libavcodec/shorten.c:525: error: Buffer Overrun L2
  Offset: [-oo, 8] Size: 3 by call to `decode_subframe_lpc`.

libavcodec/shorten.c:453:15: Call
451.         int cmd;
452.         int len;
453.         cmd = get_ur_golomb_shorten(&s->gb, FNSIZE);
                   ^
454. 
455.         if (cmd > FN_VERBATIM) {

libavcodec/golomb.h:356:16: Call
  354.  */
  355. static inline unsigned int get_ur_golomb_shorten(GetBitContext *gb, int k){
  356.         return get_ur_golomb_jpegls(gb, k, INT_MAX, 0);
                      ^
  357. }
  358. 

libavcodec/golomb.h:327:13: Assignment
    325.             return buf + 1;
    326.         }else
    327.             return -1;
                     ^
    328.     }
    329. }

libavcodec/golomb.h:356:9: Assignment
  354.  */
  355. static inline unsigned int get_ur_golomb_shorten(GetBitContext *gb, int k){
  356.         return get_ur_golomb_jpegls(gb, k, INT_MAX, 0);
               ^
  357. }
  358. 

libavcodec/shorten.c:453:9: Assignment
451.         int cmd;
452.         int len;
453.         cmd = get_ur_golomb_shorten(&s->gb, FNSIZE);
             ^
454. 
455.         if (cmd > FN_VERBATIM) {

libavcodec/shorten.c:525:28: Call
523.                     s->decoded[channel][i] = 0;
524.             } else {
525.                 if ((ret = decode_subframe_lpc(s, cmd, channel, residual_size, coffset)) < 0)
                                ^
526.                     return ret;
527.             }

libavcodec/shorten.c:268:1: <Offset trace>
266. };
267. 
268. static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
     ^
269.                                int residual_size, int32_t coffset)
270. {

libavcodec/shorten.c:268:1: Parameter `command`
  266. };
  267. 
  268. static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
       ^
  269.                                int residual_size, int32_t coffset)
  270. {

libavcodec/shorten.c:289:9: Assignment
  287.     } else {
  288.         /* fixed LPC coeffs */
  289.         pred_order = command;
               ^
  290.         coeffs     = fixed_coeffs[pred_order-1];
  291.         qshift     = 0;

libavcodec/shorten.c:262:1: <Length trace>
260. }
261. 
262. static const int fixed_coeffs[3][3] = {
     ^
263.     { 1,  0,  0 },
264.     { 2, -1,  0 },

libavcodec/shorten.c:262:1: Array declaration
  260. }
  261. 
  262. static const int fixed_coeffs[3][3] = {
       ^
  263.     { 1,  0,  0 },
  264.     { 2, -1,  0 },

libavcodec/shorten.c:290:9: Array access: Offset: [-oo, 8] Size: 3 by call to `decode_subframe_lpc` 
  288.         /* fixed LPC coeffs */
  289.         pred_order = command;
  290.         coeffs     = fixed_coeffs[pred_order-1];
               ^
  291.         qshift     = 0;
  292.     }

