libavcodec/dcadec.c:1908: error: Buffer Overrun L2
  Offset: [0, 6] Size: 6.

libavcodec/dcadec.c:1870:32: <Offset trace>
1868.             return AVERROR_INVALIDDATA;
1869. 
1870.         if (s->prim_channels + !!s->lfe > 2 &&
                                     ^
1871.             avctx->request_channel_layout == AV_CH_LAYOUT_STEREO) {
1872.             channels = 2;

libavcodec/dcadec.c:1870:32: Assignment
1868.             return AVERROR_INVALIDDATA;
1869. 
1870.         if (s->prim_channels + !!s->lfe > 2 &&
                                     ^
1871.             avctx->request_channel_layout == AV_CH_LAYOUT_STEREO) {
1872.             channels = 2;

libavcodec/dcadata.h:7554:1: <Length trace>
7552. };
7553. 
7554. static const float dca_default_coeffs[10][6][2] = {
      ^
7555.     { { 0.707107, 0.707107 }, { 0.000000, 0.000000 },                                                                                                 }, // A [LFE]
7556.     { { 1.000000, 0.000000 }, { 0.000000, 1.000000 }, { 0.000000, 0.000000 },                                                                         }, // A + B (dual mono) [LFE]

libavcodec/dcadata.h:7554:1: Array declaration
7552. };
7553. 
7554. static const float dca_default_coeffs[10][6][2] = {
      ^
7555.     { { 0.707107, 0.707107 }, { 0.000000, 0.000000 },                                                                                                 }, // A [LFE]
7556.     { { 1.000000, 0.000000 }, { 0.000000, 1.000000 }, { 0.000000, 0.000000 },                                                                         }, // A + B (dual mono) [LFE]

libavcodec/dcadec.c:1908:45: Array access: Offset: [0, 6] Size: 6
1906.                 }
1907.                 for (i = 0; i < s->prim_channels + !!s->lfe; i++) {
1908.                     s->downmix_coef[i][0] = dca_default_coeffs[am][i][0];
                                                  ^
1909.                     s->downmix_coef[i][1] = dca_default_coeffs[am][i][1];
1910.                 }

static int dca_decode_frame(AVCodecContext *avctx, void *data,
                            int *got_frame_ptr, AVPacket *avpkt)
{
    AVFrame *frame     = data;
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    int lfe_samples;
    int num_core_channels = 0;
    int i, ret;
    float  **samples_flt;
    DCAContext *s = avctx->priv_data;
    int channels, full_channels;
    int core_ss_end;
    s->xch_present = 0;
    s->dca_buffer_size = ff_dca_convert_bitstream(buf, buf_size, s->dca_buffer,
                                                  DCA_MAX_FRAME_SIZE + DCA_MAX_EXSS_HEADER_SIZE);
    if (s->dca_buffer_size == AVERROR_INVALIDDATA) {
        av_log(avctx, AV_LOG_ERROR, "Not a valid DCA frame\n");
        return AVERROR_INVALIDDATA;
    }
    init_get_bits(&s->gb, s->dca_buffer, s->dca_buffer_size * 8);
    if ((ret = dca_parse_frame_header(s)) < 0) {
        return ret;
    }
    avctx->sample_rate = s->sample_rate;
    avctx->bit_rate    = s->bit_rate;
    s->profile = FF_PROFILE_DTS;
    for (i = 0; i < (s->sample_blocks / 8); i++) {
        if ((ret = dca_decode_block(s, 0, i))) {
            av_log(avctx, AV_LOG_ERROR, "error decoding block\n");
            return ret;
        }
    }
    num_core_channels = s->prim_channels;
    if (s->ext_coding)
        s->core_ext_mask = dca_ext_audio_descr_mask[s->ext_descr];
    else
        s->core_ext_mask = 0;
    core_ss_end = FFMIN(s->frame_size, s->dca_buffer_size) * 8;
    if (s->core_ext_mask < 0 || s->core_ext_mask & DCA_EXT_XCH) {
        s->core_ext_mask = FFMAX(s->core_ext_mask, 0);
        skip_bits_long(&s->gb, (-get_bits_count(&s->gb)) & 31);
        while (core_ss_end - get_bits_count(&s->gb) >= 32) {
