src/http/modules/ngx_http_fastcgi_module.c:647: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_parse_url`.

src/http/modules/ngx_http_fastcgi_module.c:638:9: Call
636.     ngx_memzero(&url, sizeof(ngx_url_t));
637. 
638.     if (ngx_http_script_run(r, &url.url, flcf->fastcgi_lengths->elts, 0,
             ^
639.                             flcf->fastcgi_values->elts)
640.         == NULL)

src/http/ngx_http_script.c:488:1: Parameter `len`
  486. 
  487. 
  488. u_char *
       ^
  489. ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value,
  490.     void *code_lengths, size_t len, void *code_values)

src/http/ngx_http_script.c:520:19: Call
  518. 
  519.     value->len = len;
  520.     value->data = ngx_pnalloc(r->pool, len);
                         ^
  521.     if (value->data == NULL) {
  522.         return NULL;

src/core/ngx_palloc.c:156:13: Assignment
    154. 
    155.         do {
    156.             m = p->d.last;
                     ^
    157. 
    158.             if ((size_t) (p->d.end - m) >= size) {

src/core/ngx_palloc.c:161:17: Assignment
    159.                 p->d.last = m + size;
    160. 
    161.                 return m;
                         ^
    162.             }
    163. 

src/http/ngx_http_script.c:520:5: Assignment
  518. 
  519.     value->len = len;
  520.     value->data = ngx_pnalloc(r->pool, len);
           ^
  521.     if (value->data == NULL) {
  522.         return NULL;

src/http/modules/ngx_http_fastcgi_module.c:647:9: Call
645.     url.no_resolve = 1;
646. 
647.     if (ngx_parse_url(r->pool, &url) != NGX_OK) {
             ^
648.          if (url.err) {
649.             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,

src/core/ngx_inet.c:510:1: Parameter `*u->url.data`
  508. 
  509. 
  510. ngx_int_t
       ^
  511. ngx_parse_url(ngx_pool_t *pool, ngx_url_t *u)
  512. {

src/core/ngx_inet.c:530:12: Call
  528.     }
  529. 
  530.     return ngx_parse_inet_url(pool, u);
                  ^
  531. }
  532. 

src/core/ngx_inet.c:658:13: Assignment
    656. 
    657.         if (uri < port) {
    658.             port = NULL;
                     ^
    659.         }
    660.     }

src/core/ngx_inet.c:663:9: Assignment
    661. 
    662.     if (port) {
    663.         port++;
                 ^
    664. 
    665.         len = last - port;

src/core/ngx_inet.c:672:13: Call
    670.         }
    671. 
    672.         n = ngx_atoi(port, len);
                     ^
    673. 
    674.         if (n < 1 || n > 65535) {

src/core/ngx_string.c:851:1: <Length trace>
849. 
850. 
851. ngx_int_t
     ^
852. ngx_atoi(u_char *line, size_t n)
853. {

src/core/ngx_string.c:851:1: Parameter `*line`
      849. 
      850. 
      851. ngx_int_t
           ^
      852. ngx_atoi(u_char *line, size_t n)
      853. {

src/core/ngx_string.c:861:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_parse_url` 
      859. 
      860.     for (value = 0; n--; line++) {
      861.         if (*line < '0' || *line > '9') {
                       ^
      862.             return NGX_ERROR;
      863.         }

