libavcodec/cook.c:989: error: Buffer Overrun L1
  Offset: [-oo, -1] Size: 256 by call to `decode_subpacket`.

libavcodec/cook.c:960:5: Assignment
958.     int i, out_size;
959.     int offset = 0;
960.     int chidx = 0;
         ^
961. 
962.     if (buf_size < avctx->block_align)

libavcodec/cook.c:987:9: Assignment
985.     for(i=0;i<q->num_subpackets;i++){
986.         q->subpacket[i].bits_per_subpacket = (q->subpacket[i].size*8)>>q->subpacket[i].bits_per_subpdiv;
987.         q->subpacket[i].ch_idx = chidx;
             ^
988.         av_log(avctx,AV_LOG_DEBUG,"subpacket[%i] size %i js %i %i block_align %i\n",i,q->subpacket[i].size,q->subpacket[i].joint_stereo,offset,avctx->block_align);
989.         decode_subpacket(q, &q->subpacket[i], buf + offset, data);

libavcodec/cook.c:989:9: Call
987.         q->subpacket[i].ch_idx = chidx;
988.         av_log(avctx,AV_LOG_DEBUG,"subpacket[%i] size %i js %i %i block_align %i\n",i,q->subpacket[i].size,q->subpacket[i].joint_stereo,offset,avctx->block_align);
989.         decode_subpacket(q, &q->subpacket[i], buf + offset, data);
             ^
990.         offset += q->subpacket[i].size;
991.         chidx += q->subpacket[i].num_channels;

libavcodec/cook.c:907:1: Parameter `p->numvector_size`
  905.  * @param outbuffer         pointer to the outbuffer
  906.  */
  907. static void decode_subpacket(COOKContext *q, COOKSubpacket *p,
       ^
  908.                              const uint8_t *inbuffer, float *outbuffer)
  909. {

libavcodec/cook.c:922:9: Call
  920.         joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2);
  921.     } else {
  922.         mono_decode(q, p, q->decode_buffer_1);
               ^
  923. 
  924.         if (p->num_channels == 2) {

libavcodec/cook.c:625:1: Parameter `p->numvector_size`
    623.  */
    624. 
    625. static void mono_decode(COOKContext *q, COOKSubpacket *p, float* mlt_buffer) {
         ^
    626. 
    627.     int category_index[128];

libavcodec/cook.c:636:5: Call
    634.     decode_envelope(q, p, quant_index_table);
    635.     q->num_vectors = get_bits(&q->gb,p->log2_numvector_size);
    636.     categorize(q, p, quant_index_table, category, category_index);
             ^
    637.     expand_category(q, category, category_index);
    638.     decode_vectors(q, p, category, quant_index_table, mlt_buffer);

libavcodec/cook.c:390:1: <Offset trace>
388.  */
389. 
390. static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
     ^
391.                        int* category, int* category_index){
392.     int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;

libavcodec/cook.c:390:1: Parameter `p->numvector_size`
      388.  */
      389. 
      390. static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
           ^
      391.                        int* category, int* category_index){
      392.     int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;

libavcodec/cook.c:398:5: Assignment
      396.     int tmp_categorize_array[128*2];
      397.     int tmp_categorize_array1_idx=p->numvector_size;
      398.     int tmp_categorize_array2_idx=p->numvector_size;
               ^
      399. 
      400.     bits_left =  p->bits_per_subpacket - get_bits_count(&q->gb);

libavcodec/cook.c:390:1: <Length trace>
388.  */
389. 
390. static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
     ^
391.                        int* category, int* category_index){
392.     int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;

libavcodec/cook.c:390:1: Array declaration
      388.  */
      389. 
      390. static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
           ^
      391.                        int* category, int* category_index){
      392.     int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;

libavcodec/cook.c:469:13: Array access: Offset: [-oo, -1] Size: 256 by call to `decode_subpacket` 
      467.             }
      468.             if(index == -1)break;
      469.             tmp_categorize_array[--tmp_categorize_array2_idx] = index;
                       ^
      470.             tmpbias2 -= expbits_tab[exp_index2[index]] -
      471.                         expbits_tab[exp_index2[index]-1];