            uint32_t bits = get_bits_long(&s->gb, 32);
            switch (bits) {
            case 0x5a5a5a5a: {
                int ext_amode, xch_fsize;
                s->xch_base_channel = s->prim_channels;
                xch_fsize = show_bits(&s->gb, 10);
                if ((s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + xch_fsize) &&
                    (s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + xch_fsize + 1))
                    continue;
                skip_bits(&s->gb, 10);
                s->core_ext_mask |= DCA_EXT_XCH;
                if ((ext_amode = get_bits(&s->gb, 4)) != 1) {
                    av_log(avctx, AV_LOG_ERROR, "XCh extension amode %d not"
                           " supported!\n", ext_amode);
                    continue;
                }
                dca_parse_audio_coding_header(s, s->xch_base_channel);
                for (i = 0; i < (s->sample_blocks / 8); i++)
                    if ((ret = dca_decode_block(s, s->xch_base_channel, i))) {
                        av_log(avctx, AV_LOG_ERROR, "error decoding XCh extension\n");
                        continue;
                    }
                s->xch_present = 1;
                break;
            }
            case 0x47004a03:
                s->core_ext_mask |= DCA_EXT_XXCH;
                break;
            case 0x1d95f262: {
                int fsize96 = show_bits(&s->gb, 12) + 1;
                if (s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + fsize96)
                    continue;
                av_log(avctx, AV_LOG_DEBUG, "X96 extension found at %d bits\n",
                       get_bits_count(&s->gb));
                skip_bits(&s->gb, 12);
                av_log(avctx, AV_LOG_DEBUG, "FSIZE96 = %d bytes\n", fsize96);
                av_log(avctx, AV_LOG_DEBUG, "REVNO = %d\n", get_bits(&s->gb, 4));
                s->core_ext_mask |= DCA_EXT_X96;
                break;
            }
            }
            skip_bits_long(&s->gb, (-get_bits_count(&s->gb)) & 31);
        }
    } else {
        skip_bits_long(&s->gb, core_ss_end - get_bits_count(&s->gb));
    }
    if (s->core_ext_mask & DCA_EXT_X96)
        s->profile = FF_PROFILE_DTS_96_24;
    else if (s->core_ext_mask & (DCA_EXT_XCH | DCA_EXT_XXCH))
        s->profile = FF_PROFILE_DTS_ES;
    if (s->dca_buffer_size - s->frame_size > 32 &&
        get_bits_long(&s->gb, 32) == DCA_HD_MARKER)
        dca_exss_parse_header(s);
    avctx->profile = s->profile;
    full_channels = channels = s->prim_channels + !!s->lfe;
    if (s->amode < 16) {
        avctx->channel_layout = dca_core_channel_layout[s->amode];
#if FF_API_REQUEST_CHANNELS
FF_DISABLE_DEPRECATION_WARNINGS
        if (s->xch_present && (!avctx->request_channels ||
                               avctx->request_channels > num_core_channels + !!s->lfe)) {
FF_ENABLE_DEPRECATION_WARNINGS
#else
        if (s->xch_present) {
#endif
            avctx->channel_layout |= AV_CH_BACK_CENTER;
            if (s->lfe) {
                avctx->channel_layout |= AV_CH_LOW_FREQUENCY;
                s->channel_order_tab = dca_channel_reorder_lfe_xch[s->amode];
            } else {
                s->channel_order_tab = dca_channel_reorder_nolfe_xch[s->amode];
            }
        } else {
            channels = num_core_channels + !!s->lfe;
            s->xch_present = 0;
            if (s->lfe) {
                avctx->channel_layout |= AV_CH_LOW_FREQUENCY;
                s->channel_order_tab = dca_channel_reorder_lfe[s->amode];
            } else
                s->channel_order_tab = dca_channel_reorder_nolfe[s->amode];
        }
        if (channels > !!s->lfe &&
            s->channel_order_tab[channels - 1 - !!s->lfe] < 0)
