libavcodec/vc1dec.c:6081: error: Buffer Overrun L2
  Offset: [1, 1+max(1, `avctx->priv_data->two_sprites`)] (⇐ [0, max(1, `avctx->priv_data->two_sprites`)] + 1) Size: 2 by call to `vc1_decode_sprites`.

libavcodec/vc1dec.c:5752:1: Parameter `avctx->priv_data->two_sprites`
5750.  * @todo TODO: Handle VC-1 IDUs (Transport level?)
5751.  */
5752. static int vc1_decode_frame(AVCodecContext *avctx, void *data,
      ^
5753.                             int *got_frame, AVPacket *avpkt)
5754. {

libavcodec/vc1dec.c:6081:13: Call
6079.             goto end;
6080. #if CONFIG_WMV3IMAGE_DECODER || CONFIG_VC1IMAGE_DECODER
6081.         if (vc1_decode_sprites(v, &s->gb))
                  ^
6082.             goto err;
6083. #endif

libavcodec/vc1dec.c:5442:1: Parameter `v->two_sprites`
  5440. 
  5441. 
  5442. static int vc1_decode_sprites(VC1Context *v, GetBitContext* gb)
        ^
  5443. {
  5444.     MpegEncContext *s     = &v->s;

libavcodec/vc1dec.c:5448:5: Call
  5446.     SpriteData sd;
  5447. 
  5448.     vc1_parse_sprites(v, gb, &sd);
            ^
  5449. 
  5450.     if (!s->current_picture.f->data[0]) {

libavcodec/vc1dec.c:5278:1: Parameter `sd->coefs[*]`
    5276. }
    5277. 
    5278. static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)
          ^
    5279. {
    5280.     AVCodecContext *avctx = v->s.avctx;

libavcodec/vc1dec.c:5284:9: Call
    5282. 
    5283.     for (sprite = 0; sprite <= v->two_sprites; sprite++) {
    5284.         vc1_sprite_parse_transform(gb, sd->coefs[sprite]);
                  ^
    5285.         if (sd->coefs[sprite][1] || sd->coefs[sprite][3])
    5286.             avpriv_request_sample(avctx, "Non-zero rotation coefficients");

libavcodec/vc1dec.c:5244:1: <Length trace>
5242. }
5243. 
5244. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      ^
5245. {
5246.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:5244:1: Parameter `*c`
      5242. }
      5243. 
      5244. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
            ^
      5245. {
      5246.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:5246:5: Array access: Offset: [1, 1+max(1, avctx->priv_data->two_sprites)] (⇐ [0, max(1, avctx->priv_data->two_sprites)] + 1) Size: 2 by call to `vc1_decode_sprites` 
      5244. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      5245. {
      5246.     c[1] = c[3] = 0;
                ^
      5247. 
      5248.     switch (get_bits(gb, 2)) {

static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
{
    c[1] = c[3] = 0;
    switch (get_bits(gb, 2)) {
    case 0:
        c[0] = 1 << 16;
        c[2] = get_fp_val(gb);
        c[4] = 1 << 16;
        break;
    case 1:
        c[0] = c[4] = get_fp_val(gb);
        c[2] = get_fp_val(gb);
        break;
    case 2:
        c[0] = get_fp_val(gb);
        c[2] = get_fp_val(gb);
        c[4] = get_fp_val(gb);
        break;
    case 3:
        c[0] = get_fp_val(gb);
        c[1] = get_fp_val(gb);
        c[2] = get_fp_val(gb);
        c[3] = get_fp_val(gb);
        c[4] = get_fp_val(gb);
        break;
    }
    c[5] = get_fp_val(gb);
    if (get_bits1(gb))
        c[6] = get_fp_val(gb);
    else
        c[6] = 1 << 16;
}
['static int vc1_decode_frame(AVCodecContext *avctx, void *data,\n                            int *got_frame, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size, n_slices = 0, i, ret;\n    VC1Context *v = avctx->priv_data;\n    MpegEncContext *s = &v->s;\n    AVFrame *pict = data;\n    uint8_t *buf2 = NULL;\n    const uint8_t *buf_start = buf;\n    int mb_height, n_slices1;\n    struct {\n        uint8_t *buf;\n        GetBitContext gb;\n        int mby_start;\n    } *slices = NULL, *tmp;\n    if (buf_size == 0 || (buf_size == 4 && AV_RB32(buf) == VC1_CODE_ENDOFSEQ)) {\n        if (s->low_delay == 0 && s->next_picture_ptr) {\n            if ((ret = av_frame_ref(pict, s->next_picture_ptr->f)) < 0)\n                return ret;\n            s->next_picture_ptr = NULL;\n            *got_frame = 1;\n        }\n        return 0;\n    }\n    if (avctx->codec_id == AV_CODEC_ID_VC1 || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) {\n        int buf_size2 = 