src/http/modules/ngx_http_proxy_module.c:820: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_proxy_module.c:816:9: Assignment
814. 
815.     if (r->valid_location) {
816.         p = ngx_copy(p, ctx->vars.uri.data, ctx->vars.uri.len);
             ^
817.     }
818. 

src/http/modules/ngx_http_proxy_module.c:820:9: Call
818. 
819.     if (escape) {
820.         ngx_escape_uri(p, r->uri.data + loc_len,
             ^
821.                        r->uri.len - loc_len, NGX_ESCAPE_URI);
822.         p += r->uri.len - loc_len + escape;

src/core/ngx_string.c:1213:1: <Length trace>
1211. 
1212. 
1213. uintptr_t
      ^
1214. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1215. {

src/core/ngx_string.c:1213:1: Parameter `*dst`
  1211. 
  1212. 
  1213. uintptr_t
        ^
  1214. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1215. {

src/core/ngx_string.c:1346:14: Assignment
  1344.     for (i = 0; i < size; i++) {
  1345.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1346.             *dst++ = '%';
                     ^
  1347.             *dst++ = hex[*src >> 4];
  1348.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1347:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1345.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1346.             *dst++ = '%';
  1347.             *dst++ = hex[*src >> 4];
                    ^
  1348.             *dst++ = hex[*src & 0xf];
  1349.             src++;

uintptr_t
ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
{
    ngx_uint_t      i, n;
    uint32_t       *escape;
    static u_char   hex[] = "0123456789abcdef";
    static uint32_t   uri[] = {
        0xffffffff,
        0x80000029,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   args[] = {
        0xffffffff,
        0x80000829,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   html[] = {
        0xffffffff,
        0x000000ad,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   refresh[] = {
        0xffffffff,
        0x00000085,
        0x00000000,
        0x80000000,
        0xffffffff,
        0xffffffff,
        0xffffffff,
        0xffffffff
    };
    static uint32_t   memcached[] = {
        0xffffffff,
        0x00000021,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
        0x00000000,
    };
    static uint32_t  *map[] =
        { uri, args, html, refresh, memcached, memcached };
    escape = map[type];
    if (dst == NULL) {
        n  = 0;
        for (i = 0; i < size; i++) {
            if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
                n++;
            }
            src++;
        }
        return (uintptr_t) n;
    }
    for (i = 0; i < size; i++) {
        if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
            *dst++ = '%';
            *dst++ = hex[*src >> 4];
            *dst++ = hex[*src & 0xf];
            src++;
        } else {
            *dst++ = *src++;
        }
    }
    return (uintptr_t) dst;
}
['static ngx_int_t\nngx_http_proxy_create_key(ngx_http_request_t *r)\n{\n    size_t                      len, loc_len;\n    u_char                     *p;\n    uintptr_t                   escape;\n    ngx_str_t                  *key;\n    ngx_http_upstream_t        *u;\n    ngx_http_proxy_ctx_t       *ctx;\n    ngx_http_proxy_loc_conf_t  *plcf;\n    u = r->upstream;\n    plcf = ngx_http_get_module_loc_conf(r, ngx_http_proxy_module);\n    ctx = ngx_http_get_module_ctx(r, ngx_http_proxy_module);\n    key = ngx_array_push(&r->cache->keys);\n    if (key == NULL) {\n        return NGX_ERROR;\n    }\n    if (plcf->cache_key.value.len) {\n        if (ngx_http_complex_value(r, &plcf->cache_key, key) != NGX_OK) {\n            return NGX_ERROR;\n        }\n        return NGX_OK;\n    }\n    *key = ctx->vars.key_start;\n    key = ngx_array_push(&r->cache->keys);\n    if (key == NULL) {\n        return NGX_ERROR;\n    }\n    if (plcf->proxy_lengths) {\n        *key = ctx->vars.uri;\n        u->uri = ctx->vars.uri;\n        return NGX_OK;\n    } else if (ctx->vars.uri.len == 0 && r->valid_unparsed_uri && r == r->main)\n    {\n        *key = r->unparsed_uri;\n        u->uri = r->unparsed_uri;\n        return NGX_OK;\n    }\n    loc_len = (r->valid_location && ctx->vars.uri.len) ? plcf->location.len : 0;\n    if (r->quoted_uri || r->internal) {\n        escape = 2 * ngx_escape_uri(NULL, r->uri.data + loc_len,\n                                    r->uri.len - loc_len, NGX_ESCAPE_URI);\n    } else {\n        escape = 0;\n    }\n    len = ctx->vars.uri.len + r->uri.len - loc_len + escape\n          + sizeof("?") - 1 + r->args.len;\n    p = ngx_pnalloc(r->pool, len);\n    if (p == NULL) {\n        return NGX_ERROR;\n    }\n    key->data = p;\n    if (r->valid_location) {\n        p = ngx_copy(p, ctx->vars.uri.data, ctx->vars.uri.len);\n    }\n    if (escape) {\n        ngx_escape_uri(p, r->uri.data + loc_len,\n                       r->uri.len - loc_len, NGX_ESCAPE_URI);\n        p += r->uri.len - loc_len + escape;\n    } else {\n        p = ngx_copy(p, r->uri.data + loc_len, r->uri.len - loc_len);\n    }\n    if (r->args.len > 0) {\n        *p++ = \'?\';\n        p = ngx_copy(p, r->args.data, r->args.len);\n    }\n    key->len = p - key->data;\n    u->uri = *key;\n    return NGX_OK;\n}', 'uintptr_t\nngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)\n{\n    ngx_uint_t      i, n;\n    uint32_t       *escape;\n    static u_char   hex[] = "0123456789abcdef";\n    static uint32_t   uri[] = {\n        0xffffffff,\n        0x80000029,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   args[] = {\n        0xffffffff,\n        0x80000829,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   html[] = {\n        0xffffffff,\n        0x000000ad,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   refresh[] = {\n        0xffffffff,\n        0x00000085,\n        0x00000000,\n        0x80000000,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff,\n        0xffffffff\n    };\n    static uint32_t   memcached[] = {\n        0xffffffff,\n        0x00000021,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n        0x00000000,\n    };\n    static uint32_t  *map[] =\n        { uri, args, html, refresh, memcached, memcached };\n    escape = map[type];\n    if (dst == NULL) {\n        n  = 0;\n        for (i = 0; i < size; i++) {\n            if (escape[*src >> 5] & (1 << (*src & 0x1f))) {\n                n++;\n            }\n            src++;\n        }\n        return (uintptr_t) n;\n    }\n    for (i = 0; i < size; i++) {\n        if (escape[*src >> 5] & (1 << (*src & 0x1f))) {\n            *dst++ = \'%\';\n            *dst++ = hex[*src >> 4];\n            *dst++ = hex[*src & 0xf];\n            src++;\n        } else {\n            *dst++ = *src++;\n        }\n    }\n    return (uintptr_t) dst;\n}']