            return AVERROR_INVALIDDATA;
        if (s->prim_channels + !!s->lfe > 2 &&
            avctx->request_channel_layout == AV_CH_LAYOUT_STEREO) {
            channels = 2;
            s->output = DCA_STEREO;
            avctx->channel_layout = AV_CH_LAYOUT_STEREO;
            if (s->core_downmix && (s->core_downmix_amode == DCA_STEREO ||
                                    s->core_downmix_amode == DCA_STEREO_TOTAL)) {
                int sign, code;
                for (i = 0; i < s->prim_channels + !!s->lfe; i++) {
                    sign = s->core_downmix_codes[i][0] & 0x100 ? 1 : -1;
                    code = s->core_downmix_codes[i][0] & 0x0FF;
                    s->downmix_coef[i][0] = (!code ? 0.0f :
                                             sign * dca_dmixtable[code - 1]);
                    sign = s->core_downmix_codes[i][1] & 0x100 ? 1 : -1;
                    code = s->core_downmix_codes[i][1] & 0x0FF;
                    s->downmix_coef[i][1] = (!code ? 0.0f :
                                             sign * dca_dmixtable[code - 1]);
                }
            } else {
                int am = s->amode & DCA_CHANNEL_MASK;
                if (am >= FF_ARRAY_ELEMS(dca_default_coeffs)) {
                    av_log(s->avctx, AV_LOG_ERROR,
                           "Invalid channel mode %d\n", am);
                    return AVERROR_INVALIDDATA;
                }
                if (s->prim_channels + !!s->lfe >
                    FF_ARRAY_ELEMS(dca_default_coeffs[0])) {
                    avpriv_request_sample(s->avctx, "Downmixing %d channels",
                                          s->prim_channels + !!s->lfe);
                    return AVERROR_PATCHWELCOME;
                }
                for (i = 0; i < s->prim_channels + !!s->lfe; i++) {
                    s->downmix_coef[i][0] = dca_default_coeffs[am][i][0];
                    s->downmix_coef[i][1] = dca_default_coeffs[am][i][1];
                }
            }
            av_dlog(s->avctx, "Stereo downmix coeffs:\n");
            for (i = 0; i < s->prim_channels + !!s->lfe; i++) {
                av_dlog(s->avctx, "L, input channel %d = %f\n", i,
                        s->downmix_coef[i][0]);
                av_dlog(s->avctx, "R, input channel %d = %f\n", i,
                        s->downmix_coef[i][1]);
            }
            av_dlog(s->avctx, "\n");
        }
    } else {
        av_log(avctx, AV_LOG_ERROR, "Non standard configuration %d !\n", s->amode);
        return AVERROR_INVALIDDATA;
    }
    avctx->channels = channels;
    frame->nb_samples = 256 * (s->sample_blocks / 8);
    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        return ret;
    }
    samples_flt = (float **)frame->extended_data;
    if (avctx->channels < full_channels) {
        ret = av_samples_get_buffer_size(NULL, full_channels - channels,
                                         frame->nb_samples,
                                         avctx->sample_fmt, 0);
        if (ret < 0)
            return ret;
        av_fast_malloc(&s->extra_channels_buffer,
                       &s->extra_channels_buffer_size, ret);
        if (!s->extra_channels_buffer)
            return AVERROR(ENOMEM);
        ret = av_samples_fill_arrays((uint8_t **)s->extra_channels, NULL,
                                     s->extra_channels_buffer,
                                     full_channels - channels,
                                     frame->nb_samples, avctx->sample_fmt, 0);
        if (ret < 0)
            return ret;
    }
    for (i = 0; i < (s->sample_blocks / 8); i++) {
        int ch;
        for (ch = 0; ch < channels; ch++)
