src/http/ngx_http_upstream.c:3401: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ngx_ext_rename_file`.

src/http/ngx_http_upstream.c:3382:13: Call
3380.     if (u->conf->store_lengths == NULL) {
3381. 
3382.         if (ngx_http_map_uri_to_path(r, &path, &root, 0) == NULL) {
                  ^
3383.             return;
3384.         }

src/http/ngx_http_core_module.c:2012:1: Parameter `*path->data`
  2010. 
  2011. 
  2012. u_char *
        ^
  2013. ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path,
  2014.     size_t *root_length, size_t reserved)

src/http/ngx_http_upstream.c:3401:12: Call
3399.                    tf->file.name.data, path.data);
3400. 
3401.     (void) ngx_ext_rename_file(&tf->file.name, &path, &ext);
                 ^
3402. 
3403.     u->store = 0;

src/core/ngx_file.c:627:1: Parameter `*to->data`
  625. 
  626. 
  627. ngx_int_t
       ^
  628. ngx_ext_rename_file(ngx_str_t *src, ngx_str_t *to, ngx_ext_rename_file_t *ext)
  629. {

src/core/ngx_file.c:668:15: Call
  666.         }
  667. 
  668.         err = ngx_create_full_path(to->data, ngx_dir_access(ext->path_access));
                     ^
  669. 
  670.         if (err) {

src/core/ngx_file.c:272:1: <Length trace>
270. 
271. 
272. ngx_err_t
     ^
273. ngx_create_full_path(u_char *dir, ngx_uint_t access)
274. {

src/core/ngx_file.c:272:1: Parameter `*dir`
    270. 
    271. 
    272. ngx_err_t
         ^
    273. ngx_create_full_path(u_char *dir, ngx_uint_t access)
    274. {

src/core/ngx_file.c:283:5: Assignment
    281.     p = dir + 3;
    282. #else
    283.     p = dir + 1;
             ^
    284. #endif
    285. 

src/core/ngx_file.c:286:24: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ngx_ext_rename_file` 
    284. #endif
    285. 
    286.     for ( /* void */ ; *p; p++) {
                                ^
    287.         ch = *p;
    288. 