static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
                               int residual_size, int32_t coffset)
{
    int pred_order, sum, qshift, init_sum, i, j;
    const int *coeffs;
    if (command == FN_QLPC) {
        pred_order = get_ur_golomb_shorten(&s->gb, LPCQSIZE);
        if (pred_order > s->nwrap) {
            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n", pred_order);
            return AVERROR(EINVAL);
        }
        for (i=0; i<pred_order; i++)
            s->coeffs[i] = get_sr_golomb_shorten(&s->gb, LPCQUANT);
        coeffs = s->coeffs;
        qshift = LPCQUANT;
    } else {
        pred_order = command;
        coeffs     = fixed_coeffs[pred_order-1];
        qshift     = 0;
    }
    if (command == FN_QLPC && coffset)
        for (i = -pred_order; i < 0; i++)
            s->decoded[channel][i] -= coffset;
    init_sum = pred_order ? (command == FN_QLPC ? s->lpcqoffset : 0) : coffset;
    for (i=0; i < s->blocksize; i++) {
        sum = init_sum;
        for (j=0; j<pred_order; j++)
            sum += coeffs[j] * s->decoded[channel][i-j-1];
        s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + (sum >> qshift);
    }
    if (command == FN_QLPC && coffset)
        for (i = 0; i < s->blocksize; i++)
            s->decoded[channel][i] += coffset;
    return 0;
}
['static int shorten_decode_frame(AVCodecContext *avctx,\n        void *data, int *data_size,\n        AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    ShortenContext *s = avctx->priv_data;\n    int i, input_buf_size = 0;\n    int16_t *samples = data;\n    int ret;\n    if(s->max_framesize == 0){\n        void *tmp_ptr;\n        s->max_framesize= 1024;\n        tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size,\n                                  s->max_framesize);\n        if (!tmp_ptr) {\n            av_log(avctx, AV_LOG_ERROR, "error allocating bitstream buffer\\n");\n            return AVERROR(ENOMEM);\n        }\n        s->bitstream = tmp_ptr;\n    }\n    if(1 && s->max_framesize){\n        buf_size= FFMIN(buf_size, s->max_framesize - s->bitstream_size);\n        input_buf_size= buf_size;\n        if(s->bitstream_index + s->bitstream_size + buf_size > s->allocated_bitstream_size){\n            memmove(s->bitstream, &s->bitstream[s->bitstream_index], s->bitstream_size);\n            s->bitstream_index=0;\n        }\n        memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size], buf, buf_size);\n        buf= &s->bitstream[s->bitstream_index];\n        buf_size += s->bitstream_size;\n        s->bitstream_size= buf_size;\n        if(buf_size < s->max_framesize){\n            *data_size = 0;\n            return input_buf_size;\n        }\n    }\n    init_get_bits(&s->gb, buf, buf_size*8);\n    skip_bits(&s->gb, s->bitindex);\n    if (!s->got_header) {\n        if ((ret = read_header(s)) < 0)\n            return ret;\n        *data_size = 0;\n    }\n    else\n    {\n        int cmd;\n        int len;\n        cmd = get_ur_golomb_shorten(&s->gb, FNSIZE);\n        if (cmd > FN_VERBATIM) {\n            av_log(avctx, AV_LOG_ERROR, "unknown shorten function %d\\n", cmd);\n            if (s->bitstream_size > 0) {\n                s->bitstream_index++;\n                s->bitstream_size--;\n            }\n            return -1;\n        }\n        if (!is_audio_command[cmd]) {\n            switch (cmd) {\n                case FN_VERBATIM:\n                    len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);\n                    while (len--) {\n                        get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);\n                    }\n                    break;\n                case FN_BITSHIFT:\n                    s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);\n                    break;\n                case FN_BLOCKSIZE: {\n                    int blocksize = get_uint(s, av_log2(s->blocksize));\n                    if (blocksize > s->blocksize) {\n                        av_log(avctx, AV_LOG_ERROR, "Increasing block size is not supported\\n");\n                        return AVERROR_PATCHWELCOME;\n                    }\n                    if (!blocksize || blocksize > MAX_BLOCKSIZE) {\n                        av_log(avctx, AV_LOG_ERROR, "invalid or unsupported "\n                               "block size: %d\\n", blocksize);\n                        return AVERROR(EINVAL);\n                    }\n                    s->blocksize = blocksize;\n                    break;\n                }\n                case FN_QUIT:\n                    break;\n            }\n            *data_size = 0;\n        } else {\n            int residual_size = 0;\n            int channel = s->cur_chan;\n            int32_t coffset;\n            if (cmd != FN_ZERO) {\n                residual_size = get_ur_golomb_shorten(&s->gb, ENERGYSIZE);\n                if (s->version == 0)\n                    residual_size--;\n            }\n            if (s->nmean == 0)\n                coffset = s->offset[channel][0];\n            else {\n                int32_t sum = (s->version < 2) ? 