libavcodec/indeo3.c:266: error: Buffer Overrun L1
  Offset: 2 Size: 2.

libavcodec/indeo3.c:225:1: <Length trace>
223.  *  @param cell     pointer to the cell  descriptor
224.  */
225. static int copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell)
     ^
226. {
227.     int     h, w, mv_x, mv_y, offset, offset_dst;

libavcodec/indeo3.c:225:1: Parameter `ctx->dsp.put_no_rnd_pixels_tab[*]`
223.  *  @param cell     pointer to the cell  descriptor
224.  */
225. static int copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell)
     ^
226. {
227.     int     h, w, mv_x, mv_y, offset, offset_dst;

libavcodec/indeo3.c:266:13: Array access: Offset: 2 Size: 2
264. 
265.         if (w >= 1) {
266.             ctx->dsp.put_no_rnd_pixels_tab[2][0](dst, src, plane->pitch, h);
                 ^
267.             w--;
268.             src += 4;

static int copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell)
{
    int     h, w, mv_x, mv_y, offset, offset_dst;
    uint8_t *src, *dst;
    offset_dst  = (cell->ypos << 2) * plane->pitch + (cell->xpos << 2);
    dst         = plane->pixels[ctx->buf_sel] + offset_dst;
    mv_y        = cell->mv_ptr[0];
    mv_x        = cell->mv_ptr[1];
    if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 ||
        ((cell->ypos + cell->height) << 2) + mv_y >= plane->height    ||
        ((cell->xpos + cell->width)  << 2) + mv_x >= plane->width) {
        av_log(ctx->avctx, AV_LOG_ERROR,
               "Motion vectors point out of the frame.\n");
        return AVERROR_INVALIDDATA;
    }
    offset      = offset_dst + mv_y * plane->pitch + mv_x;
    src         = plane->pixels[ctx->buf_sel ^ 1] + offset;
    h = cell->height << 2;
    for (w = cell->width; w > 0;) {
        if (!((cell->xpos << 2) & 15) && w >= 4) {
            for (; w >= 4; src += 16, dst += 16, w -= 4)
                ctx->dsp.put_no_rnd_pixels_tab[0][0](dst, src, plane->pitch, h);
        }
        if (!((cell->xpos << 2) & 7) && w >= 2) {
            ctx->dsp.put_no_rnd_pixels_tab[1][0](dst, src, plane->pitch, h);
            w -= 2;
            src += 8;
            dst += 8;
        }
        if (w >= 1) {
            ctx->dsp.put_no_rnd_pixels_tab[2][0](dst, src, plane->pitch, h);
            w--;
            src += 4;
            dst += 4;
        }
    }
    return 0;
}
['static int copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell)\n{\n    int     h, w, mv_x, mv_y, offset, offset_dst;\n    uint8_t *src, *dst;\n    offset_dst  = (cell->ypos << 2) * plane->pitch + (cell->xpos << 2);\n    dst         = plane->pixels[ctx->buf_sel] + offset_dst;\n    mv_y        = cell->mv_ptr[0];\n    mv_x        = cell->mv_ptr[1];\n    if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 ||\n        ((cell->ypos + cell->height) << 2) + mv_y >= plane->height    ||\n        ((cell->xpos + cell->width)  << 2) + mv_x >= plane->width) {\n        av_log(ctx->avctx, AV_LOG_ERROR,\n               "Motion vectors point out of the frame.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    offset      = offset_dst + mv_y * plane->pitch + mv_x;\n    src         = plane->pixels[ctx->buf_sel ^ 1] + offset;\n    h = cell->height << 2;\n    for (w = cell->width; w > 0;) {\n        if (!((cell->xpos << 2) & 15) && w >= 4) {\n            for (; w >= 4; src += 16, dst += 16, w -= 4)\n                ctx->dsp.put_no_rnd_pixels_tab[0][0](dst, src, plane->pitch, h);\n        }\n        if (!((cell->xpos << 2) & 7) && w >= 2) {\n            ctx->dsp.put_no_rnd_pixels_tab[1][0](dst, src, plane->pitch, h);\n            w -= 2;\n            src += 8;\n            dst += 8;\n        }\n        if (w >= 1) {\n            ctx->dsp.put_no_rnd_pixels_tab[2][0](dst, src, plane->pitch, h);\n            w--;\n            src += 4;\n            dst += 4;\n        }\n    }\n    return 0;\n}']