libavcodec/shorten.c:576: error: Buffer Overrun L2
  Offset: [-oo, 4] Size: 4 by call to `decode_subframe_lpc`.

libavcodec/shorten.c:502:15: Call
500.         }
501. 
502.         cmd = get_ur_golomb_shorten(&s->gb, FNSIZE);
                   ^
503. 
504.         if (cmd > FN_VERBATIM) {

libavcodec/golomb.h:357:16: Call
  355.  */
  356. static inline unsigned int get_ur_golomb_shorten(GetBitContext *gb, int k){
  357.         return get_ur_golomb_jpegls(gb, k, INT_MAX, 0);
                      ^
  358. }
  359. 

libavcodec/golomb.h:328:13: Assignment
    326.             return buf + 1;
    327.         }else
    328.             return -1;
                     ^
    329.     }
    330. }

libavcodec/golomb.h:357:9: Assignment
  355.  */
  356. static inline unsigned int get_ur_golomb_shorten(GetBitContext *gb, int k){
  357.         return get_ur_golomb_jpegls(gb, k, INT_MAX, 0);
               ^
  358. }
  359. 

libavcodec/shorten.c:502:9: Assignment
500.         }
501. 
502.         cmd = get_ur_golomb_shorten(&s->gb, FNSIZE);
             ^
503. 
504.         if (cmd > FN_VERBATIM) {

libavcodec/shorten.c:576:28: Call
574.                     s->decoded[channel][i] = 0;
575.             } else {
576.                 if ((ret = decode_subframe_lpc(s, cmd, channel,
                                ^
577.                                                residual_size, coffset)) < 0)
578.                     return ret;

libavcodec/shorten.c:283:1: <Offset trace>
281. };
282. 
283. static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
     ^
284.                                int residual_size, int32_t coffset)
285. {

libavcodec/shorten.c:283:1: Parameter `command`
  281. };
  282. 
  283. static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
       ^
  284.                                int residual_size, int32_t coffset)
  285. {

libavcodec/shorten.c:305:9: Assignment
  303.     } else {
  304.         /* fixed LPC coeffs */
  305.         pred_order = command;
               ^
  306.         if (pred_order > FF_ARRAY_ELEMS(fixed_coeffs)) {
  307.             av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n",

libavcodec/shorten.c:276:1: <Length trace>
274. }
275. 
276. static const int fixed_coeffs[][3] = {
     ^
277.     { 0,  0,  0 },
278.     { 1,  0,  0 },

libavcodec/shorten.c:276:1: Array declaration
  274. }
  275. 
  276. static const int fixed_coeffs[][3] = {
       ^
  277.     { 0,  0,  0 },
  278.     { 1,  0,  0 },

libavcodec/shorten.c:311:9: Array access: Offset: [-oo, 4] Size: 4 by call to `decode_subframe_lpc` 
  309.             return AVERROR_INVALIDDATA;
  310.         }
  311.         coeffs     = fixed_coeffs[pred_order];
               ^
  312.         qshift     = 0;
  313.     }

