libavcodec/g2meet.c:1504: error: Buffer Overrun L3
  Offset: [-1606004923, +oo] Size: 256 by call to `epic_jb_decode_tile`.

libavcodec/g2meet.c:1504:23: Call
1502.             switch (c->compression) {
1503.             case COMPR_EPIC_J_B:
1504.                 ret = epic_jb_decode_tile(c, c->tile_x, c->tile_y,
                            ^
1505.                                           buf + bytestream2_tell(&bc),
1506.                                           chunk_size - 2, avctx);

libavcodec/g2meet.c:873:1: Parameter `c->ec.unsigned_rung.avail_index`
  871. }
  872. 
  873. static int epic_jb_decode_tile(G2MContext *c, int tile_x, int tile_y,
       ^
  874.                                const uint8_t *src, size_t src_size,
  875.                                AVCodecContext *avctx)

libavcodec/g2meet.c:1504:23: Call
1502.             switch (c->compression) {
1503.             case COMPR_EPIC_J_B:
1504.                 ret = epic_jb_decode_tile(c, c->tile_x, c->tile_y,
                            ^
1505.                                           buf + bytestream2_tell(&bc),
1506.                                           chunk_size - 2, avctx);

libavcodec/g2meet.c:873:1: Parameter `c->ec.unsigned_rung.avail_index`
  871. }
  872. 
  873. static int epic_jb_decode_tile(G2MContext *c, int tile_x, int tile_y,
       ^
  874.                                const uint8_t *src, size_t src_size,
  875.                                AVCodecContext *avctx)

libavcodec/g2meet.c:922:16: Call
  920. 
  921.         /* decode transparent pixel value */
  922.         tr_r = ff_els_decode_unsigned(&c->ec.els_ctx, &c->ec.unsigned_rung);
                      ^
  923.         tr_g = ff_els_decode_unsigned(&c->ec.els_ctx, &c->ec.unsigned_rung);
  924.         tr_b = ff_els_decode_unsigned(&c->ec.els_ctx, &c->ec.unsigned_rung);

libavcodec/elsdec.c:350:1: <Offset trace>
348. }
349. 
350. unsigned ff_els_decode_unsigned(ElsDecCtx *ctx, ElsUnsignedRung *ur)
     ^
351. {
352.     int i, n, r, bit;

libavcodec/elsdec.c:350:1: Parameter `ur->rem_rung_list->next_index`
    348. }
    349. 
    350. unsigned ff_els_decode_unsigned(ElsDecCtx *ctx, ElsUnsignedRung *ur)
         ^
    351. {
    352.     int i, n, r, bit;

libavcodec/elsdec.c:350:1: <Length trace>
348. }
349. 
350. unsigned ff_els_decode_unsigned(ElsDecCtx *ctx, ElsUnsignedRung *ur)
     ^
351. {
352.     int i, n, r, bit;

libavcodec/elsdec.c:350:1: Parameter `*ur->rem_rung_list`
    348. }
    349. 
    350. unsigned ff_els_decode_unsigned(ElsDecCtx *ctx, ElsUnsignedRung *ur)
         ^
    351. {
    352.     int i, n, r, bit;

libavcodec/elsdec.c:411:13: Array access: Offset: [-1606004923, +oo] Size: 256 by call to `epic_jb_decode_tile` 
    409.                 ur->avail_index      += 2;
    410.             }
    411.             rung_node = &ur->rem_rung_list[rung_node->next_index + bit];
                     ^
    412.         }
    413. 

