src/http/ngx_http_core_module.c:4892: error: Buffer Overrun L3
  Offset: [5, +oo] (⇐ 5 + [0, +oo]) Size: [2, +oo] by call to `ngx_http_compile_complex_value`.

src/http/ngx_http_core_module.c:4892:17: Call
4890.             }
4891. 
4892.             if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                      ^
4893.                 return NGX_CONF_ERROR;
4894.             }

src/http/ngx_http_script.c:107:1: Parameter `ccv->value->len`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_core_module.c:4879:13: Assignment
4877. 
4878.         if (ngx_strncmp(value[i].data, "from=", 5) == 0) {
4879.             value[i].len -= 5;
                  ^
4880.             value[i].data += 5;
4881. 

src/http/ngx_http_core_module.c:4892:17: Call
4890.             }
4891. 
4892.             if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                      ^
4893.                 return NGX_CONF_ERROR;
4894.             }

src/http/ngx_http_script.c:107:1: <Offset trace>
105. 
106. 
107. ngx_int_t
     ^
108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
109. {

src/http/ngx_http_script.c:107:1: Parameter `ccv->value->len`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:107:1: <Length trace>
105. 
106. 
107. ngx_int_t
     ^
108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
109. {

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:126:13: Array access: Offset: [5, +oo] (⇐ 5 + [0, +oo]) Size: [2, +oo] by call to `ngx_http_compile_complex_value` 
  124. 
  125.     for (i = 0; i < v->len; i++) {
  126.         if (v->data[i] == '$') {
                   ^
  127.             if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {
  128.                 nc++;