0;\n        buf2 = av_mallocz(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);\n        if (IS_MARKER(AV_RB32(buf))) {\n            const uint8_t *start, *end, *next;\n            int size;\n            next = buf;\n            for (start = buf, end = buf + buf_size; next < end; start = next) {\n                next = find_next_marker(start + 4, end);\n                size = next - start - 4;\n                if (size <= 0) continue;\n                switch (AV_RB32(start)) {\n                case VC1_CODE_FRAME:\n                    if (avctx->hwaccel)\n                        buf_start = start;\n                    buf_size2 = vc1_unescape_buffer(start + 4, size, buf2);\n                    break;\n                case VC1_CODE_FIELD: {\n                    int buf_size3;\n                    tmp = av_realloc(slices, sizeof(*slices) * (n_slices+1));\n                    if (!tmp)\n                        goto err;\n                    slices = tmp;\n                    slices[n_slices].buf = av_mallocz(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);\n                    if (!slices[n_slices].buf)\n                        goto err;\n                    buf_size3 = vc1_unescape_buffer(start + 4, size,\n                                                    slices[n_slices].buf);\n                    init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,\n                                  buf_size3 << 3);\n                    slices[n_slices].mby_start = s->mb_height >> 1;\n                    n_slices1 = n_slices - 1;\n                    n_slices++;\n                    break;\n                }\n                case VC1_CODE_ENTRYPOINT:\n                    buf_size2 = vc1_unescape_buffer(start + 4, size, buf2);\n                    init_get_bits(&s->gb, buf2, buf_size2 * 8);\n                    ff_vc1_decode_entry_point(avctx, v, &s->gb);\n                    break;\n                case VC1_CODE_SLICE: {\n                    int buf_size3;\n                    tmp = av_realloc(slices, sizeof(*slices) * (n_slices+1));\n                    if (!tmp)\n                        goto err;\n                    slices = tmp;\n                    slices[n_slices].buf = av_mallocz(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);\n                    if (!slices[n_slices].buf)\n                        goto err;\n                    buf_size3 = vc1_unescape_buffer(start + 4, size,\n                                                    slices[n_slices].buf);\n                    init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,\n                                  buf_size3 << 3);\n                    slices[n_slices].mby_start = get_bits(&slices[n_slices].gb, 9);\n                    n_slices++;\n                    break;\n                }\n                }\n            }\n        } else if (v->interlace && ((buf[0] & 0xC0) == 0xC0)) {\n            const uint8_t *divider;\n            int buf_size3;\n            divider = find_next_marker(buf, buf + buf_size);\n            if ((divider == (buf + buf_size)) || AV_RB32(divider) != VC1_CODE_FIELD) {\n                av_log(avctx, AV_LOG_ERROR, "Error in WVC1 interlaced frame\\n");\n                goto err;\n            } else {\n                tmp = av_realloc(slices, sizeof(*slices) * (n_slices+1));\n                if (!tmp)\n                    goto err;\n                slices = tmp;\n                slices[n_slices].buf = av_mallocz(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);\n                if (!slices[n_slices].buf)\n                    goto err;\n                buf_size3 = vc1_unescape_buffer(divider + 4, buf + buf_size - divider - 4, slices[n_slices].buf);\n                init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,\n                              buf_size3 << 3);\n                slices[n_slices].mby_start = s->mb_height >> 1;\n                n_slices1 = n_slices - 1;\n                n_slices++;\n            }\n            buf_size2 = vc1_unescape_buffer(buf, divider - buf, buf2);\n        } else {\n            buf_size2 = vc1_unescape_buffer(buf, buf_size, buf2);\n        }\n        