src/http/ngx_http_special_response.c:473: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_split_args`.

src/http/ngx_http_special_response.c:466:9: Call
464.     r->zero_in_uri = 0;
465. 
466.     if (ngx_http_complex_value(r, &err_page->value, &uri) != NGX_OK) {
             ^
467.         return NGX_ERROR;
468.     }

src/http/ngx_http_script.c:56:1: Parameter `*value->data`
  54. 
  55. 
  56. ngx_int_t
      ^
  57. ngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val,
  58.     ngx_str_t *value)

src/http/ngx_http_special_response.c:473:13: Call
471. 
472.         if (err_page->value.lengths) {
473.             ngx_http_split_args(r, &uri, &args);
                 ^
474. 
475.         } else {

src/http/ngx_http_parse.c:1528:1: Parameter `*uri->data`
  1526. 
  1527. 
  1528. void
        ^
  1529. ngx_http_split_args(ngx_http_request_t *r, ngx_str_t *uri, ngx_str_t *args)
  1530. {

src/http/ngx_http_parse.c:1533:5: Assignment
  1531.     u_char  ch, *p, *last;
  1532. 
  1533.     p = uri->data;
            ^
  1534. 
  1535.     last = p + uri->len;

src/http/ngx_http_parse.c:1541:15: Assignment
  1539.     while (p < last) {
  1540. 
  1541.         ch = *p++;
                      ^
  1542. 
  1543.         if (ch == '?') {

src/http/ngx_http_parse.c:1549:17: Call
  1547.             uri->len = p - 1 - uri->data;
  1548. 
  1549.             if (ngx_strlchr(p, last, '\0') != NULL) {
                        ^
  1550.                 r->zero_in_uri = 1;
  1551.             }

src/core/ngx_string.h:61:1: <Length trace>
59. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
60. 
61. static ngx_inline u_char *
    ^
62. ngx_strlchr(u_char *p, u_char *last, u_char c)
63. {

src/core/ngx_string.h:61:1: Parameter `*p`
    59. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
    60. 
    61. static ngx_inline u_char *
        ^
    62. ngx_strlchr(u_char *p, u_char *last, u_char c)
    63. {

src/core/ngx_string.h:66:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_split_args` 
    64.     while (p < last) {
    65. 
    66.         if (*p == c) {
                    ^
    67.             return p;
    68.         }

static ngx_inline u_char *
ngx_strlchr(u_char *p, u_char *last, u_char c)
{
    while (p < last) {
        if (*p == c) {
            return p;
        }
        p++;
    }
    return NULL;
}
['static ngx_int_t\nngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)\n{\n    ngx_int_t                  overwrite;\n    ngx_str_t                  uri, args;\n    ngx_table_elt_t           *location;\n    ngx_http_core_loc_conf_t  *clcf;\n    overwrite = err_page->overwrite;\n    if (overwrite && overwrite != NGX_HTTP_OK) {\n        r->expect_tested = 1;\n    }\n    r->err_status = overwrite;\n    r->zero_in_uri = 0;\n    if (ngx_http_complex_value(r, &err_page->value, &uri) != NGX_OK) {\n        return NGX_ERROR;\n    }\n    if (uri.data[0] == \'/\') {\n        if (err_page->value.lengths) {\n            ngx_http_split_args(r, &uri, &args);\n        } else {\n            args = err_page->args;\n        }\n        if (r->method != NGX_HTTP_HEAD) {\n            r->method = NGX_HTTP_GET;\n            r->method_name = ngx_http_get_name;\n        }\n        return ngx_http_internal_redirect(r, &uri, &args);\n    }\n    if (uri.data[0] == \'@\') {\n        return ngx_http_named_location(r, &uri);\n    }\n    location = ngx_list_push(&r->headers_out.headers);\n    if (location == NULL) {\n        return NGX_ERROR;\n    }\n    r->err_status = NGX_HTTP_MOVED_TEMPORARILY;\n    location->hash = 1;\n    location->key.len = sizeof("Location") - 1;\n    location->key.data = (u_char *) "Location";\n    location->value = uri;\n    r->headers_out.location = location;\n    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);\n    if (clcf->msie_refresh && r->headers_in.msie) {\n        return ngx_http_send_refresh(r);\n    }\n    return ngx_http_send_special_response(r, clcf, NGX_HTTP_MOVED_TEMPORARILY\n                                                   - NGX_HTTP_MOVED_PERMANENTLY\n                                                   + NGX_HTTP_LEVEL_200);\n}', 'ngx_int_t\nngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val,\n    ngx_str_t *value)\n{\n    size_t                        len;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_len_code_pt   lcode;\n    ngx_http_script_engine_t      e;\n    if (val->lengths == NULL) {\n        *value = val->value;\n        return NGX_OK;\n    }\n    ngx_http_script_flush_complex_value(r, val);\n    ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n    e.ip = val->lengths;\n    e.request = r;\n    e.flushed = 1;\n    len = 0;\n    while (*(uintptr_t *) e.ip) {\n        lcode = *(ngx_http_script_len_code_pt *) e.ip;\n        len += lcode(&e);\n    }\n    value->len = len;\n    value->data = ngx_pnalloc(r->pool, len);\n    if (value->data == NULL) {\n        return NGX_ERROR;\n    }\n    e.ip = val->values;\n    e.pos = value->data;\n    e.buf = *value;\n    while (*(uintptr_t *) e.ip) {\n        code = *(ngx_http_script_code_pt *) e.ip;\n        code((ngx_http_script_engine_t *) &e);\n    }\n    *value = e.buf;\n    return NGX_OK;\n}', "void\nngx_http_split_args(ngx_http_request_t *r, ngx_str_t *uri, ngx_str_t *args)\n{\n    u_char  ch, *p, *last;\n    p = uri->data;\n    last = p + uri->len;\n    args->len = 0;\n    while (p < last) {\n        ch = *p++;\n        if (ch == '?') {\n            args->len = last - p;\n            args->data = p;\n            uri->len = p - 1 - uri->data;\n            if (ngx_strlchr(p, last, '\\0') != NULL) {\n                r->zero_in_uri = 1;\n            }\n            return;\n        }\n        if (ch == '\\0') {\n            r->zero_in_uri = 1;\n            continue;\n        }\n    }\n}", 'static ngx_inline u_char *\nngx_strlchr(u_char *p, u_char *last, u_char c)\n{\n    while (p < last) {\n        if (*p == c) {\n            return p;\n        }\n        p++;\n    }\n    return NULL;\n}']