src/http/modules/ngx_http_scgi_module.c:549: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_parse_url`.

src/http/modules/ngx_http_scgi_module.c:540:9: Call
538.     ngx_memzero(&url, sizeof(ngx_url_t));
539. 
540.     if (ngx_http_script_run(r, &url.url, scf->scgi_lengths->elts, 0,
             ^
541.                             scf->scgi_values->elts)
542.         == NULL)

src/http/ngx_http_script.c:487:1: Parameter `len`
  485. 
  486. 
  487. u_char *
       ^
  488. ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value,
  489.     void *code_lengths, size_t len, void *code_values)

src/http/ngx_http_script.c:519:19: Call
  517. 
  518.     value->len = len;
  519.     value->data = ngx_pnalloc(r->pool, len);
                         ^
  520.     if (value->data == NULL) {
  521.         return NULL;

src/core/ngx_palloc.c:140:16: Call
    138. #if !(NGX_DEBUG_PALLOC)
    139.     if (size <= pool->max) {
    140.         return ngx_palloc_small(pool, size, 0);
                        ^
    141.     }
    142. #endif

src/core/ngx_palloc.c:157:9: Assignment
      155. 
      156.     do {
      157.         m = p->d.last;
                   ^
      158. 
      159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
      164.             p->d.last = m + size;
      165. 
      166.             return m;
                       ^
      167.         }
      168. 

src/core/ngx_palloc.c:140:9: Assignment
    138. #if !(NGX_DEBUG_PALLOC)
    139.     if (size <= pool->max) {
    140.         return ngx_palloc_small(pool, size, 0);
                 ^
    141.     }
    142. #endif

src/http/ngx_http_script.c:519:5: Assignment
  517. 
  518.     value->len = len;
  519.     value->data = ngx_pnalloc(r->pool, len);
           ^
  520.     if (value->data == NULL) {
  521.         return NULL;

src/http/modules/ngx_http_scgi_module.c:549:9: Call
547.     url.no_resolve = 1;
548. 
549.     if (ngx_parse_url(r->pool, &url) != NGX_OK) {
             ^
550.         if (url.err) {
551.             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,

src/core/ngx_inet.c:677:1: Parameter `*u->url.data`
  675. 
  676. 
  677. ngx_int_t
       ^
  678. ngx_parse_url(ngx_pool_t *pool, ngx_url_t *u)
  679. {

src/core/ngx_inet.c:691:16: Call
  689. 
  690.     if (len && p[0] == '[') {
  691.         return ngx_parse_inet6_url(pool, u);
                      ^
  692.     }
  693. 

src/core/ngx_inet.c:971:1: Parameter `*u->url.data`
    969. 
    970. 
    971. static ngx_int_t
         ^
    972. ngx_parse_inet6_url(ngx_pool_t *pool, ngx_url_t *u)
    973. {

src/core/ngx_inet.c:984:5: Assignment
    982.     sin6->sin6_family = AF_INET6;
    983. 
    984.     host = u->url.data + 1;
             ^
    985. 
    986.     last = u->url.data + u->url.len;

src/core/ngx_inet.c:988:9: Call
    986.     last = u->url.data + u->url.len;
    987. 
    988.     p = ngx_strlchr(host, last, ']');
                 ^
    989. 
    990.     if (p == NULL) {

src/core/ngx_string.h:65:1: <Length trace>
63. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
64. 
65. static ngx_inline u_char *
    ^
66. ngx_strlchr(u_char *p, u_char *last, u_char c)
67. {

src/core/ngx_string.h:65:1: Parameter `*p`
      63. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
      64. 
      65. static ngx_inline u_char *
          ^
      66. ngx_strlchr(u_char *p, u_char *last, u_char c)
      67. {

src/core/ngx_string.h:70:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_parse_url` 
      68.     while (p < last) {
      69. 
      70.         if (*p == c) {
                      ^
      71.             return p;
      72.         }