            s->samples_chanptr[ch] = samples_flt[ch] + i * 256;
        for (; ch < full_channels; ch++)
            s->samples_chanptr[ch] = s->extra_channels[ch - channels] + i * 256;
        dca_filter_channels(s, i);
        if ((s->source_pcm_res & 1) && s->xch_present) {
            float *back_chan = s->samples_chanptr[s->channel_order_tab[s->xch_base_channel]];
            float *lt_chan   = s->samples_chanptr[s->channel_order_tab[s->xch_base_channel - 2]];
            float *rt_chan   = s->samples_chanptr[s->channel_order_tab[s->xch_base_channel - 1]];
            s->fdsp.vector_fmac_scalar(lt_chan, back_chan, -M_SQRT1_2, 256);
            s->fdsp.vector_fmac_scalar(rt_chan, back_chan, -M_SQRT1_2, 256);
        }
    }
    lfe_samples = 2 * s->lfe * (s->sample_blocks / 8);
    for (i = 0; i < 2 * s->lfe * 4; i++)
        s->lfe_data[i] = s->lfe_data[i + lfe_samples];
    *got_frame_ptr = 1;
    return buf_size;
}
['static int dca_decode_frame(AVCodecContext *avctx, void *data,\n                            int *got_frame_ptr, AVPacket *avpkt)\n{\n    AVFrame *frame     = data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    int lfe_samples;\n    int num_core_channels = 0;\n    int i, ret;\n    float  **samples_flt;\n    DCAContext *s = avctx->priv_data;\n    int channels, full_channels;\n    int core_ss_end;\n    s->xch_present = 0;\n    s->dca_buffer_size = ff_dca_convert_bitstream(buf, buf_size, s->dca_buffer,\n                                                  DCA_MAX_FRAME_SIZE + DCA_MAX_EXSS_HEADER_SIZE);\n    if (s->dca_buffer_size == AVERROR_INVALIDDATA) {\n        av_log(avctx, AV_LOG_ERROR, "Not a valid DCA frame\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    init_get_bits(&s->gb, s->dca_buffer, s->dca_buffer_size * 8);\n    if ((ret = dca_parse_frame_header(s)) < 0) {\n        return ret;\n    }\n    avctx->sample_rate = s->sample_rate;\n    avctx->bit_rate    = s->bit_rate;\n    s->profile = FF_PROFILE_DTS;\n    for (i = 0; i < (s->sample_blocks / 8); i++) {\n        if ((ret = dca_decode_block(s, 0, i))) {\n            av_log(avctx, AV_LOG_ERROR, "error decoding block\\n");\n            return ret;\n        }\n    }\n    num_core_channels = s->prim_channels;\n    if (s->ext_coding)\n        s->core_ext_mask = dca_ext_audio_descr_mask[s->ext_descr];\n    else\n        s->core_ext_mask = 0;\n    core_ss_end = FFMIN(s->frame_size, s->dca_buffer_size) * 8;\n    if (s->core_ext_mask < 0 || s->core_ext_mask & DCA_EXT_XCH) {\n        s->core_ext_mask = FFMAX(s->core_ext_mask, 0);\n        skip_bits_long(&s->gb, (-get_bits_count(&s->gb)) & 31);\n        while (core_ss_end - get_bits_count(&s->gb) >= 32) {\n            uint32_t bits = get_bits_long(&s->gb, 32);\n            switch (bits) {\n            case 0x5a5a5a5a: {\n                int ext_amode, xch_fsize;\n                s->xch_base_channel = s->prim_channels;\n                xch_fsize = show_bits(&s->gb, 10);\n                if ((s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + xch_fsize) &&\n                    (s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + xch_fsize + 1))\n                    continue;\n                skip_bits(&s->gb, 10);\n                s->core_ext_mask |= DCA_EXT_XCH;\n                if ((ext_amode = get_bits(&s->gb, 4)) != 1) {\n                    av_log(avctx, AV_LOG_ERROR, "XCh extension amode %d not"\n                           " supported!