src/http/ngx_http_script.c:920: error: Buffer Overrun L3
  Offset: [2, +oo] Size: [0, +oo].

src/http/ngx_http_script.c:919:14: <Offset trace>
917.         }
918. 
919.         for (n = 2; n < r->ncaptures; n += 2) {
                  ^
920.             e->buf.len += r->captures[n + 1] - r->captures[n];
921.         }

src/http/ngx_http_script.c:919:14: Assignment
917.         }
918. 
919.         for (n = 2; n < r->ncaptures; n += 2) {
                  ^
920.             e->buf.len += r->captures[n + 1] - r->captures[n];
921.         }

src/http/ngx_http_script.c:803:1: <Length trace>
801. #if (NGX_PCRE)
802. 
803. void
     ^
804. ngx_http_script_regex_start_code(ngx_http_script_engine_t *e)
805. {

src/http/ngx_http_script.c:803:1: Parameter `*e->request->captures`
801. #if (NGX_PCRE)
802. 
803. void
     ^
804. ngx_http_script_regex_start_code(ngx_http_script_engine_t *e)
805. {

src/http/ngx_http_script.c:829:10: Call
827.     }
828. 
829.     rc = ngx_http_regex_exec(r, code->regex, &e->line);
              ^
830. 
831.     if (rc == NGX_DECLINED) {

src/http/ngx_http_variables.c:1753:1: Parameter `*r->captures`
  1751. 
  1752. 
  1753. ngx_int_t
        ^
  1754. ngx_http_regex_exec(ngx_http_request_t *r, ngx_http_regex_t *re, ngx_str_t *s)
  1755. {

src/http/ngx_http_script.c:920:48: Array access: Offset: [2, +oo] Size: [0, +oo]
918. 
919.         for (n = 2; n < r->ncaptures; n += 2) {
920.             e->buf.len += r->captures[n + 1] - r->captures[n];
                                                    ^
921.         }
922. 
