src/http/modules/ngx_http_limit_req_module.c:198: error: Buffer Overrun L3
  Offset: [-10, +oo] Size: 2048 by call to `ngx_log_error_core`.

src/http/modules/ngx_http_limit_req_module.c:189:13: Call
187.         ctx = limit->shm_zone->data;
188. 
189.         if (ngx_http_complex_value(r, &ctx->key, &key) != NGX_OK) {
                 ^
190.             return NGX_HTTP_INTERNAL_SERVER_ERROR;
191.         }

src/http/ngx_http_script.c:57:1: Parameter `*val->lengths`
  55. 
  56. 
  57. ngx_int_t
      ^
  58. ngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val,
  59.     ngx_str_t *value)

src/http/modules/ngx_http_limit_req_module.c:189:13: Call
187.         ctx = limit->shm_zone->data;
188. 
189.         if (ngx_http_complex_value(r, &ctx->key, &key) != NGX_OK) {
                 ^
190.             return NGX_HTTP_INTERNAL_SERVER_ERROR;
191.         }

src/http/ngx_http_script.c:57:1: Parameter `*val->lengths`
  55. 
  56. 
  57. ngx_int_t
      ^
  58. ngx_http_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val,
  59.     ngx_str_t *value)

src/http/modules/ngx_http_limit_req_module.c:198:13: Call
196. 
197.         if (key.len > 65535) {
198.             ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
                 ^
199.                           "the value of the \"%V\" key "
200.                           "is more than 65535 bytes: \"%V\"",

src/core/ngx_log.c:78:1: Global `err_levels.len`
  76. #if (NGX_HAVE_VARIADIC_MACROS)
  77. 
  78. void
      ^
  79. ngx_log_error_core(ngx_uint_t level, ngx_log_t *log, ngx_err_t err,
  80.     const char *fmt, ...)

src/core/ngx_log.c:173:5: Assignment
  171.     }
  172. 
  173.     msg -= (7 + err_levels[level].len + 3);
           ^
  174. 
  175.     (void) ngx_sprintf(msg, "nginx: [%V] ", &err_levels[level]);

src/core/ngx_log.c:175:12: Call
  173.     msg -= (7 + err_levels[level].len + 3);
  174. 
  175.     (void) ngx_sprintf(msg, "nginx: [%V] ", &err_levels[level]);
                  ^
  176. 
  177.     (void) ngx_write_console(ngx_stderr, msg, p - msg);

src/core/ngx_string.c:104:1: Parameter `*buf`
    102. 
    103. 
    104. u_char * ngx_cdecl
         ^
    105. ngx_sprintf(u_char *buf, const char *fmt, ...)
    106. {

src/core/ngx_string.c:111:9: Call
    109. 
    110.     va_start(args, fmt);
    111.     p = ngx_vslprintf(buf, (void *) -1, fmt, args);
                 ^
    112.     va_end(args);
    113. 

src/core/ngx_string.c:146:1: <Length trace>
144. 
145. 
146. u_char *
     ^
147. ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
148. {

src/core/ngx_string.c:146:1: Parameter `*buf`
      144. 
      145. 
      146. u_char *
           ^
      147. ngx_vslprintf(u_char *buf, u_char *last, const char *fmt, va_list args)
      148. {

src/core/ngx_string.c:365:21: Array access: Offset: [-10, +oo] Size: 2048 by call to `ngx_log_error_core` 
      363. 
      364.                 if (f < 0) {
      365.                     *buf++ = '-';
                               ^
      366.                     f = -f;
      367.                 }