static int decode_subframe_lpc(ShortenContext *s, int command, int channel,
                               int residual_size, int32_t coffset)
{
    int pred_order, sum, qshift, init_sum, i, j;
    const int *coeffs;
    if (command == FN_QLPC) {
        pred_order = get_ur_golomb_shorten(&s->gb, LPCQSIZE);
        if (pred_order > s->nwrap) {
            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n",
                   pred_order);
            return AVERROR(EINVAL);
        }
        for (i = 0; i < pred_order; i++)
            s->coeffs[i] = get_sr_golomb_shorten(&s->gb, LPCQUANT);
        coeffs = s->coeffs;
        qshift = LPCQUANT;
    } else {
        pred_order = command;
        if (pred_order > FF_ARRAY_ELEMS(fixed_coeffs)) {
            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\n",
                   pred_order);
            return AVERROR_INVALIDDATA;
        }
        coeffs     = fixed_coeffs[pred_order];
        qshift     = 0;
    }
    if (command == FN_QLPC && coffset)
        for (i = -pred_order; i < 0; i++)
            s->decoded[channel][i] -= coffset;
    init_sum = pred_order ? (command == FN_QLPC ? s->lpcqoffset : 0) : coffset;
    for (i = 0; i < s->blocksize; i++) {
        sum = init_sum;
        for (j = 0; j < pred_order; j++)
            sum += coeffs[j] * s->decoded[channel][i - j - 1];
        s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) +
                                 (sum >> qshift);
    }
    if (command == FN_QLPC && coffset)
        for (i = 0; i < s->blocksize; i++)
            s->decoded[channel][i] += coffset;
    return 0;
}
['static int shorten_decode_frame(AVCodecContext *avctx, void *data,\n                                int *got_frame_ptr, AVPacket *avpkt)\n{\n    AVFrame *frame     = data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    ShortenContext *s  = avctx->priv_data;\n    int i, input_buf_size = 0;\n    int ret;\n    if (s->max_framesize == 0) {\n        void *tmp_ptr;\n        s->max_framesize = 1024;\n        tmp_ptr = av_fast_realloc(s->bitstream, &s->allocated_bitstream_size,\n                                  s->max_framesize);\n        if (!tmp_ptr) {\n            av_log(avctx, AV_LOG_ERROR, "error allocating bitstream buffer\\n");\n            return AVERROR(ENOMEM);\n        }\n        s->bitstream = tmp_ptr;\n    }\n    if (1 && s->max_framesize) {\n        buf_size       = FFMIN(buf_size, s->max_framesize - s->bitstream_size);\n        input_buf_size = buf_size;\n        if (s->bitstream_index + s->bitstream_size + buf_size >\n            s->allocated_bitstream_size) {\n            memmove(s->bitstream, &s->bitstream[s->bitstream_index],\n                    s->bitstream_size);\n            s->bitstream_index = 0;\n        }\n        if (buf)\n            memcpy(&s->bitstream[s->bitstream_index + s->bitstream_size], buf,\n                   buf_size);\n        buf               = &s->bitstream[s->bitstream_index];\n        buf_size         += s->bitstream_size;\n        s->bitstream_size = buf_size;\n        if (buf_size < s->max_framesize && avpkt->data) {\n            *got_frame_ptr = 0;\n            return input_buf_size;\n        }\n    }\n    init_get_bits(&s->gb, buf, buf_size * 8);\n    skip_bits(&s->gb, s->bitindex);\n    if (!s->got_header) {\n        if ((ret = read_header(s)) < 0)\n            return ret;\n        *got_frame_ptr = 0;\n        goto finish_frame;\n    }\n    if (s->got_quit_command) {\n        *got_frame_ptr = 0;\n        return avpkt->size;\n    }\n    s->cur_chan = 0;\n    while (s->cur_chan < s->channels) {\n        unsigned cmd;\n        int len;\n        if (get_bits_left(&s->gb) < 3 + FNSIZE) {\n            *got_frame_ptr = 0;\n            break;\n        }\n        cmd = get_ur_golomb_shorten(&s->gb, FNSIZE);\n        if (cmd > FN_VERBATIM) {\n            av_log(avctx, AV_LOG_ERROR, "unknown shorten function %d\\n", cmd);\n            *got_frame_ptr = 0;\n            break;\n        }\n        if (!is_audio_command[cmd]) {\n            switch (cmd) {\n            case FN_VERBATIM:\n                len = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE);\n                while (len--)\n                    get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE);\n                break;\n            case FN_BITSHIFT:\n                s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);\n                break;\n            case FN_BLOCKSIZE: {\n                unsigned blocksize = get_uint(s, av_log2(s->blocksize));\n                if (blocksize > s->blocksize) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "Increasing block size is not supported\\n");\n                    return AVERROR_PATCHWELCOME;\n                }\n                if (!blocksize || blocksize > MAX_BLOCKSIZE) {\n                    av_log(avctx, AV_LOG_ERROR, "invalid or unsupported "\n                                                "block size: %d\\n", blocksize);\n                    return AVERROR(EINVAL);\n                }\n                s->blocksize = blocksize;\n                break;\n            }\n            case FN_QUIT:\n                s->got_quit_command = 1;\n                break;\n            }\n            if (cmd == FN_BLOCKSIZE || cmd == FN_QUIT) {\n                *got_frame_ptr = 0;\n                break;\n            }\n        } else {\n            int residual_size = 0;\n            int channel = s->cur_chan;\n            int32_t coffset;\n            if (cmd != FN_ZERO) {\n                residual_size = get_ur_golomb_shorten(&s->gb, ENERGYSIZE);\n                if (s->version == 0)\n                    residual_size--;\n            }\n            if (s->nmean == 0)\n                coffset = s->offset[channel][0];\n            else {\n                int32_t sum = (s->version < 2) ? 