src/http/modules/ngx_http_proxy_module.c:1032: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_proxy_module.c:1028:13: Assignment
1026.     } else {
1027.         if (r->valid_location) {
1028.             b->last = ngx_copy(b->last, ctx->vars.uri.data, ctx->vars.uri.len);
                  ^
1029.         }
1030. 

src/http/modules/ngx_http_proxy_module.c:1032:13: Call
1030. 
1031.         if (escape) {
1032.             ngx_escape_uri(b->last, r->uri.data + loc_len,
                  ^
1033.                            r->uri.len - loc_len, NGX_ESCAPE_URI);
1034.             b->last += r->uri.len - loc_len + escape;

src/core/ngx_string.c:1256:1: <Length trace>
1254. 
1255. 
1256. uintptr_t
      ^
1257. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1258. {

src/core/ngx_string.c:1256:1: Parameter `*dst`
  1254. 
  1255. 
  1256. uintptr_t
        ^
  1257. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1258. {

src/core/ngx_string.c:1390:14: Assignment
  1388.     while (size) {
  1389.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1390.             *dst++ = '%';
                     ^
  1391.             *dst++ = hex[*src >> 4];
  1392.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1391:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1389.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1390.             *dst++ = '%';
  1391.             *dst++ = hex[*src >> 4];
                    ^
  1392.             *dst++ = hex[*src & 0xf];
  1393.             src++;