init_get_bits(&s->gb, buf2, buf_size2*8);\n    } else\n        init_get_bits(&s->gb, buf, buf_size*8);\n    if (v->res_sprite) {\n        v->new_sprite  = !get_bits1(&s->gb);\n        v->two_sprites =  get_bits1(&s->gb);\n        if (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) {\n            if (v->new_sprite) {\n                avctx->width  = avctx->coded_width  = v->sprite_width;\n                avctx->height = avctx->coded_height = v->sprite_height;\n            } else {\n                goto image;\n            }\n        }\n    }\n    if (s->context_initialized &&\n        (s->width  != avctx->coded_width ||\n         s->height != avctx->coded_height)) {\n        ff_vc1_decode_end(avctx);\n    }\n    if (!s->context_initialized) {\n        if (ff_msmpeg4_decode_init(avctx) < 0)\n            goto err;\n        if (ff_vc1_decode_init_alloc_tables(v) < 0) {\n            ff_MPV_common_end(s);\n            goto err;\n        }\n        s->low_delay = !avctx->has_b_frames || v->res_sprite;\n        if (v->profile == PROFILE_ADVANCED) {\n            s->h_edge_pos = avctx->coded_width;\n            s->v_edge_pos = avctx->coded_height;\n        }\n    }\n    v->pic_header_flag = 0;\n    v->first_pic_header_flag = 1;\n    if (v->profile < PROFILE_ADVANCED) {\n        if (ff_vc1_parse_frame_header(v, &s->gb) < 0) {\n            goto err;\n        }\n    } else {\n        if (ff_vc1_parse_frame_header_adv(v, &s->gb) < 0) {\n            goto err;\n        }\n    }\n    v->first_pic_header_flag = 0;\n    if ((avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE)\n        && s->pict_type != AV_PICTURE_TYPE_I) {\n        av_log(v->s.avctx, AV_LOG_ERROR, "Sprite decoder: expected I-frame\\n");\n        goto err;\n    }\n    s->current_picture.f->pict_type = s->pict_type;\n    s->current_picture.f->key_frame = s->pict_type == AV_PICTURE_TYPE_I;\n    if (s->last_picture_ptr == NULL && (s->pict_type == AV_PICTURE_TYPE_B || s->droppable)) {\n        goto err;\n    }\n    if ((avctx->skip_frame >= AVDISCARD_NONREF && s->pict_type == AV_PICTURE_TYPE_B) ||\n        (avctx->skip_frame >= AVDISCARD_NONKEY && s->pict_type != AV_PICTURE_TYPE_I) ||\n         avctx->skip_frame >= AVDISCARD_ALL) {\n        goto end;\n    }\n    if (s->next_p_frame_damaged) {\n        if (s->pict_type == AV_PICTURE_TYPE_B)\n            goto end;\n        else\n            s->next_p_frame_damaged = 0;\n    }\n    if (ff_MPV_frame_start(s, avctx) < 0) {\n        goto err;\n    }\n    s->current_picture_ptr->f->repeat_pict = 0;\n    if (v->rff) {\n        s->current_picture_ptr->f->repeat_pict = 1;\n    } else if (v->rptfrm) {\n        s->current_picture_ptr->f->repeat_pict = v->rptfrm * 2;\n    }\n    s->me.qpel_put = s->dsp.put_qpel_pixels_tab;\n    s->me.qpel_avg = s->dsp.avg_qpel_pixels_tab;\n    if (avctx->hwaccel) {\n        if (avctx->hwaccel->start_frame(avctx, buf, buf_size) < 0)\n            goto err;\n        if (avctx->hwaccel->decode_slice(avctx, buf_start, (buf + buf_size) - buf_start) < 0)\n            goto err;\n        if (avctx->hwaccel->end_frame(avctx) < 0)\n            goto err;\n    } else {\n        int header_ret = 0;\n        ff_mpeg_er_frame_start(s);\n        v->bits = buf_size * 8;\n        v->end_mb_x = s->mb_width;\n        if (v->field_mode) {\n            s->current_picture.f->linesize[0] <<= 1;\n            s->current_picture.f->linesize[1] <<= 1;\n            s->current_picture.f->linesize[2] <<= 1;\n            s->linesize                      <<= 1;\n            s->uvlinesize                    <<= 1;\n        }\n        mb_height = s->mb_height >> v->field_mode;\n        if (!mb_height) {\n            av_log(v->s.avctx, AV_LOG_ERROR, "Invalid mb_height.