src/http/ngx_http_core_module.c:5121: error: Buffer Overrun L3
  Offset: [5, +oo] Size: [1, +oo] by call to `ngx_http_compile_complex_value`.

src/http/ngx_http_core_module.c:5121:17: Call
5119.             }
5120. 
5121.             if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                      ^
5122.                 return NGX_CONF_ERROR;
5123.             }

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_core_module.c:5109:13: Assignment
5107.         if (ngx_strncmp(value[i].data, "from=", 5) == 0) {
5108.             value[i].len -= 5;
5109.             value[i].data += 5;
                  ^
5110. 
5111.             ngx_memzero(&ccv, sizeof(ngx_http_compile_complex_value_t));

src/http/ngx_http_core_module.c:5121:17: Call
5119.             }
5120. 
5121.             if (ngx_http_compile_complex_value(&ccv) != NGX_OK) {
                      ^
5122.                 return NGX_CONF_ERROR;
5123.             }

src/http/ngx_http_script.c:107:1: Parameter `*ccv->value->data`
  105. 
  106. 
  107. ngx_int_t
       ^
  108. ngx_http_compile_complex_value(ngx_http_compile_complex_value_t *ccv)
  109. {

src/http/ngx_http_script.c:134:13: Call
  132.         && (ccv->conf_prefix || ccv->root_prefix))
  133.     {
  134.         if (ngx_get_full_name(ccv->cf->pool,
                   ^
  135.                               ccv->conf_prefix ? &ccv->cf->cycle->conf_prefix:
  136.                                                  &ccv->cf->cycle->prefix,

src/core/ngx_file.c:20:1: Parameter `*name->data`
    18. 
    19. 
    20. ngx_int_t
        ^
    21. ngx_get_full_name(ngx_pool_t *pool, ngx_str_t *prefix, ngx_str_t *name)
    22. {

src/core/ngx_file.c:49:5: Call
    47. 
    48.     p = ngx_cpymem(n, prefix->data, len);
    49.     ngx_cpystrn(p, name->data, name->len + 1);
            ^
    50. 
    51.     name->len += len;

src/core/ngx_string.c:30:1: <Length trace>
28. 
29. 
30. u_char *
    ^
31. ngx_cpystrn(u_char *dst, u_char *src, size_t n)
32. {

src/core/ngx_string.c:30:1: Parameter `*src`
      28. 
      29. 
      30. u_char *
          ^
      31. ngx_cpystrn(u_char *dst, u_char *src, size_t n)
      32. {

src/core/ngx_string.c:38:16: Array access: Offset: [5, +oo] Size: [1, +oo] by call to `ngx_http_compile_complex_value` 
      36. 
      37.     while (--n) {
      38.         *dst = *src;
                         ^
      39. 
      40.         if (*dst == '\0') {
