src/http/ngx_http_upstream.c:2696: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_ext_rename_file`.

src/http/ngx_http_upstream.c:2679:9: Call
2677.     if (u->conf->store_lengths == NULL) {
2678. 
2679.         ngx_http_map_uri_to_path(r, &path, &root, 0);
              ^
2680. 
2681.     } else {

src/http/ngx_http_core_module.c:1725:1: Parameter `*path->data`
  1723. 
  1724. 
  1725. u_char *
        ^
  1726. ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path,
  1727.     size_t *root_length, size_t reserved)

src/http/ngx_http_upstream.c:2696:12: Call
2694.                    tf->file.name.data, path.data);
2695. 
2696.     (void) ngx_ext_rename_file(&tf->file.name, &path, &ext);
                 ^
2697. }
2698. 

src/core/ngx_file.c:534:1: Parameter `*to->data`
  532. 
  533. 
  534. ngx_int_t
       ^
  535. ngx_ext_rename_file(ngx_str_t *src, ngx_str_t *to, ngx_ext_rename_file_t *ext)
  536. {

src/core/ngx_file.c:575:15: Call
  573.         }
  574. 
  575.         err = ngx_create_full_path(to->data, ngx_dir_access(ext->path_access));
                     ^
  576. 
  577.         if (err) {

src/core/ngx_file.c:180:1: <Length trace>
178. 
179. 
180. ngx_err_t
     ^
181. ngx_create_full_path(u_char *dir, ngx_uint_t access)
182. {

src/core/ngx_file.c:180:1: Parameter `*dir`
    178. 
    179. 
    180. ngx_err_t
         ^
    181. ngx_create_full_path(u_char *dir, ngx_uint_t access)
    182. {

src/core/ngx_file.c:191:5: Assignment
    189.     p = dir + 3;
    190. #else
    191.     p = dir + 1;
             ^
    192. #endif
    193. 

src/core/ngx_file.c:194:24: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_ext_rename_file` 
    192. #endif
    193. 
    194.     for ( /* void */ ; *p; p++) {
                                ^
    195.         ch = *p;
    196. 
