src/http/ngx_http_core_module.c:5062: error: Buffer Overrun L3
  Offset: [5, +oo] (⇐ 5 + [0, +oo]) Size: [1, +oo] by call to `ngx_http_compile_complex_value`.

src/http/ngx_http_core_module.c:5062:17: Call
5060.             }
5061. 
5062.             if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                      ^
5063.                 return NGX_CONF_ERROR;
5064.             }

src/http/ngx_http_script.c:107:1: Parameter `ccv->value->len`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_core_module.c:5049:13: Assignment
5047. 
5048.         if (ngx_strncmp(value[i].data, "from=", 5) == 0) {
5049.             value[i].len -= 5;
                  ^
5050.             value[i].data += 5;
5051. 

src/http/ngx_http_core_module.c:5062:17: Call
5060.             }
5061. 
5062.             if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                      ^
5063.                 return NGX_CONF_ERROR;
5064.             }

src/http/ngx_http_script.c:107:1: <Offset trace>
105. 
106. 
107. ngx_int_t
     ^
108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
109. {

src/http/ngx_http_script.c:107:1: Parameter `ccv->value->len`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:107:1: <Length trace>
105. 
106. 
107. ngx_int_t
     ^
108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
109. {

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:121:13: Array access: Offset: [5, +oo] (⇐ 5 + [0, +oo]) Size: [1, +oo] by call to `ngx_http_compile_complex_value` 
  119. 
  120.     for (i = 0; i < v->len; i++) {
  121.         if (v->data[i] == '$') {
                   ^
  122.             if (v->data[i + 1] >= '1' && v->data[i + 1] <= '9') {
  123.                 nc++;
