src/http/modules/ngx_http_referer_module.c:275: error: Buffer Overrun L3
  Offset added: [-3, +oo] (⇐ [0, 2] + [-3, +oo]) Size: [8, +oo] by call to `ngx_http_add_variable`.

src/http/modules/ngx_http_referer_module.c:275:11: Call
273.     ngx_http_variable_t  *var;
274. 
275.     var = ngx_http_add_variable(cf, &ngx_http_invalid_referer_name,
               ^
276.                                 NGX_HTTP_VAR_CHANGEABLE);
277.     if (var == NULL) {

src/http/ngx_http_variables.c:392:1: Parameter `name->len`
  390. 
  391. 
  392. ngx_http_variable_t *
       ^
  393. ngx_http_add_variable(ngx_conf_t *cf, ngx_str_t *name, ngx_uint_t flags)
  394. {

src/http/ngx_http_variables.c:439:5: Assignment
  437.     }
  438. 
  439.     v->name.len = name->len;
           ^
  440.     v->name.data = ngx_pnalloc(cf->pool, name->len);
  441.     if (v->name.data == NULL) {

src/http/ngx_http_variables.c:453:10: Call
  451.     v->index = 0;
  452. 
  453.     rc = ngx_hash_add_key(cmcf->variables_keys, &v->name, v, 0);
                ^
  454. 
  455.     if (rc == NGX_ERROR) {

src/core/ngx_hash.c:752:13: <Offset trace>
750. 
751.         if (key->len > 1 && key->data[0] == '.') {
752.             skip = 1;
                 ^
753.             goto wildcard;
754.         }

src/core/ngx_hash.c:752:13: Assignment
    750. 
    751.         if (key->len > 1 && key->data[0] == '.') {
    752.             skip = 1;
                     ^
    753.             goto wildcard;
    754.         }

src/core/ngx_hash.c:966:5: Assignment
    964.     }
    965. 
    966.     name->len = last - skip;
             ^
    967.     name->data = ngx_pnalloc(ha->temp_pool, name->len);
    968.     if (name->data == NULL) {

src/core/ngx_hash.c:712:1: <Length trace>
710. 
711. 
712. ngx_int_t
     ^
713. ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value,
714.     ngx_uint_t flags)

src/core/ngx_hash.c:712:1: Parameter `*key->data`
    710. 
    711. 
    712. ngx_int_t
         ^
    713. ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value,
    714.     ngx_uint_t flags)

src/core/ngx_hash.c:972:5: Array access: Offset added: [-3, +oo] (⇐ [0, 2] + [-3, +oo]) Size: [8, +oo] by call to `ngx_http_add_variable` 
    970.     }
    971. 
    972.     ngx_memcpy(name->data, key->data + skip, name->len);
             ^
    973. 
    974. 
