src/http/ngx_http_upstream.c:2568: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_ext_rename_file`.

src/http/ngx_http_upstream.c:2553:9: Call
2551.     if (u->conf->store_lengths == NULL) {
2552. 
2553.         ngx_http_map_uri_to_path(r, &path, &root, 0);
              ^
2554. 
2555.     } else {

src/http/ngx_http_core_module.c:1670:1: Parameter `*path->data`
  1668. 
  1669. 
  1670. u_char *
        ^
  1671. ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path,
  1672.     size_t *root_length, size_t reserved)

src/http/ngx_http_upstream.c:2568:12: Call
2566.                    tf->file.name.data, path.data);
2567. 
2568.     (void) ngx_ext_rename_file(&tf->file.name, &path, &ext);
                 ^
2569. }
2570. 

src/core/ngx_file.c:526:1: Parameter `*to->data`
  524. 
  525. 
  526. ngx_int_t
       ^
  527. ngx_ext_rename_file(ngx_str_t *src, ngx_str_t *to, ngx_ext_rename_file_t *ext)
  528. {

src/core/ngx_file.c:565:15: Call
  563.         }
  564. 
  565.         err = ngx_create_full_path(to->data, ngx_dir_access(ext->path_access));
                     ^
  566. 
  567.         if (err) {

src/core/ngx_file.c:185:1: <Length trace>
183. 
184. 
185. ngx_err_t
     ^
186. ngx_create_full_path(u_char *dir, ngx_uint_t access)
187. {

src/core/ngx_file.c:185:1: Parameter `*dir`
    183. 
    184. 
    185. ngx_err_t
         ^
    186. ngx_create_full_path(u_char *dir, ngx_uint_t access)
    187. {

src/core/ngx_file.c:191:10: Assignment
    189.     ngx_err_t   err;
    190. 
    191.     for (p = dir + 1; *p; p++) {
                  ^
    192.         ch = *p;
    193. 

src/core/ngx_file.c:191:23: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_ext_rename_file` 
    189.     ngx_err_t   err;
    190. 
    191.     for (p = dir + 1; *p; p++) {
                               ^
    192.         ch = *p;
    193. 