static ngx_inline u_char *
ngx_strlchr(u_char *p, u_char *last, u_char c)
{
    while (p < last) {
        if (*p == c) {
            return p;
        }
        p++;
    }
    return NULL;
}
['static ngx_int_t\nngx_http_scgi_eval(ngx_http_request_t *r, ngx_http_scgi_loc_conf_t * scf)\n{\n    ngx_url_t             url;\n    ngx_http_upstream_t  *u;\n    ngx_memzero(&url, sizeof(ngx_url_t));\n    if (ngx_http_script_run(r, &url.url, scf->scgi_lengths->elts, 0,\n                            scf->scgi_values->elts)\n        == NULL)\n    {\n        return NGX_ERROR;\n    }\n    url.no_resolve = 1;\n    if (ngx_parse_url(r->pool, &url) != NGX_OK) {\n        if (url.err) {\n            ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,\n                          "%s in upstream \\"%V\\"", url.err, &url.url);\n        }\n        return NGX_ERROR;\n    }\n    u = r->upstream;\n    u->resolved = ngx_pcalloc(r->pool, sizeof(ngx_http_upstream_resolved_t));\n    if (u->resolved == NULL) {\n        return NGX_ERROR;\n    }\n    if (url.addrs && url.addrs[0].sockaddr) {\n        u->resolved->sockaddr = url.addrs[0].sockaddr;\n        u->resolved->socklen = url.addrs[0].socklen;\n        u->resolved->naddrs = 1;\n        u->resolved->host = url.addrs[0].name;\n    } else {\n        u->resolved->host = url.host;\n    }\n    u->resolved->port = url.port;\n    u->resolved->no_port = url.no_port;\n    return NGX_OK;\n}', 'u_char *\nngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value,\n    void *code_lengths, size_t len, void *code_values)\n{\n    ngx_uint_t                    i;\n    ngx_http_script_code_pt       code;\n    ngx_http_script_len_code_pt   lcode;\n    ngx_http_script_engine_t      e;\n    ngx_http_core_main_conf_t    *cmcf;\n    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);\n    for (i = 0; i < cmcf->variables.nelts; i++) {\n        if (r->variables[i].no_cacheable) {\n            r->variables[i].valid = 0;\n            r->variables[i].not_found = 0;\n        }\n    }\n    ngx_memzero(&e, sizeof(ngx_http_script_engine_t));\n    e.ip = code_lengths;\n    e.request = r;\n    e.flushed = 1;\n    while (*(uintptr_t *) e.ip) {\n        lcode = *(ngx_http_script_len_code_pt *) e.ip;\n        len += lcode(&e);\n    }\n    value->len = len;\n    value->data = ngx_pnalloc(r->pool, len);\n    if (value->data == NULL) {\n        return NULL;\n    }\n    e.ip = code_values;\n    e.pos = value->data;\n    while (*(uintptr_t *) e.ip) {\n        code = *(ngx_http_script_code_pt *) e.ip;\n        code((ngx_http_script_engine_t *) &e);\n    }\n    return e.pos;\n}', 'void *\nngx_pnalloc(ngx_pool_t *pool, size_t size)\n{\n#if !(NGX_DEBUG_PALLOC)\n    if (size <= pool->max) {\n        return ngx_palloc_small(pool, size, 0);\n    }\n#endif\n    return ngx_palloc_large(pool, size);\n}', 'static ngx_inline void *\nngx_palloc_small(ngx_pool_t *pool, size_t size, ngx_uint_t align)\n{\n    u_char      *m;\n    ngx_pool_t  *p;\n    p = pool->current;\n    do {\n        m = p->d.last;\n        if (align) {\n            m = ngx_align_ptr(m, NGX_ALIGNMENT);\n        }\n        if ((size_t) (p->d.end - m) >= size) {\n            p->d.last = m + size;\n            return m;\n        }\n        p = p->d.next;\n    } while (p);\n    return ngx_palloc_block(pool, size);\n}', 