src/http/modules/ngx_http_referer_module.c:275: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `ngx_http_add_variable`.

src/http/modules/ngx_http_referer_module.c:275:11: Call
273.     ngx_http_variable_t  *var;
274. 
275.     var = ngx_http_add_variable(cf, &ngx_http_invalid_referer_name,
               ^
276.                                 NGX_HTTP_VAR_CHANGEABLE);
277.     if (var == NULL) {

src/http/ngx_http_variables.c:392:1: Parameter `name->len`
  390. 
  391. 
  392. ngx_http_variable_t *
       ^
  393. ngx_http_add_variable(ngx_conf_t *cf, ngx_str_t *name, ngx_uint_t flags)
  394. {

src/http/ngx_http_variables.c:439:5: Assignment
  437.     }
  438. 
  439.     v->name.len = name->len;
           ^
  440.     v->name.data = ngx_pnalloc(cf->pool, name->len);
  441.     if (v->name.data == NULL) {

src/http/ngx_http_variables.c:453:10: Call
  451.     v->index = 0;
  452. 
  453.     rc = ngx_hash_add_key(cmcf->variables_keys, &v->name, v, 0);
                ^
  454. 
  455.     if (rc == NGX_ERROR) {

src/core/ngx_hash.c:712:1: <Offset trace>
710. 
711. 
712. ngx_int_t
     ^
713. ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value,
714.     ngx_uint_t flags)

src/core/ngx_hash.c:712:1: Parameter `key->len`
    710. 
    711. 
    712. ngx_int_t
         ^
    713. ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value,
    714.     ngx_uint_t flags)

src/core/ngx_hash.c:712:1: <Length trace>
710. 
711. 
712. ngx_int_t
     ^
713. ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value,
714.     ngx_uint_t flags)

src/core/ngx_hash.c:712:1: Parameter `*key->data`
    710. 
    711. 
    712. ngx_int_t
         ^
    713. ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value,
    714.     ngx_uint_t flags)

src/core/ngx_hash.c:763:17: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `ngx_http_add_variable` 
    761.             }
    762. 
    763.             if (key->data[i - 2] == '.' && key->data[i - 1] == '*') {
                         ^
    764.                 skip = 0;
    765.                 last -= 2;