\\n", ext_amode);\n                    continue;\n                }\n                dca_parse_audio_coding_header(s, s->xch_base_channel);\n                for (i = 0; i < (s->sample_blocks / 8); i++)\n                    if ((ret = dca_decode_block(s, s->xch_base_channel, i))) {\n                        av_log(avctx, AV_LOG_ERROR, "error decoding XCh extension\\n");\n                        continue;\n                    }\n                s->xch_present = 1;\n                break;\n            }\n            case 0x47004a03:\n                s->core_ext_mask |= DCA_EXT_XXCH;\n                break;\n            case 0x1d95f262: {\n                int fsize96 = show_bits(&s->gb, 12) + 1;\n                if (s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + fsize96)\n                    continue;\n                av_log(avctx, AV_LOG_DEBUG, "X96 extension found at %d bits\\n",\n                       get_bits_count(&s->gb));\n                skip_bits(&s->gb, 12);\n                av_log(avctx, AV_LOG_DEBUG, "FSIZE96 = %d bytes\\n", fsize96);\n                av_log(avctx, AV_LOG_DEBUG, "REVNO = %d\\n", get_bits(&s->gb, 4));\n                s->core_ext_mask |= DCA_EXT_X96;\n                break;\n            }\n            }\n            skip_bits_long(&s->gb, (-get_bits_count(&s->gb)) & 31);\n        }\n    } else {\n        skip_bits_long(&s->gb, core_ss_end - get_bits_count(&s->gb));\n    }\n    if (s->core_ext_mask & DCA_EXT_X96)\n        s->profile = FF_PROFILE_DTS_96_24;\n    else if (s->core_ext_mask & (DCA_EXT_XCH | DCA_EXT_XXCH))\n        s->profile = FF_PROFILE_DTS_ES;\n    if (s->dca_buffer_size - s->frame_size > 32 &&\n        get_bits_long(&s->gb, 32) == DCA_HD_MARKER)\n        dca_exss_parse_header(s);\n    avctx->profile = s->profile;\n    full_channels = channels = s->prim_channels + !!s->lfe;\n    if (s->amode < 16) {\n        avctx->channel_layout = dca_core_channel_layout[s->amode];\n#if FF_API_REQUEST_CHANNELS\nFF_DISABLE_DEPRECATION_WARNINGS\n        if (s->xch_present && (!avctx->request_channels ||\n                               avctx->request_channels > num_core_channels + !!s->lfe)) {\nFF_ENABLE_DEPRECATION_WARNINGS\n#else\n        if (s->xch_present) {\n#endif\n            avctx->channel_layout |= AV_CH_BACK_CENTER;\n            if (s->lfe) {\n                avctx->channel_layout |= AV_CH_LOW_FREQUENCY;\n                s->channel_order_tab = dca_channel_reorder_lfe_xch[s->amode];\n            } else {\n                s->channel_order_tab = dca_channel_reorder_nolfe_xch[s->amode];\n            }\n        } else {\n            channels = num_core_channels + !!s->lfe;\n            s->xch_present = 0;\n            if (s->lfe) {\n                avctx->channel_layout |= AV_CH_LOW_FREQUENCY;\n                s->channel_order_tab = dca_channel_reorder_lfe[s->amode];\n            } else\n                s->channel_order_tab = dca_channel_reorder_nolfe[s->amode];\n        }\n        if (channels > !!s->lfe &&\n            s->channel_order_tab[channels - 1 - !!s->lfe] < 0)\n            return AVERROR_INVALIDDATA;\n        if (s->prim_channels + !!s->lfe > 2 &&\n            avctx->request_channel_layout == AV_CH_LAYOUT_STEREO) {\n            channels = 2;\n            s->output = DCA_STEREO;\n            avctx->channel_layout = AV_CH_LAYOUT_STEREO;\n            if (s->core_downmix && (s->core_downmix_amode == DCA_STEREO ||\n                                    s->core_downmix_amode == DCA_STEREO_TOTAL)) {\n                int sign, code;\n                for (i = 0; i < s->prim_channels + !!s->lfe; i++) {\n                    sign = s->core_downmix_codes[i][0] & 0x100 ? 1 : -1;\n                    code = s->core_downmix_codes[i][0] & 0x0FF;\n                    s->downmix_coef[i][0] = (!code ? 0.0f :\n                                             sign * dca_dmixtable[code - 1]);\n                    sign = s->core_downmix_codes[i][1] & 0x100 ? 1 : -1;\n                    code = s->core_downmix_codes[i][1] & 0x0FF;\n                    s->downmix_coef[i][1] = (!code ? 