\\n");\n            goto err;\n        }\n        for (i = 0; i <= n_slices; i++) {\n            if (i > 0 &&  slices[i - 1].mby_start >= mb_height) {\n                if (v->field_mode <= 0) {\n                    av_log(v->s.avctx, AV_LOG_ERROR, "Slice %d starts beyond "\n                           "picture boundary (%d >= %d)\\n", i,\n                           slices[i - 1].mby_start, mb_height);\n                    continue;\n                }\n                v->second_field = 1;\n                v->blocks_off   = s->mb_width  * s->mb_height << 1;\n                v->mb_off       = s->mb_stride * s->mb_height >> 1;\n            } else {\n                v->second_field = 0;\n                v->blocks_off   = 0;\n                v->mb_off       = 0;\n            }\n            if (i) {\n                v->pic_header_flag = 0;\n                if (v->field_mode && i == n_slices1 + 2) {\n                    if ((header_ret = ff_vc1_parse_frame_header_adv(v, &s->gb)) < 0) {\n                        av_log(v->s.avctx, AV_LOG_ERROR, "Field header damaged\\n");\n                        if (avctx->err_recognition & AV_EF_EXPLODE)\n                            goto err;\n                        continue;\n                    }\n                } else if (get_bits1(&s->gb)) {\n                    v->pic_header_flag = 1;\n                    if ((header_ret = ff_vc1_parse_frame_header_adv(v, &s->gb)) < 0) {\n                        av_log(v->s.avctx, AV_LOG_ERROR, "Slice header damaged\\n");\n                        if (avctx->err_recognition & AV_EF_EXPLODE)\n                            goto err;\n                        continue;\n                    }\n                }\n            }\n            if (header_ret < 0)\n                continue;\n            s->start_mb_y = (i == 0) ? 0 : FFMAX(0, slices[i-1].mby_start % mb_height);\n            if (!v->field_mode || v->second_field)\n                s->end_mb_y = (i == n_slices     ) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height);\n            else\n                s->end_mb_y = (i <= n_slices1 + 1) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height);\n            ff_vc1_decode_blocks(v);\n            if (i != n_slices)\n                s->gb = slices[i].gb;\n        }\n        if (v->field_mode) {\n            v->second_field = 0;\n            s->current_picture.f->linesize[0] >>= 1;\n            s->current_picture.f->linesize[1] >>= 1;\n            s->current_picture.f->linesize[2] >>= 1;\n            s->linesize                      >>= 1;\n            s->uvlinesize                    >>= 1;\n            if (v->s.pict_type != AV_PICTURE_TYPE_BI && v->s.pict_type != AV_PICTURE_TYPE_B) {\n                FFSWAP(uint8_t *, v->mv_f_next[0], v->mv_f[0]);\n                FFSWAP(uint8_t *, v->mv_f_next[1], v->mv_f[1]);\n            }\n        }\n        av_dlog(s->avctx, "Consumed %i/%i bits\\n",\n                get_bits_count(&s->gb), s->gb.size_in_bits);\n        if (!v->field_mode)\n            ff_er_frame_end(&s->er);\n    }\n    ff_MPV_frame_end(s);\n    if (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) {\nimage:\n        avctx->width  = avctx->coded_width  = v->output_width;\n        avctx->height = avctx->coded_height = v->output_height;\n        if (avctx->skip_frame >= AVDISCARD_NONREF)\n            goto end;\n#if CONFIG_WMV3IMAGE_DECODER || CONFIG_VC1IMAGE_DECODER\n        if (vc1_decode_sprites(v, &s->gb))\n            goto err;\n#endif\n        if ((ret = av_frame_ref(pict, v->sprite_output_frame)) < 0)\n            goto err;\n        *got_frame = 1;\n    } else {\n        if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) {\n            if ((ret = av_frame_ref(pict, s->current_picture_ptr->f)) < 0)\n                goto err;\n            ff_print_debug_info(s, s->current_picture_ptr);\n            *got_frame = 1;\n        } else if (s->last_picture_ptr != NULL) {\n            if ((ret = av_frame_ref(pict, s->last_picture_ptr->f)) < 0)\n                goto err;\n            ff_print_debug_info(s, s->last_picture_ptr);\n            *got_frame = 1;\n        }\n    }\nend:\n    av_free(buf2);\n    for (i = 0; i < n_slices; i++)\n        av_free(slices[i].buf);\n    av_free(slices);\n    return buf_size;\nerr:\n    av_free(buf2);\n    for (i = 0; i < n_slices; i++)\n        av_free(slices[i].buf);\n    av_free(slices);\n    return -1;\n}', 'static int vc1_decode_sprites(VC1Context *v, GetBitContext* gb)\n{\n    MpegEncContext *s     = &v->s;\n    AVCodecContext *avctx = s->avctx;\n    SpriteData sd;\n    vc1_parse_sprites(v, gb, &sd);\n    