src/http/modules/ngx_http_rewrite_module.c:898: error: Buffer Overrun L3
  Offset added: [-4, +oo] (⇐ [0, 2] + [-4, +oo]) Size: [0, +oo] by call to `ngx_http_add_variable`.

src/http/modules/ngx_http_rewrite_module.c:895:5: Assignment
893.     }
894. 
895.     value[1].len--;
         ^
896.     value[1].data++;
897. 

src/http/modules/ngx_http_rewrite_module.c:898:9: Call
896.     value[1].data++;
897. 
898.     v = ngx_http_add_variable(cf, &value[1], NGX_HTTP_VAR_CHANGEABLE);
             ^
899.     if (v == NULL) {
900.         return NGX_CONF_ERROR;

src/http/ngx_http_variables.c:257:1: Parameter `name->len`
  255. 
  256. 
  257. ngx_http_variable_t *
       ^
  258. ngx_http_add_variable(ngx_conf_t *cf, ngx_str_t *name, ngx_uint_t flags)
  259. {

src/http/ngx_http_variables.c:292:5: Assignment
  290.     }
  291. 
  292.     v->name.len = name->len;
           ^
  293.     v->name.data = ngx_pnalloc(cf->pool, name->len);
  294.     if (v->name.data == NULL) {

src/http/ngx_http_variables.c:306:10: Call
  304.     v->index = 0;
  305. 
  306.     rc = ngx_hash_add_key(cmcf->variables_keys, &v->name, v, 0);
                ^
  307. 
  308.     if (rc == NGX_ERROR) {

src/core/ngx_hash.c:749:13: <Offset trace>
747. 
748.         if (key->len > 1 && key->data[0] == '.') {
749.             skip = 1;
                 ^
750.             goto wildcard;
751.         }

src/core/ngx_hash.c:749:13: Assignment
    747. 
    748.         if (key->len > 1 && key->data[0] == '.') {
    749.             skip = 1;
                     ^
    750.             goto wildcard;
    751.         }

src/core/ngx_hash.c:974:5: Assignment
    972.     }
    973. 
    974.     name->len = last - skip;
             ^
    975.     name->data = ngx_pnalloc(ha->temp_pool, name->len);
    976.     if (name->data == NULL) {

src/core/ngx_hash.c:713:1: <Length trace>
711. 
712. 
713. ngx_int_t
     ^
714. ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value,
715.     ngx_uint_t flags)

src/core/ngx_hash.c:713:1: Parameter `*key->data`
    711. 
    712. 
    713. ngx_int_t
         ^
    714. ngx_hash_add_key(ngx_hash_keys_arrays_t *ha, ngx_str_t *key, void *value,
    715.     ngx_uint_t flags)

src/core/ngx_hash.c:980:5: Array access: Offset added: [-4, +oo] (⇐ [0, 2] + [-4, +oo]) Size: [0, +oo] by call to `ngx_http_add_variable` 
    978.     }
    979. 
    980.     ngx_memcpy(name->data, key->data + skip, name->len);
             ^
    981. 
    982.     return NGX_OK;
