src/http/modules/ngx_http_proxy_module.c:848: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_proxy_module.c:844:9: Assignment
842. 
843.     if (r->valid_location) {
844.         p = ngx_copy(p, ctx->vars.uri.data, ctx->vars.uri.len);
             ^
845.     }
846. 

src/http/modules/ngx_http_proxy_module.c:848:9: Call
846. 
847.     if (escape) {
848.         ngx_escape_uri(p, r->uri.data + loc_len,
             ^
849.                        r->uri.len - loc_len, NGX_ESCAPE_URI);
850.         p += r->uri.len - loc_len + escape;

src/core/ngx_string.c:1336:1: <Length trace>
1334. 
1335. 
1336. uintptr_t
      ^
1337. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1338. {

src/core/ngx_string.c:1336:1: Parameter `*dst`
  1334. 
  1335. 
  1336. uintptr_t
        ^
  1337. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1338. {

src/core/ngx_string.c:1490:14: Assignment
  1488.     while (size) {
  1489.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1490.             *dst++ = '%';
                     ^
  1491.             *dst++ = hex[*src >> 4];
  1492.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1491:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1489.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1490.             *dst++ = '%';
  1491.             *dst++ = hex[*src >> 4];
                    ^
  1492.             *dst++ = hex[*src & 0xf];
  1493.             src++;
