reserve space for r->uri, the bug has been introduced in r2566
diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 66698d5..66b3cee 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -1688,7 +1688,9 @@
last = ngx_copy(path->data, clcf->root.data, clcf->root.len);
} else {
- if (ngx_http_script_run(r, path, clcf->root_lengths->elts, ++reserved,
+ reserved += alias ? 1 : r->uri.len + 1;
+
+ if (ngx_http_script_run(r, path, clcf->root_lengths->elts, reserved,
clcf->root_values->elts)
== NULL)
{