static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
                       int* category, int* category_index){
    int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;
    int exp_index2[102];
    int exp_index1[102];
    int tmp_categorize_array[128*2];
    int tmp_categorize_array1_idx=p->numvector_size;
    int tmp_categorize_array2_idx=p->numvector_size;
    bits_left =  p->bits_per_subpacket - get_bits_count(&q->gb);
    if(bits_left > q->samples_per_channel) {
        bits_left = q->samples_per_channel +
                    ((bits_left - q->samples_per_channel)*5)/8;
    }
    memset(&exp_index1,           0, sizeof(exp_index1));
    memset(&exp_index2,           0, sizeof(exp_index2));
    memset(&tmp_categorize_array, 0, sizeof(tmp_categorize_array));
    bias=-32;
    for (i=32 ; i>0 ; i=i/2){
        num_bits = 0;
        index = 0;
        for (j=p->total_subbands ; j>0 ; j--){
            exp_idx = av_clip((i - quant_index_table[index] + bias) / 2, 0, 7);
            index++;
            num_bits+=expbits_tab[exp_idx];
        }
        if(num_bits >= bits_left - 32){
            bias+=i;
        }
    }
    num_bits=0;
    for (i=0 ; i<p->total_subbands ; i++) {
        exp_idx = av_clip((bias - quant_index_table[i]) / 2, 0, 7);
        num_bits += expbits_tab[exp_idx];
        exp_index1[i] = exp_idx;
        exp_index2[i] = exp_idx;
    }
    tmpbias1 = tmpbias2 = num_bits;
    for (j = 1 ; j < p->numvector_size ; j++) {
        if (tmpbias1 + tmpbias2 > 2*bits_left) {
            int max = -999999;
            index=-1;
            for (i=0 ; i<p->total_subbands ; i++){
                if (exp_index1[i] < 7) {
                    v = (-2*exp_index1[i]) - quant_index_table[i] + bias;
                    if ( v >= max) {
                        max = v;
                        index = i;
                    }
                }
            }
            if(index==-1)break;
            tmp_categorize_array[tmp_categorize_array1_idx++] = index;
            tmpbias1 -= expbits_tab[exp_index1[index]] -
                        expbits_tab[exp_index1[index]+1];
            ++exp_index1[index];
        } else {
            int min = 999999;
            index=-1;
            for (i=0 ; i<p->total_subbands ; i++){
                if(exp_index2[i] > 0){
                    v = (-2*exp_index2[i])-quant_index_table[i]+bias;
                    if ( v < min) {
                        min = v;
                        index = i;
                    }
                }
            }
            if(index == -1)break;
            tmp_categorize_array[--tmp_categorize_array2_idx] = index;
            tmpbias2 -= expbits_tab[exp_index2[index]] -
                        expbits_tab[exp_index2[index]-1];
            --exp_index2[index];
        }
    }
    for(i=0 ; i<p->total_subbands ; i++)
        category[i] = exp_index2[i];
    for(i=0 ; i<p->numvector_size-1 ; i++)
        category_index[i] = tmp_categorize_array[tmp_categorize_array2_idx++];
}
['static int cook_decode_frame(AVCodecContext *avctx,\n            void *data, int *data_size,\n            AVPacket *avpkt) {\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    COOKContext *q = avctx->priv_data;\n    int i, out_size;\n    int offset = 0;\n    int chidx = 0;\n    if (buf_size < avctx->block_align)\n        return buf_size;\n    out_size = q->nb_channels * q->samples_per_channel *\n               av_get_bytes_per_sample(avctx->sample_fmt);\n    if (*data_size < out_size) {\n        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\\n");\n        return AVERROR(EINVAL);\n    }\n    q->subpacket[0].size = avctx->block_align;\n    for(i=1;i<q->num_subpackets;i++){\n        q->subpacket[i].size = 2 * buf[avctx->block_align - q->num_subpackets + i];\n        q->subpacket[0].size -= q->subpacket[i].size + 1;\n        if (q->subpacket[0].size < 0) {\n            av_log(avctx,AV_LOG_DEBUG,"frame subpacket size total > avctx->block_align!\\n");\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    for(i=0;i<q->num_subpackets;i++){\n        q->subpacket[i].bits_per_subpacket = (q->subpacket[i].size*8)>>q->subpacket[i].bits_per_subpdiv;\n        q->subpacket[i].ch_idx = chidx;\n        av_log(avctx,AV_LOG_DEBUG,"subpacket[%i] size %i js %i %i block_align %i\\n",i,q->subpacket[i].size,q->subpacket[i].joint_stereo,offset,avctx->block_align);\n        decode_subpacket(q, &q->subpacket[i], buf + offset, data);\n        offset += q->subpacket[i].size;\n        chidx += q->subpacket[i].num_channels;\n        av_log(avctx,AV_LOG_DEBUG,"subpacket[%i] %i %i\\n",i,q->subpacket[i].size * 8,get_bits_count(&q->gb));\n    }\n    *data_size = out_size;\n    if (avctx->frame_number < 2) *data_size = 0;\n    return avctx->block_align;\n}', 'static void decode_subpacket(COOKContext *q, COOKSubpacket *p,\n                             const uint8_t *inbuffer, float *outbuffer)\n{\n    int sub_packet_size = p->size;\n    memset(q->decode_buffer_1,0,sizeof(q->decode_buffer_1));\n    decode_bytes_and_gain(q, p, inbuffer, &p->gains1);\n    if (p->joint_stereo) {\n        joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2);\n    } else {\n        mono_decode(q, p, q->decode_buffer_1);\n        if (p->num_channels == 2) {\n            decode_bytes_and_gain(q, p, inbuffer + sub_packet_size/2, &p->gains2);\n            mono_decode(q, p, q->decode_buffer_2);\n        }\n    }\n    mlt_compensate_output(q, q->decode_buffer_1, &p->gains1,\n                          p->mono_previous_buffer1, outbuffer, p->ch_idx);\n    if (p->num_channels == 2) {\n        if (p->joint_stereo) {\n            mlt_compensate_output(q, q->decode_buffer_2, &p->gains1,\n                                  p->mono_previous_buffer2, outbuffer, p->ch_idx + 1);\n         } else {\n            mlt_compensate_output(q, q->decode_buffer_2, &p->gains2,\n                                  p->mono_previous_buffer2, outbuffer, p->ch_idx + 1);\n         }\n     }\n}', 'static void mono_decode(COOKContext *q, COOKSubpacket *p, float* mlt_buffer) {\n    int category_index[128];\n    int quant_index_table[102];\n    int category[128];\n    memset(&category,       0, sizeof(category));\n    memset(&category_index, 0, sizeof(category_index));\n    decode_envelope(q, p, quant_index_table);\n    q->num_vectors = get_bits(&q->gb,p->log2_numvector_size);\n    categorize(q, p, quant_index_table, category, category_index);\n    expand_category(q, category, category_index);\n    decode_vectors(q, p, category, quant_index_table, mlt_buffer);\n}', 'static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,\n                       int* category, int* category_index){\n    int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;\n    int exp_index2[102];\n    int exp_index1[102];\n    int tmp_categorize_array[128*2];\n    int tmp_categorize_array1_idx=p->numvector_size;\n    int tmp_categorize_array2_idx=p->numvector_size;\n    bits_left =  p->bits_per_subpacket - get_bits_count(&q->gb);\n    if(bits_left > q->samples_per_channel) {\n        bits_left = q->samples_per_channel +\n                    ((bits_left - q->samples_per_channel)*5)/8;\n    }\n    memset(&exp_index1,           0, sizeof(exp_index1));\n    memset(&exp_index2,           0, sizeof(exp_index2));\n    memset(&tmp_categorize_array, 0, sizeof(tmp_categorize_array));\n    bias=-32;\n    for (i=32 ; i>0 ; i=i/2){\n        num_bits = 0;\n        index = 0;\n        for (j=p->total_subbands ; j>0 ; j--){\n            exp_idx = av_clip((i - quant_index_table[index] + bias) / 2, 0, 7);\n            index++;\n            num_bits+=expbits_tab[exp_idx];\n        }\n        if(num_bits >= bits_left - 32){\n            bias+=i;\n        }\n    }\n    num_bits=0;\n    for (i=0 ; i<p->total_subbands ; i++) {\n        exp_idx = av_clip((bias - quant_index_table[i]) / 2, 0, 7);\n        num_bits += expbits_tab[exp_idx];\n        exp_index1[i] = exp_idx;\n        exp_index2[i] = exp_idx;\n    }\n    tmpbias1 = tmpbias2 = num_bits;\n    for (j = 1 ; j < p->numvector_size ; j++) {\n        if (tmpbias1 + tmpbias2 > 2*bits_left) {\n            int max = -999999;\n            index=-1;\n            for (i=0 ; i<p->total_subbands ; i++){\n                if (exp_index1[i] < 7) {\n                    v = (-2*exp_index1[i]) - quant_index_table[i] + bias;\n                    if ( v >= max) {\n                        max = v;\n                        index = i;\n                    }\n                }\n            }\n            if(index==-1)break;\n            tmp_categorize_array[tmp_categorize_array1_idx++] = index;\n            tmpbias1 -= expbits_tab[exp_index1[index]] -\n                        expbits_tab[exp_index1[index]+1];\n            ++exp_index1[index];\n        } else {\n            int min = 999999;\n            index=-1;\n            for (i=0 ; i<p->total_subbands ; i++){\n                if(exp_index2[i] > 0){\n                    v = (-2*exp_index2[i])-quant_index_table[i]+bias;\n                    if ( v < min) {\n                        min = v;\n                        index = i;\n                    }\n                }\n            }\n            if(index == -1)break;\n            tmp_categorize_array[--tmp_categorize_array2_idx] = index;\n            tmpbias2 -= expbits_tab[exp_index2[index]] -\n                        expbits_tab[exp_index2[index]-1];\n            --exp_index2[index];\n        }\n    }\n    for(i=0 ; i<p->total_subbands ; i++)\n        category[i] = exp_index2[i];\n    for(i=0 ; i<p->numvector_size-1 ; i++)\n        category_index[i] = tmp_categorize_array[tmp_categorize_array2_idx++];\n}']