ngx_int_t
ngx_atoi(u_char *line, size_t n)
{
    ngx_int_t  value;
    if (n == 0) {
        return NGX_ERROR;
    }
    for (value = 0; n--; line++) {
        if (*line < '0' || *line > '9') {
            return NGX_ERROR;
        }
        value = value * 10 + (*line - '0');
    }
    if (value < 0) {
        return NGX_ERROR;
    } else {
        return value;
    }
}
['static ngx_int_t\nngx_http_fastcgi_eval(ngx_http_request_t *r, ngx_http_fastcgi_loc_conf_t *flcf)\n{\n    ngx_url_t             url;\n    ngx_http_upstream_t  *u;\n    ngx_memzero(&url, sizeof(ngx_url_t));\n    if (ngx_http_script_run(r, &url.url, flcf->fastcgi_lengths->elts, 0,\n                            flcf->fastcgi_values->elts)\n        == NULL)\n    {\n        return NGX_ERROR;\n    }\n    url.no_resolve = 1;\n    if (ngx_parse_url(r->pool, &url) != NGX_OK) {\n         if (url.err) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "%s in upstream \\"%V\\"", url.err, &url.url);\n        }\n        return NGX_ERROR;\n    }\n    u = r->upstream;\n    u->resolved = ngx_pcalloc(r->pool, sizeof(ngx_http_upstream_resolved_t));\n    if (u->resolved == NULL) {\n        return NGX_ERROR;\n    }\n    if (url.addrs && url.addrs[0].sockaddr) {\n        u->resolved->sockaddr = url.addrs[0].sockaddr;\n        u->resolved->socklen = url.addrs[0].socklen;\n        u->resolved->naddrs = 1;\n        u->resolved->host = url.addrs[0].name;\n    } else {\n        u->resolved->host = url.host;\n        u->resolved->port = url.port;\n        u->resolved->no_port = url.no_port;\n    }\n    return NGX_OK;\n}', 'u_char *\nngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value,\n    void *code_lengths, size_t len, void *code_values)\n{\n    ngx_uint_t                    i;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_len_code_pt   lcode;\n    ngx_http_script_engine_t      e;\n    ngx_http_core_main_conf_t    *cmcf;\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    for (i = 0; i < cmcf->variables.nelts; i++) {\n        if (r->variables[i].no_cacheable) {\n            r->variables[i].valid = 0;\n            r->variables[i].not_found = 0;\n        }\n    }\n    ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n    e.ip = code_lengths;\n    e.request = r;\n    e.flushed = 1;\n    while (*(uintptr_t *) e.ip) {\n        lcode = *(ngx_http_script_len_code_pt *) e.ip;\n        len += lcode(&e);\n    }\n    value->len = len;\n    value->data = ngx_pnalloc(r->pool, len);\n    if (value->data == NULL) {\n        return NULL;\n    }\n    e.ip = code_values;\n    e.pos = value->data;\n    while (*(uintptr_t *) e.ip) {\n        code = *(ngx_http_script_code_pt *) e.ip;\n        code((ngx_http_script_engine_t *) &e);\n    }\n    return e.pos;\n}', 'void *\nngx_pnalloc(ngx_pool_t *pool, size_t size)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    if (size <= pool->max) {\n        p = pool->current;\n        do {\n            m = p->d.last;\n            if ((size_t) (p->d.end - m) >= size) {\n                p->d.last = m + size;\n                return m;\n            }\n            p = p->d.next;\n        } while (p);\n        return ngx_palloc_block(pool, size);\n    }\n    return ngx_palloc_large(pool, size);\n}', 'ngx_int_t\nngx_parse_url(ngx_pool_t *pool, ngx_url_t *u)\n{\n    u_char  *p;\n    p = u->url.data;\n    if (ngx_strncasecmp(p, (u_char *) "unix:", 5) == 0) {\n        return ngx_parse_unix_domain_url(pool, u);\n    }\n    if ((p[0] == \':\' || p[0] == \'/\') && !u->listen) {\n        u->err = "invalid host";\n        return NGX_ERROR;\n    }\n    if (p[0] == \'[\') {\n        return ngx_parse_inet6_url(pool, u);\n    }\n    return ngx_parse_inet_url(pool, u);\n}', 'static ngx_int_t\nngx_parse_inet_url(ngx_pool_t *pool, ngx_url_t *u)\n{\n    u_char              *p, *host, *port, *last, *uri, *args;\n    size_t               len;\n    ngx_int_t            n;\n    struct hostent      *h;\n    struct sockaddr_in  *sin;\n    u->socklen = sizeof(struct sockaddr_in);\n    sin = (struct sockaddr_in *) &u->sockaddr;\n    sin->sin_family = AF_INET;\n    u->family = AF_INET;\n    host = u->url.data;\n    last = host + u->url.len;\n    port = ngx_strlchr(host, last, \':\');\n    uri = ngx_strlchr(host, last, \'/\');\n    args = ngx_strlchr(host, last, \'?