0.0f :\n                                             sign * dca_dmixtable[code - 1]);\n                }\n            } else {\n                int am = s->amode & DCA_CHANNEL_MASK;\n                if (am >= FF_ARRAY_ELEMS(dca_default_coeffs)) {\n                    av_log(s->avctx, AV_LOG_ERROR,\n                           "Invalid channel mode %d\\n", am);\n                    return AVERROR_INVALIDDATA;\n                }\n                if (s->prim_channels + !!s->lfe >\n                    FF_ARRAY_ELEMS(dca_default_coeffs[0])) {\n                    avpriv_request_sample(s->avctx, "Downmixing %d channels",\n                                          s->prim_channels + !!s->lfe);\n                    return AVERROR_PATCHWELCOME;\n                }\n                for (i = 0; i < s->prim_channels + !!s->lfe; i++) {\n                    s->downmix_coef[i][0] = dca_default_coeffs[am][i][0];\n                    s->downmix_coef[i][1] = dca_default_coeffs[am][i][1];\n                }\n            }\n            av_dlog(s->avctx, "Stereo downmix coeffs:\\n");\n            for (i = 0; i < s->prim_channels + !!s->lfe; i++) {\n                av_dlog(s->avctx, "L, input channel %d = %f\\n", i,\n                        s->downmix_coef[i][0]);\n                av_dlog(s->avctx, "R, input channel %d = %f\\n", i,\n                        s->downmix_coef[i][1]);\n            }\n            av_dlog(s->avctx, "\\n");\n        }\n    } else {\n        av_log(avctx, AV_LOG_ERROR, "Non standard configuration %d !\\n", s->amode);\n        return AVERROR_INVALIDDATA;\n    }\n    avctx->channels = channels;\n    frame->nb_samples = 256 * (s->sample_blocks / 8);\n    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    samples_flt = (float **)frame->extended_data;\n    if (avctx->channels < full_channels) {\n        ret = av_samples_get_buffer_size(NULL, full_channels - channels,\n                                         frame->nb_samples,\n                                         avctx->sample_fmt, 0);\n        if (ret < 0)\n            return ret;\n        av_fast_malloc(&s->extra_channels_buffer,\n                       &s->extra_channels_buffer_size, ret);\n        if (!s->extra_channels_buffer)\n            return AVERROR(ENOMEM);\n        ret = av_samples_fill_arrays((uint8_t **)s->extra_channels, NULL,\n                                     s->extra_channels_buffer,\n                                     full_channels - channels,\n                                     frame->nb_samples, avctx->sample_fmt, 0);\n        if (ret < 0)\n            return ret;\n    }\n    for (i = 0; i < (s->sample_blocks / 8); i++) {\n        int ch;\n        for (ch = 0; ch < channels; ch++)\n            s->samples_chanptr[ch] = samples_flt[ch] + i * 256;\n        for (; ch < full_channels; ch++)\n            s->samples_chanptr[ch] = s->extra_channels[ch - channels] + i * 256;\n        dca_filter_channels(s, i);\n        if ((s->source_pcm_res & 1) && s->xch_present) {\n            float *back_chan = s->samples_chanptr[s->channel_order_tab[s->xch_base_channel]];\n            float *lt_chan   = s->samples_chanptr[s->channel_order_tab[s->xch_base_channel - 2]];\n            float *rt_chan   = s->samples_chanptr[s->channel_order_tab[s->xch_base_channel - 1]];\n            s->fdsp.vector_fmac_scalar(lt_chan, back_chan, -M_SQRT1_2, 256);\n            s->fdsp.vector_fmac_scalar(rt_chan, back_chan, -M_SQRT1_2, 256);\n        }\n    }\n    lfe_samples = 2 * s->lfe * (s->sample_blocks / 8);\n    for (i = 0; i < 2 * s->lfe * 4; i++)\n        s->lfe_data[i] = s->lfe_data[i + lfe_samples];\n    *got_frame_ptr = 1;\n    return buf_size;\n}']