'ngx_int_t\nngx_parse_url(ngx_pool_t *pool, ngx_url_t *u)\n{\n    u_char  *p;\n    size_t   len;\n    p = u->url.data;\n    len = u->url.len;\n    if (len >= 5 && ngx_strncasecmp(p, (u_char *) "unix:", 5) == 0) {\n        return ngx_parse_unix_domain_url(pool, u);\n    }\n    if (len && p[0] == \'[\') {\n        return ngx_parse_inet6_url(pool, u);\n    }\n    return ngx_parse_inet_url(pool, u);\n}', 'static ngx_int_t\nngx_parse_inet6_url(ngx_pool_t *pool, ngx_url_t *u)\n{\n#if (NGX_HAVE_INET6)\n    u_char               *p, *host, *port, *last, *uri;\n    size_t                len;\n    ngx_int_t             n;\n    struct sockaddr_in6  *sin6;\n    u->socklen = sizeof(struct sockaddr_in6);\n    sin6 = (struct sockaddr_in6 *) &u->sockaddr;\n    sin6->sin6_family = AF_INET6;\n    host = u->url.data + 1;\n    last = u->url.data + u->url.len;\n    p = ngx_strlchr(host, last, \']\');\n    if (p == NULL) {\n        u->err = "invalid host";\n        return NGX_ERROR;\n    }\n    port = p + 1;\n    uri = ngx_strlchr(port, last, \'/\');\n    if (uri) {\n        if (u->listen || !u->uri_part) {\n            u->err = "invalid host";\n            return NGX_ERROR;\n        }\n        u->uri.len = last - uri;\n        u->uri.data = uri;\n        last = uri;\n    }\n    if (port < last) {\n        if (*port != \':\') {\n            u->err = "invalid host";\n            return NGX_ERROR;\n        }\n        port++;\n        len = last - port;\n        n = ngx_atoi(port, len);\n        if (n < 1 || n > 65535) {\n            u->err = "invalid port";\n            return NGX_ERROR;\n        }\n        u->port = (in_port_t) n;\n        sin6->sin6_port = htons((in_port_t) n);\n        u->port_text.len = len;\n        u->port_text.data = port;\n    } else {\n        u->no_port = 1;\n        u->port = u->default_port;\n        sin6->sin6_port = htons(u->default_port);\n    }\n    len = p - host;\n    if (len == 0) {\n        u->err = "no host";\n        return NGX_ERROR;\n    }\n    u->host.len = len + 2;\n    u->host.data = host - 1;\n    if (ngx_inet6_addr(host, len, sin6->sin6_addr.s6_addr) != NGX_OK) {\n        u->err = "invalid IPv6 address";\n        return NGX_ERROR;\n    }\n    if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {\n        u->wildcard = 1;\n    }\n    u->family = AF_INET6;\n    u->naddrs = 1;\n    u->addrs = ngx_pcalloc(pool, sizeof(ngx_addr_t));\n    if (u->addrs == NULL) {\n        return NGX_ERROR;\n    }\n    sin6 = ngx_pcalloc(pool, sizeof(struct sockaddr_in6));\n    if (sin6 == NULL) {\n        return NGX_ERROR;\n    }\n    ngx_memcpy(sin6, &u->sockaddr, sizeof(struct sockaddr_in6));\n    u->addrs[0].sockaddr = (struct sockaddr *) sin6;\n    u->addrs[0].socklen = sizeof(struct sockaddr_in6);\n    p = ngx_pnalloc(pool, u->host.len + sizeof(":65535") - 1);\n    if (p == NULL) {\n        return NGX_ERROR;\n    }\n    u->addrs[0].name.len = ngx_sprintf(p, "%V:%d",\n                                       &u->host, u->port) - p;\n    u->addrs[0].name.data = p;\n    return NGX_OK;\n#else\n    u->err = "the INET6 sockets are not supported on this platform";\n    return NGX_ERROR;\n#endif\n}', 'static ngx_inline u_char *\nngx_strlchr(u_char *p, u_char *last, u_char c)\n{\n    while (p < last) {\n        if (*p == c) {\n            return p;\n        }\n        p++;\n    }\n    return NULL;\n}']