\');\n    if (args) {\n        if (uri == NULL) {\n            uri = args;\n        } else if (args < uri) {\n            uri = args;\n        }\n    }\n    if (uri) {\n        if (u->listen || !u->uri_part) {\n            u->err = "invalid host";\n            return NGX_ERROR;\n        }\n        u->uri.len = last - uri;\n        u->uri.data = uri;\n        last = uri;\n        if (uri < port) {\n            port = NULL;\n        }\n    }\n    if (port) {\n        port++;\n        len = last - port;\n        if (len == 0) {\n            u->err = "invalid port";\n            return NGX_ERROR;\n        }\n        n = ngx_atoi(port, len);\n        if (n < 1 || n > 65535) {\n            u->err = "invalid port";\n            return NGX_ERROR;\n        }\n        u->port = (in_port_t) n;\n        sin->sin_port = htons((in_port_t) n);\n        u->port_text.len = len;\n        u->port_text.data = port;\n        last = port - 1;\n    } else {\n        if (uri == NULL) {\n            if (u->listen) {\n                n = ngx_atoi(host, last - host);\n                if (n != NGX_ERROR) {\n                    if (n < 1 || n > 65535) {\n                        u->err = "invalid port";\n                        return NGX_ERROR;\n                    }\n                    u->port = (in_port_t) n;\n                    sin->sin_port = htons((in_port_t) n);\n                    u->port_text.len = last - host;\n                    u->port_text.data = host;\n                    u->wildcard = 1;\n                    return NGX_OK;\n                }\n            }\n        }\n        u->no_port = 1;\n    }\n    len = last - host;\n    if (len == 0) {\n        u->err = "no host";\n        return NGX_ERROR;\n    }\n    if (len == 1 && *host == \'*\') {\n        len = 0;\n    }\n    u->host.len = len;\n    u->host.data = host;\n    if (u->no_resolve) {\n        return NGX_OK;\n    }\n    if (len) {\n        sin->sin_addr.s_addr = ngx_inet_addr(host, len);\n        if (sin->sin_addr.s_addr == INADDR_NONE) {\n            p = ngx_alloc(++len, pool->log);\n            if (p == NULL) {\n                return NGX_ERROR;\n            }\n            (void) ngx_cpystrn(p, host, len);\n            h = gethostbyname((const char *) p);\n            ngx_free(p);\n            if (h == NULL || h->h_addr_list[0] == NULL) {\n                u->err = "host not found";\n                return NGX_ERROR;\n            }\n            sin->sin_addr.s_addr = *(in_addr_t *) (h->h_addr_list[0]);\n        }\n        if (sin->sin_addr.s_addr == INADDR_ANY) {\n            u->wildcard = 1;\n        }\n    } else {\n        sin->sin_addr.s_addr = INADDR_ANY;\n        u->wildcard = 1;\n    }\n    if (u->no_port) {\n        u->port = u->default_port;\n        sin->sin_port = htons(u->default_port);\n    }\n    if (u->listen) {\n        return NGX_OK;\n    }\n    if (ngx_inet_resolve_host(pool, u) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    return NGX_OK;\n}', "ngx_int_t\nngx_atoi(u_char *line, size_t n)\n{\n    ngx_int_t  value;\n    if (n == 0) {\n        return NGX_ERROR;\n    }\n    for (value = 0; n--; line++) {\n        if (*line < '0' || *line > '9') {\n            return NGX_ERROR;\n        }\n        value = value * 10 + (*line - '0');\n    }\n    if (value < 0) {\n        return NGX_ERROR;\n    } else {\n        return value;\n    }\n}"]