0 : s->nmean / 2;\n                for (i = 0; i < s->nmean; i++)\n                    sum += s->offset[channel][i];\n                coffset = sum / s->nmean;\n                if (s->version >= 2)\n                    coffset >>= FFMIN(1, s->bitshift);\n            }\n            if (cmd == FN_ZERO) {\n                for (i = 0; i < s->blocksize; i++)\n                    s->decoded[channel][i] = 0;\n            } else {\n                if ((ret = decode_subframe_lpc(s, cmd, channel,\n                                               residual_size, coffset)) < 0)\n                    return ret;\n            }\n            if (s->nmean > 0) {\n                int32_t sum = (s->version < 2) ? 0 : s->blocksize / 2;\n                for (i = 0; i < s->blocksize; i++)\n                    sum += s->decoded[channel][i];\n                for (i = 1; i < s->nmean; i++)\n                    s->offset[channel][i - 1] = s->offset[channel][i];\n                if (s->version < 2)\n                    s->offset[channel][s->nmean - 1] = sum / s->blocksize;\n                else\n                    s->offset[channel][s->nmean - 1] = (sum / s->blocksize) << s->bitshift;\n            }\n            for (i = -s->nwrap; i < 0; i++)\n                s->decoded[channel][i] = s->decoded[channel][i + s->blocksize];\n            fix_bitshift(s, s->decoded[channel]);\n            s->cur_chan++;\n            if (s->cur_chan == s->channels) {\n                frame->nb_samples = s->blocksize;\n                if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {\n                    av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n                    return ret;\n                }\n                output_buffer((int16_t **)frame->extended_data, s->channels,\n                              s->blocksize, s->decoded);\n                *got_frame_ptr = 1;\n            }\n        }\n    }\n    if (s->cur_chan < s->channels)\n        *got_frame_ptr = 0;\nfinish_frame:\n    s->bitindex = get_bits_count(&s->gb) - 8 * (get_bits_count(&s->gb) / 8);\n    i           = get_bits_count(&s->gb) / 8;\n    if (i > buf_size) {\n        av_log(s->avctx, AV_LOG_ERROR, "overread: %d\\n", i - buf_size);\n        s->bitstream_size  = 0;\n        s->bitstream_index = 0;\n        return AVERROR_INVALIDDATA;\n    }\n    if (s->bitstream_size) {\n        s->bitstream_index += i;\n        s->bitstream_size  -= i;\n        return input_buf_size;\n    } else\n        return i;\n}', 'static inline unsigned int get_ur_golomb_shorten(GetBitContext *gb, int k){\n        return get_ur_golomb_jpegls(gb, k, INT_MAX, 0);\n}', 'static inline int get_ur_golomb_jpegls(GetBitContext *gb, int k, int limit, int esc_len){\n    unsigned int buf;\n    int log;\n    OPEN_READER(re, gb);\n    UPDATE_CACHE(re, gb);\n    buf=GET_CACHE(re, gb);\n    log= av_log2(buf);\n    if(log - k >= 32-MIN_CACHE_BITS+(MIN_CACHE_BITS==32) && 32-log < limit){\n        buf >>= log - k;\n        buf += (30-log)<<k;\n        LAST_SKIP_BITS(re, gb, 32 + k - log);\n        CLOSE_READER(re, gb);\n        return buf;\n    }else{\n        int i;\n        for (i = 0; i < limit && SHOW_UBITS(re, gb, 1) == 0 && HAVE_BITS_REMAINING(re, gb); i++) {\n            LAST_SKIP_BITS(re, gb, 1);\n            UPDATE_CACHE(re, gb);\n        }\n        SKIP_BITS(re, gb, 1);\n        if(i < limit - 1){\n            if(k){\n                buf = SHOW_UBITS(re, gb, k);\n                LAST_SKIP_BITS(re, gb, k);\n            }else{\n                buf=0;\n            }\n            CLOSE_READER(re, gb);\n            return buf + (i<<k);\n        }else if(i == limit - 1){\n            buf = SHOW_UBITS(re, gb, esc_len);\n            LAST_SKIP_BITS(re, gb, esc_len);\n            CLOSE_READER(re, gb);\n            return buf + 1;\n        }else\n            return -1;\n    }\n}', 'static int decode_subframe_lpc(ShortenContext *s, int command, int channel,\n                               int residual_size, int32_t coffset)\n{\n    int pred_order, sum, qshift, init_sum, i, j;\n    const int *coeffs;\n    if (command == FN_QLPC) {\n        pred_order = get_ur_golomb_shorten(&s->gb, LPCQSIZE);\n        if (pred_order > s->nwrap) {\n            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\\n",\n                   pred_order);\n            return AVERROR(EINVAL);\n        }\n        for (i = 0; i < pred_order; i++)\n            s->coeffs[i] = get_sr_golomb_shorten(&s->gb, LPCQUANT);\n        coeffs = s->coeffs;\n        qshift = LPCQUANT;\n    } else {\n        pred_order = command;\n        if (pred_order > FF_ARRAY_ELEMS(fixed_coeffs)) {\n            av_log(s->avctx, AV_LOG_ERROR, "invalid pred_order %d\\n",\n                   pred_order);\n            return AVERROR_INVALIDDATA;\n        }\n        coeffs     = fixed_coeffs[pred_order];\n        qshift     = 0;\n    }\n    if (command == FN_QLPC && coffset)\n        for (i = -pred_order; i < 0; i++)\n            s->decoded[channel][i] -= coffset;\n    init_sum = pred_order ? (command == FN_QLPC ? s->lpcqoffset : 0) : coffset;\n    for (i = 0; i < s->blocksize; i++) {\n        sum = init_sum;\n        for (j = 0; j < pred_order; j++)\n            sum += coeffs[j] * s->decoded[channel][i - j - 1];\n        s->decoded[channel][i] = get_sr_golomb_shorten(&s->gb, residual_size) +\n                                 (sum >> qshift);\n    }\n    if (command == FN_QLPC && coffset)\n        for (i = 0; i < s->blocksize; i++)\n            s->decoded[channel][i] += coffset;\n    return 0;\n}']