reserve space for r->uri, the bug has been introduced in r2566

src/http/ngx_http_core_module.c

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 66698d5..66b3cee 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -1688,7 +1688,9 @@
         last = ngx_copy(path->data, clcf->root.data, clcf->root.len);
 
     } else {
-        if (ngx_http_script_run(r, path, clcf->root_lengths->elts, ++reserved,
+        reserved += alias ? 1 : r->uri.len + 1;
+
+        if (ngx_http_script_run(r, path, clcf->root_lengths->elts, reserved,
                                 clcf->root_values->elts)
             == NULL)
         {