed: %i on \\"%V\\" using \\"%V\\"",\n                      rc, s, &re->name);\n        return NGX_ERROR;\n    }\n    for (i = 0; i < re->nvariables; i++) {\n        n = re->variables[i].capture;\n        index = re->variables[i].index;\n        vv = &r->variables[index];\n        vv->len = r->captures[n + 1] - r->captures[n];\n        vv->valid = 1;\n        vv->no_cacheable = 0;\n        vv->not_found = 0;\n        vv->data = &s->data[r->captures[n]];\n#if (NGX_DEBUG)\n        {\n        ngx_http_variable_t  *v;\n        v = cmcf->variables.elts;\n        ngx_log_debug3(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,\n                       "http regex set $%V to \\"%*s\\"",\n                       &v[index].name, vv->len, vv->data);\n        }\n#endif\n    }\n    r->ncaptures = rc * 2;\n    r->captures_data = s->data;\n    return NGX_OK;\n}']