src/http/modules/ngx_http_scgi_module.c:549: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_parse_url`.

src/http/modules/ngx_http_scgi_module.c:540:9: Call
538.     ngx_memzero(&url, sizeof(ngx_url_t));
539. 
540.     if (ngx_http_script_run(r, &url.url, scf->scgi_lengths->elts, 0,
             ^
541.                             scf->scgi_values->elts)
542.         == NULL)

src/http/ngx_http_script.c:487:1: Parameter `len`
  485. 
  486. 
  487. u_char *
       ^
  488. ngx_http_script_run(ngx_http_request_t *r, ngx_str_t *value,
  489.     void *code_lengths, size_t len, void *code_values)

src/http/ngx_http_script.c:519:19: Call
  517. 
  518.     value->len = len;
  519.     value->data = ngx_pnalloc(r->pool, len);
                         ^
  520.     if (value->data == NULL) {
  521.         return NULL;

src/core/ngx_palloc.c:140:16: Call
    138. #if !(NGX_DEBUG_PALLOC)
    139.     if (size <= pool->max) {
    140.         return ngx_palloc_small(pool, size, 0);
                        ^
    141.     }
    142. #endif

src/core/ngx_palloc.c:157:9: Assignment
      155. 
      156.     do {
      157.         m = p->d.last;
                   ^
      158. 
      159.         if (align) {

src/core/ngx_palloc.c:166:13: Assignment
      164.             p->d.last = m + size;
      165. 
      166.             return m;
                       ^
      167.         }
      168. 

src/core/ngx_palloc.c:140:9: Assignment
    138. #if !(NGX_DEBUG_PALLOC)
    139.     if (size <= pool->max) {
    140.         return ngx_palloc_small(pool, size, 0);
                 ^
    141.     }
    142. #endif

src/http/ngx_http_script.c:519:5: Assignment
  517. 
  518.     value->len = len;
  519.     value->data = ngx_pnalloc(r->pool, len);
           ^
  520.     if (value->data == NULL) {
  521.         return NULL;

src/http/modules/ngx_http_scgi_module.c:549:9: Call
547.     url.no_resolve = 1;
548. 
549.     if (ngx_parse_url(r->pool, &url) != NGX_OK) {
             ^
550.         if (url.err) {
551.             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,

src/core/ngx_inet.c:677:1: Parameter `*u->url.data`
  675. 
  676. 
  677. ngx_int_t
       ^
  678. ngx_parse_url(ngx_pool_t *pool, ngx_url_t *u)
  679. {

src/core/ngx_inet.c:691:16: Call
  689. 
  690.     if (len && p[0] == '[') {
  691.         return ngx_parse_inet6_url(pool, u);
                      ^
  692.     }
  693. 

src/core/ngx_inet.c:971:1: Parameter `*u->url.data`
    969. 
    970. 
    971. static ngx_int_t
         ^
    972. ngx_parse_inet6_url(ngx_pool_t *pool, ngx_url_t *u)
    973. {

src/core/ngx_inet.c:984:5: Assignment
    982.     sin6->sin6_family = AF_INET6;
    983. 
    984.     host = u->url.data + 1;
             ^
    985. 
    986.     last = u->url.data + u->url.len;

src/core/ngx_inet.c:988:9: Call
    986.     last = u->url.data + u->url.len;
    987. 
    988.     p = ngx_strlchr(host, last, ']');
                 ^
    989. 
    990.     if (p == NULL) {

src/core/ngx_string.h:65:1: <Length trace>
63. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
64. 
65. static ngx_inline u_char *
    ^
66. ngx_strlchr(u_char *p, u_char *last, u_char c)
67. {

src/core/ngx_string.h:65:1: Parameter `*p`
      63. #define ngx_strchr(s1, c)   strchr((const char *) s1, (int) c)
      64. 
      65. static ngx_inline u_char *
          ^
      66. ngx_strlchr(u_char *p, u_char *last, u_char c)
      67. {

src/core/ngx_string.h:70:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_parse_url` 
      68.     while (p < last) {
      69. 
      70.         if (*p == c) {
                      ^
      71.             return p;
      72.         }
