src/http/ngx_http_variables.c:527: error: Buffer Overrun L3
  Offset: [-4, +oo] Size: 2048 by call to `ngx_log_error_core`.

src/http/ngx_http_variables.c:524:5: Assignment
522.     }
523. 
524.     vv->not_found = 1;
         ^
525. 
526.     if (nowarn == 0) {

src/http/ngx_http_variables.c:527:9: Call
525. 
526.     if (nowarn == 0) {
527.         ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
             ^
528.                       "unknown \"%V\" variable", name);
529.     }

src/core/ngx_log.c:75:1: Global `err_levels.len`
  73. #if (NGX_HAVE_VARIADIC_MACROS)
  74. 
  75. void
      ^
  76. ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
  77.     const char *fmt, ...)

src/core/ngx_log.c:151:5: Assignment
  149.     }
  150. 
  151.     msg -= (err_levels[level].len + 4);
           ^
  152. 
  153.     (void) ngx_sprintf(msg, "[%V]: ", &err_levels[level]);

src/core/ngx_log.c:153:12: Call
  151.     msg -= (err_levels[level].len + 4);
  152. 
  153.     (void) ngx_sprintf(msg, "[%V]: ", &err_levels[level]);
                  ^
  154. 
  155.     (void) ngx_write_console(ngx_stderr, msg, p - msg);

src/core/ngx_string.c:98:1: Parameter `*buf`
     96. 
     97. 
     98. u_char * ngx_cdecl
         ^
     99. ngx_sprintf(u_char *buf, const char *fmt, ...)
    100. {

src/core/ngx_string.c:105:9: Call
    103. 
    104.     va_start(args, fmt);
    105.     p = ngx_vslprintf(buf, (void *) -1, fmt, args);
                 ^
    106.     va_end(args);
    107. 

src/core/ngx_string.c:140:1: <Length trace>
138. 
139. 
140. u_char *
     ^
141. ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
142. {

src/core/ngx_string.c:140:1: Parameter `*buf`
      138. 
      139. 
      140. u_char *
           ^
      141. ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
      142. {

src/core/ngx_string.c:364:21: Array access: Offset: [-4, +oo] Size: 2048 by call to `ngx_log_error_core` 
      362. 
      363.                 if (f < 0) {
      364.                     *buf++ = '-';
                               ^
      365.                     f = -f;
      366.                 }
