src/http/modules/ngx_http_proxy_module.c:1003: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri`.

src/http/modules/ngx_http_proxy_module.c:999:13: Assignment
 997.     } else {
 998.         if (r->valid_location) {
 999.             b->last = ngx_copy(b->last, ctx->vars.uri.data, ctx->vars.uri.len);
                  ^
1000.         }
1001. 

src/http/modules/ngx_http_proxy_module.c:1003:13: Call
1001. 
1002.         if (escape) {
1003.             ngx_escape_uri(b->last, r->uri.data + loc_len,
                  ^
1004.                            r->uri.len - loc_len, NGX_ESCAPE_URI);
1005.             b->last += r->uri.len - loc_len + escape;

src/core/ngx_string.c:1213:1: <Length trace>
1211. 
1212. 
1213. uintptr_t
      ^
1214. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
1215. {

src/core/ngx_string.c:1213:1: Parameter `*dst`
  1211. 
  1212. 
  1213. uintptr_t
        ^
  1214. ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
  1215. {

src/core/ngx_string.c:1346:14: Assignment
  1344.     for (i = 0; i < size; i++) {
  1345.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1346.             *dst++ = '%';
                     ^
  1347.             *dst++ = hex[*src >> 4];
  1348.             *dst++ = hex[*src & 0xf];

src/core/ngx_string.c:1347:13: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_escape_uri` 
  1345.         if (escape[*src >> 5] & (1 << (*src & 0x1f))) {
  1346.             *dst++ = '%';
  1347.             *dst++ = hex[*src >> 4];
                    ^
  1348.             *dst++ = hex[*src & 0xf];
  1349.             src++;