if (!s->current_picture.f->data[0]) {\n        av_log(avctx, AV_LOG_ERROR, "Got no sprites\\n");\n        return -1;\n    }\n    if (v->two_sprites && (!s->last_picture_ptr || !s->last_picture.f->data[0])) {\n        av_log(avctx, AV_LOG_WARNING, "Need two sprites, only got one\\n");\n        v->two_sprites = 0;\n    }\n    av_frame_unref(v->sprite_output_frame);\n    if (ff_get_buffer(avctx, v->sprite_output_frame, 0) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return -1;\n    }\n    vc1_draw_sprites(v, &sd);\n    return 0;\n}', 'static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)\n{\n    AVCodecContext *avctx = v->s.avctx;\n    int sprite, i;\n    for (sprite = 0; sprite <= v->two_sprites; sprite++) {\n        vc1_sprite_parse_transform(gb, sd->coefs[sprite]);\n        if (sd->coefs[sprite][1] || sd->coefs[sprite][3])\n            avpriv_request_sample(avctx, "Non-zero rotation coefficients");\n        av_log(avctx, AV_LOG_DEBUG, sprite ? "S2:" : "S1:");\n        for (i = 0; i < 7; i++)\n            av_log(avctx, AV_LOG_DEBUG, " %d.%.3d",\n                   sd->coefs[sprite][i] / (1<<16),\n                   (abs(sd->coefs[sprite][i]) & 0xFFFF) * 1000 / (1 << 16));\n        av_log(avctx, AV_LOG_DEBUG, "\\n");\n    }\n    skip_bits(gb, 2);\n    if (sd->effect_type = get_bits_long(gb, 30)) {\n        switch (sd->effect_pcount1 = get_bits(gb, 4)) {\n        case 7:\n            vc1_sprite_parse_transform(gb, sd->effect_params1);\n            break;\n        case 14:\n            vc1_sprite_parse_transform(gb, sd->effect_params1);\n            vc1_sprite_parse_transform(gb, sd->effect_params1 + 7);\n            break;\n        default:\n            for (i = 0; i < sd->effect_pcount1; i++)\n                sd->effect_params1[i] = get_fp_val(gb);\n        }\n        if (sd->effect_type != 13 || sd->effect_params1[0] != sd->coefs[0][6]) {\n            av_log(avctx, AV_LOG_DEBUG, "Effect: %d; params: ", sd->effect_type);\n            for (i = 0; i < sd->effect_pcount1; i++)\n                av_log(avctx, AV_LOG_DEBUG, " %d.%.2d",\n                       sd->effect_params1[i] / (1 << 16),\n                       (abs(sd->effect_params1[i]) & 0xFFFF) * 1000 / (1 << 16));\n            av_log(avctx, AV_LOG_DEBUG, "\\n");\n        }\n        sd->effect_pcount2 = get_bits(gb, 16);\n        if (sd->effect_pcount2 > 10) {\n            av_log(avctx, AV_LOG_ERROR, "Too many effect parameters\\n");\n            return;\n        } else if (sd->effect_pcount2) {\n            i = -1;\n            av_log(avctx, AV_LOG_DEBUG, "Effect params 2: ");\n            while (++i < sd->effect_pcount2) {\n                sd->effect_params2[i] = get_fp_val(gb);\n                av_log(avctx, AV_LOG_DEBUG, " %d.%.2d",\n                       sd->effect_params2[i] / (1 << 16),\n                       (abs(sd->effect_params2[i]) & 0xFFFF) * 1000 / (1 << 16));\n            }\n            av_log(avctx, AV_LOG_DEBUG, "\\n");\n        }\n    }\n    if (sd->effect_flag = get_bits1(gb))\n        av_log(avctx, AV_LOG_DEBUG, "Effect flag set\\n");\n    if (get_bits_count(gb) >= gb->size_in_bits +\n       (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE ? 64 : 0))\n        av_log(avctx, AV_LOG_ERROR, "Buffer overrun\\n");\n    if (get_bits_count(gb) < gb->size_in_bits - 8)\n        av_log(avctx, AV_LOG_WARNING, "Buffer not fully read\\n");\n}', 'static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])\n{\n    c[1] = c[3] = 0;\n    switch (get_bits(gb, 2)) {\n    case 0:\n        c[0] = 1 << 16;\n        c[2] = get_fp_val(gb);\n        c[4] = 1 << 16;\n        break;\n    case 1:\n        c[0] = c[4] = get_fp_val(gb);\n        c[2] = get_fp_val(gb);\n        break;\n    case 2:\n        c[0] = get_fp_val(gb);\n        c[2] = get_fp_val(gb);\n        c[4] = get_fp_val(gb);\n        break;\n    case 3:\n        c[0] = get_fp_val(gb);\n        c[1] = get_fp_val(gb);\n        c[2] = get_fp_val(gb);\n        c[3] = get_fp_val(gb);\n        c[4] = get_fp_val(gb);\n        break;\n    }\n    c[5] = get_fp_val(gb);\n    if (get_bits1(gb))\n        c[6] = get_fp_val(gb);\n    else\n        c[6] = 1 << 16;\n}']