src/http/ngx_http_special_response.c:473: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_split_args`.

src/http/ngx_http_special_response.c:466:9: Call
464.     r->zero_in_uri = 0;
465. 
466.     if (ngx_http_complex_value(r, &err_page->value, &uri) != NGX_OK) {
             ^
467.         return NGX_ERROR;
468.     }

src/http/ngx_http_script.c:56:1: Parameter `*value->data`
  54. 
  55. 
  56. ngx_int_t
      ^
  57. ngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val,
  58.     ngx_str_t *value)

src/http/ngx_http_special_response.c:473:13: Call
471. 
472.         if (err_page->value.lengths) {
473.             ngx_http_split_args(r, &uri, &args);
                 ^
474. 
475.         } else {

src/http/ngx_http_parse.c:1528:1: Parameter `*uri->data`
  1526. 
  1527. 
  1528. void
        ^
  1529. ngx_http_split_args(ngx_http_request_t *r, ngx_str_t *uri, ngx_str_t *args)
  1530. {

src/http/ngx_http_parse.c:1533:5: Assignment
  1531.     u_char  ch, *p, *last;
  1532. 
  1533.     p = uri->data;
            ^
  1534. 
  1535.     last = p + uri->len;

src/http/ngx_http_parse.c:1541:15: Assignment
  1539.     while (p < last) {
  1540. 
  1541.         ch = *p++;
                      ^
  1542. 
  1543.         if (ch == '?') {

src/http/ngx_http_parse.c:1549:17: Call
  1547.             uri->len = p - 1 - uri->data;
  1548. 
  1549.             if (ngx_strlchr(p, last, '\0') != NULL) {
                        ^
  1550.                 r->zero_in_uri = 1;
  1551.             }

src/core/ngx_string.h:61:1: <Length trace>
59. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
60. 
61. static ngx_inline u_char *
    ^
62. ngx_strlchr(u_char *p, u_char *last, u_char c)
63. {

src/core/ngx_string.h:61:1: Parameter `*p`
    59. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
    60. 
    61. static ngx_inline u_char *
        ^
    62. ngx_strlchr(u_char *p, u_char *last, u_char c)
    63. {

src/core/ngx_string.h:66:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_http_split_args` 
    64.     while (p < last) {
    65. 
    66.         if (*p == c) {
                    ^
    67.             return p;
    68.         }