0 : s->nmean / 2;\n                for (i=0; i<s->nmean; i++)\n                    sum += s->offset[channel][i];\n                coffset = sum / s->nmean;\n                if (s->version >= 2)\n                    coffset >>= FFMIN(1, s->bitshift);\n            }\n            if (cmd == FN_ZERO) {\n                for (i=0; i<s->blocksize; i++)\n                    s->decoded[channel][i] = 0;\n            } else {\n                if ((ret = decode_subframe_lpc(s, cmd, channel, residual_size, coffset)) < 0)\n                    return ret;\n            }\n            if (s->nmean > 0) {\n                int32_t sum = (s->version < 2) ? 0 : s->blocksize / 2;\n                for (i=0; i<s->blocksize; i++)\n                    sum += s->decoded[channel][i];\n                for (i=1; i<s->nmean; i++)\n                    s->offset[channel][i-1] = s->offset[channel][i];\n                if (s->version < 2)\n                    s->offset[channel][s->nmean - 1] = sum / s->blocksize;\n                else\n                    s->offset[channel][s->nmean - 1] = (sum / s->blocksize) << s->bitshift;\n            }\n            for (i=-s->nwrap; i<0; i++)\n                s->decoded[channel][i] = s->decoded[channel][i + s->blocksize];\n            fix_bitshift(s, s->decoded[channel]);\n            s->cur_chan++;\n            if (s->cur_chan == s->channels) {\n                int out_size = s->blocksize * s->channels *\n                               av_get_bytes_per_sample(avctx->sample_fmt);\n                if (*data_size < out_size) {\n                    av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\\n");\n                    return AVERROR(EINVAL);\n                }\n                samples = interleave_buffer(samples, s->channels, s->blocksize, s->decoded);\n                s->cur_chan = 0;\n                *data_size = out_size;\n            } else {\n                *data_size = 0;\n            }\n        }\n    }\n    s->bitindex = get_bits_count(&s->gb) - 8*((get_bits_count(&s->gb))/8);\n    i= (get_bits_count(&s->gb))/8;\n    if (i > buf_size) {\n        av_log(s->avctx, AV_LOG_ERROR, "overread: %d\\n", i - buf_size);\n        s->bitstream_size=0;\n        s->bitstream_index=0;\n        return -1;\n    }\n    if (s->bitstream_size) {\n        s->bitstream_index += i;\n        s->bitstream_size  -= i;\n        return input_buf_size;\n    } else\n        return i;\n}', 'static inline unsigned int get_ur_golomb_shorten(GetBitContext *gb, int k){\n        return get_ur_golomb_jpegls(gb, k, INT_MAX, 0);\n}', 'static inline int get_ur_golomb_jpegls(GetBitContext *gb, int k, int limit, int esc_len){\n    unsigned int buf;\n    int log;\n    OPEN_READER(re, gb);\n    UPDATE_CACHE(re, gb);\n    buf=GET_CACHE(re, gb);\n    log= av_log2(buf);\n    if(log - k >= 32-MIN_CACHE_BITS+(MIN_CACHE_BITS==32) && 32-log < limit){\n        buf >>= log - k;\n        buf += (30-log)<<k;\n        LAST_SKIP_BITS(re, gb, 32 + k - log);\n        CLOSE_READER(re, gb);\n        return buf;\n    }else{\n        int i;\n        for(i=0; SHOW_UBITS(re, gb, 1) == 0; i++){\n            LAST_SKIP_BITS(re, gb, 1);\n            UPDATE_CACHE(re, gb);\n        }\n        SKIP_BITS(re, gb, 1);\n        if(i < limit - 1){\n            if(k){\n                buf = SHOW_UBITS(re, gb, k);\n                LAST_SKIP_BITS(re, gb, k);\n            }else{\n                buf=0;\n            }\n            CLOSE_READER(re, gb);\n            return buf + (i<<k);\n        }else if(i == limit - 1){\n            buf = SHOW_UBITS(re, gb, esc_len);\n            LAST_SKIP_BITS(re, gb, esc_len);\n            CLOSE_READER(re, gb);\n            return buf + 1;\n        }else\n            return -1;\n    }\n}', 'static int decode_subframe_lpc(ShortenContext *s, int command, int channel,\n                               int residual_size, int32_t coffset)\n{\n    int pred_order, sum, qshift, init_sum, i, j;\n    const int *coeffs;\n    if (command == FN_QLPC) {\n        pred_order = get_ur_golomb_shorten(&s->gb, LPCQSIZE);\n        if (pred_order > s->nwrap) {\n            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\\n", pred_order);\n            return AVERROR(EINVAL);\n        }\n        for (i=0; i<pred_order; i++)\n            s->coeffs[i] = get_sr_golomb_shorten(&s->gb, LPCQUANT);\n        coeffs = s->coeffs;\n        qshift = LPCQUANT;\n    } else {\n        pred_order = command;\n        coeffs     = fixed_coeffs[pred_order-1];\n        qshift     = 0;\n    }\n    if (command == FN_QLPC && coffset)\n        for (i = -pred_order; i < 0; i++)\n            s->decoded[channel][i] -= coffset;\n    init_sum = pred_order ? (command == FN_QLPC ? s->lpcqoffset : 0) : coffset;\n    for (i=0; i < s->blocksize; i++) {\n        sum = init_sum;\n        for (j=0; j<pred_order; j++)\n            sum += coeffs[j] * s->decoded[channel][i-j-1];\n        s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) + (sum >> qshift);\n    }\n    if (command == FN_QLPC && coffset)\n        for (i = 0; i < s->blocksize; i++)\n            s->decoded[channel][i] += coffset;\n    return 0;\n}']