unsigned ff_els_decode_unsigned(ElsDecCtx *ctx, ElsUnsignedRung *ur)
{
    int i, n, r, bit;
    ElsRungNode *rung_node;
    if (ctx->err)
        return 0;
    for (n = 0; n < ELS_EXPGOLOMB_LEN + 1; n++)
        if (ff_els_decode_bit(ctx, &ur->prefix_rung[n]))
            break;
    if (ctx->err || n >= ELS_EXPGOLOMB_LEN) {
        ctx->err = AVERROR(EOVERFLOW);
        return 0;
    }
    if (!n)
        return 0;
    if (!ur->rem_rung_list) {
        ur->rem_rung_list = av_realloc(NULL, RUNG_SPACE);
        if (!ur->rem_rung_list) {
            ctx->err = AVERROR(ENOMEM);
            return 0;
        }
        memset(ur->rem_rung_list, 0, RUNG_SPACE);
        ur->rung_list_size = RUNG_SPACE;
        ur->avail_index    = ELS_EXPGOLOMB_LEN;
    }
    for (i = 0, r = 0, bit = 0; i < n; i++) {
        if (!i)
            rung_node = &ur->rem_rung_list[n];
        else {
            if (!rung_node->next_index) {
                if (ur->rung_list_size <= (ur->avail_index + 2) * sizeof(ElsRungNode)) {
                    ptrdiff_t pos     = rung_node - ur->rem_rung_list;
                    ur->rem_rung_list = av_realloc(ur->rem_rung_list,
                                                   ur->rung_list_size +
                                                   RUNG_SPACE);
                    if (!ur->rem_rung_list) {
                        av_free(ur->rem_rung_list);
                        ctx->err = AVERROR(ENOMEM);
                        return 0;
                    }
                    memset((uint8_t *) ur->rem_rung_list + ur->rung_list_size, 0,
                           RUNG_SPACE);
                    ur->rung_list_size += RUNG_SPACE;
                    rung_node = &ur->rem_rung_list[pos];
                }
                rung_node->next_index = ur->avail_index;
                ur->avail_index      += 2;
            }
            rung_node = &ur->rem_rung_list[rung_node->next_index + bit];
        }
        bit = ff_els_decode_bit(ctx, &rung_node->rung);
        if (ctx->err)
            return bit;
        r = (r << 1) + bit;
    }
    return (1 << n) - 1 + r;
}
['static int g2m_decode_frame(AVCodecContext *avctx, void *data,\n                            int *got_picture_ptr, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    G2MContext *c = avctx->priv_data;\n    AVFrame *pic = data;\n    GetByteContext bc, tbc;\n    int magic;\n    int got_header = 0;\n    uint32_t chunk_size, r_mask, g_mask, b_mask;\n    int chunk_type, chunk_start;\n    int i;\n    int ret;\n    if (buf_size < 12) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Frame should have at least 12 bytes, got %d instead\\n",\n               buf_size);\n        return AVERROR_INVALIDDATA;\n    }\n    bytestream2_init(&bc, buf, buf_size);\n    magic = bytestream2_get_be32(&bc);\n    if ((magic & ~0xF) != MKBETAG(\'G\', \'2\', \'M\', \'0\') ||\n        (magic & 0xF) < 2 || (magic & 0xF) > 5) {\n        av_log(avctx, AV_LOG_ERROR, "Wrong magic %08X\\n", magic);\n        return AVERROR_INVALIDDATA;\n    }\n    c->swapuv = magic == MKBETAG(\'G\', \'2\', \'M\', \'2\');\n    while (bytestream2_get_bytes_left(&bc) > 5) {\n        chunk_size  = bytestream2_get_le32(&bc) - 1;\n        chunk_type  = bytestream2_get_byte(&bc);\n        chunk_start = bytestream2_tell(&bc);\n        if (chunk_size > bytestream2_get_bytes_left(&bc)) {\n            av_log(avctx, AV_LOG_ERROR, "Invalid chunk size %"PRIu32" type %02X\\n",\n                   chunk_size, chunk_type);\n            break;\n        }\n        switch (chunk_type) {\n        case DISPLAY_INFO:\n            c->got_header = 0;\n            if (chunk_size < 21) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid display info size %"PRIu32"\\n",\n                       chunk_size);\n                break;\n            }\n            c->width  = bytestream2_get_be32(&bc);\n            c->height = bytestream2_get_be32(&bc);\n            if (c->width  < 16 || c->width  > c->orig_width ||\n                c->height < 16 || c->height > c->orig_height) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Invalid frame dimensions %dx%d\\n",\n                       c->width, c->height);\n                ret = AVERROR_INVALIDDATA;\n                goto header_fail;\n            }\n            if (c->width != avctx->width || c->height != avctx->height) {\n                ret = ff_set_dimensions(avctx, c->width, c->height);\n                if (ret < 0)\n                    return ret;\n            }\n            c->compression = bytestream2_get_be32(&bc);\n            if (c->compression != 2 && c->compression != 3) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Unknown compression method %d\\n",\n                       c->compression);\n                return AVERROR_PATCHWELCOME;\n            }\n            c->tile_width  = bytestream2_get_be32(&bc);\n            c->tile_height = bytestream2_get_be32(&bc);\n            if (!c->tile_width || !c->tile_height ||\n                ((c->tile_width | c->tile_height) & 0xF)) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Invalid tile dimensions %dx%d\\n",\n                       c->tile_width, c->tile_height);\n                ret = AVERROR_INVALIDDATA;\n                goto header_fail;\n            }\n            c->tiles_x = (c->width  + c->tile_width  - 1) / c->tile_width;\n            c->tiles_y = (c->height + c->tile_height - 1) / c->tile_height;\n            c->bpp     = bytestream2_get_byte(&bc);\n            if (c->bpp == 32) {\n                if (bytestream2_get_bytes_left(&bc) < 16 ||\n                    (chunk_size - 21) < 16) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "Display info: missing bitmasks!\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                r_mask = bytestream2_get_be32(&bc);\n                g_mask = bytestream2_get_be32(&bc);\n                b_mask = bytestream2_get_be32(&bc);\n                if (r_mask != 0xFF0000 || g_mask != 0xFF00 || b_mask != 0xFF) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "Invalid or unsupported bitmasks: R=%"PRIX32", G=%"PRIX32", B=%"PRIX32"\\n",\n                           r_mask, g_mask, b_mask);\n                    return AVERROR_PATCHWELCOME;\n                }\n            } else {\n                avpriv_request_sample(avctx, "bpp=%d", c->bpp);\n                return AVERROR_PATCHWELCOME;\n            }\n            if (g2m_init_buffers(c)) {\n                ret = AVERROR(ENOMEM);\n                goto header_fail;\n            }\n            got_header = 1;\n            break;\n        case TILE_DATA:\n            if (!c->tiles_x || !c->tiles_y) {\n                av_log(avctx, AV_LOG_WARNING,\n                       "No display info - skipping tile\\n");\n                break;\n            }\n            if (chunk_size < 2) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid tile data size %"PRIu32"\\n",\n                       chunk_size);\n                break;\n            }\n            c->tile_x = bytestream2_get_byte(&bc);\n            c->tile_y = bytestream2_get_byte(&bc);\n            if (c->tile_x >= c->tiles_x || c->tile_y >= c->tiles_y) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Invalid tile pos %d,%d (in %dx%d grid)\\n",\n                       c->tile_x, c->tile_y, c->tiles_x, c->tiles_y);\n                break;\n            }\n            ret = 0;\n            switch (c->compression) {\n            case COMPR_EPIC_J_B:\n                ret = epic_jb_decode_tile(c, c->tile_x, c->tile_y,\n                                          buf + bytestream2_tell(&bc),\n                                          chunk_size - 2, avctx);\n                break;\n            case COMPR_KEMPF_J_B:\n                ret = kempf_decode_tile(c, c->tile_x, c->tile_y,\n                                        buf + bytestream2_tell(&bc),\n                                        chunk_size - 2);\n                break;\n            }\n            if (ret && c->framebuf)\n                av_log(avctx, AV_LOG_ERROR, "Error decoding tile %d,%d\\n",\n                       c->tile_x, c->tile_y);\n            break;\n        case CURSOR_POS:\n            if (chunk_size < 5) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid cursor pos size %"PRIu32"\\n",\n                       chunk_size);\n                break;\n            }\n            c->cursor_x = bytestream2_get_be16(&bc);\n            c->cursor_y = bytestream2_get_be16(&bc);\n            break;\n        case CURSOR_SHAPE:\n            if (chunk_size < 8) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid cursor data size %"PRIu32"\\n",\n                       chunk_size);\n                break;\n            }\n            bytestream2_init(&tbc, buf + bytestream2_tell(&bc),\n                             chunk_size - 4);\n            g2m_load_cursor(avctx, c, &tbc);\n            break;\n        case CHUNK_CC:\n        case CHUNK_CD:\n            break;\n        default:\n            av_log(avctx, AV_LOG_WARNING, "Skipping chunk type %02d\\n",\n                   chunk_type);\n        }\n        bytestream2_skip(&bc, chunk_start + chunk_size - bytestream2_tell(&bc));\n    }\n    if (got_header)\n        c->got_header = 1;\n    if (c->width && c->height) {\n        if ((ret = ff_get_buffer(avctx, pic, 0)) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n            return ret;\n        }\n        pic->key_frame = got_header;\n        pic->pict_type = got_header ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;\n        for (i = 0; i < avctx->height; i++)\n            memcpy(pic->data[0] + i * pic->linesize[0],\n                   c->framebuf + i * c->framebuf_stride,\n                   c->width * 3);\n        g2m_paint_cursor(c, pic->data[0], pic->linesize[0]);\n        *got_picture_ptr = 1;\n    }\n    return buf_size;\nheader_fail:\n    c->width   =\n    c->height  = 0;\n    c->tiles_x =\n    c->tiles_y = 0;\n    return ret;\n}', 'static int epic_jb_decode_tile(G2MContext *c, int tile_x, int tile_y,\n                               const uint8_t *src, size_t src_size,\n                               AVCodecContext *avctx)\n{\n    uint8_t prefix, mask = 0x80;\n    int extrabytes, tile_width, tile_height, awidth, aheight;\n    size_t els_dsize;\n    uint8_t *dst;\n    if (!src_size)\n        return 0;\n    prefix = *src++;\n    src_size--;\n    for (extrabytes = 0; (prefix & mask) && (extrabytes < 7); extrabytes++)\n        mask >>= 1;\n    if (extrabytes > 3 || src_size < extrabytes) {\n        av_log(avctx, AV_LOG_ERROR, "ePIC: invalid data size VLI\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    els_dsize = prefix & ((0x80 >> extrabytes) - 1);\n    while (extrabytes-- > 0) {\n        els_dsize = (els_dsize << 8) | *src++;\n        src_size--;\n    }\n    if (src_size < els_dsize) {\n        av_log(avctx, AV_LOG_ERROR, "ePIC: data too short, needed %zu, got %zu\\n",\n               els_dsize, src_size);\n        return AVERROR_INVALIDDATA;\n    }\n    tile_width  = FFMIN(c->width  - tile_x * c->tile_width,  c->tile_width);\n    tile_height = FFMIN(c->height - tile_y * c->tile_height, c->tile_height);\n    awidth      = FFALIGN(tile_width,  16);\n    aheight     = FFALIGN(tile_height, 16);\n    if (els_dsize) {\n        int ret, i, j, k;\n        uint8_t tr_r, tr_g, tr_b, *buf;\n        uint32_t *in;\n        memset(&c->ec, 0, sizeof(c->ec));\n        ff_els_decoder_init(&c->ec.els_ctx, src, els_dsize);\n        epic_hash_init(&c->ec.hash);\n        tr_r = ff_els_decode_unsigned(&c->ec.els_ctx, &c->ec.unsigned_rung);\n        tr_g = ff_els_decode_unsigned(&c->ec.els_ctx, &c->ec.unsigned_rung);\n        tr_b = ff_els_decode_unsigned(&c->ec.els_ctx, &c->ec.unsigned_rung);\n        if (c->ec.els_ctx.err != 0) {\n            av_log(avctx, AV_LOG_ERROR,\n                   "ePIC: couldn\'t decode transparency pixel!\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        ret = epic_decode_tile(&c->ec, c->epic_buf, tile_height, tile_width,\n                               c->epic_buf_stride);\n        epic_free_pixel_cache(&c->ec.hash);\n        ff_els_decoder_uninit(&c->ec.unsigned_rung);\n        if (ret) {\n            av_log(avctx, AV_LOG_ERROR,\n                   "ePIC: tile decoding failed, frame=%d, tile_x=%d, tile_y=%d\\n",\n                   avctx->frame_number, tile_x, tile_y);\n            return AVERROR_INVALIDDATA;\n        }\n        buf = c->epic_buf;\n        dst = c->framebuf + tile_x * c->tile_width * 3 +\n              tile_y * c->tile_height * c->framebuf_stride;\n        for (j = 0; j < tile_height; j++) {\n            uint8_t *out = dst;\n            in  = (uint32_t *) buf;\n            for (i = 0; i < tile_width; i++) {\n                out[0] = (in[i] >> R_shift) & 0xFF;\n                out[1] = (in[i] >> G_shift) & 0xFF;\n                out[2] = (in[i] >> B_shift) & 0xFF;\n                out   += 3;\n            }\n            buf += c->epic_buf_stride;\n            dst += c->framebuf_stride;\n        }\n        if (src_size > els_dsize) {\n            uint8_t *jpg;\n            uint32_t tr;\n            int bstride = FFALIGN(tile_width, 16) >> 3;\n            int nblocks = 0;\n            int estride = c->epic_buf_stride >> 2;\n            src      += els_dsize;\n            src_size -= els_dsize;\n            in = (uint32_t *) c->epic_buf;\n            tr = (tr_r << R_shift) | (tr_g << G_shift) | (tr_b << B_shift);\n            memset(c->kempf_flags, 0,\n                   (aheight >> 3) * bstride * sizeof(*c->kempf_flags));\n            for (j = 0; j < tile_height; j += 8) {\n                for (i = 0; i < tile_width; i += 8) {\n                    c->kempf_flags[(i >> 3) + (j >> 3) * bstride] = 0;\n                    for (k = 0; k < 8 * 8; k++) {\n                        if (in[i + (k & 7) + (k >> 3) * estride] == tr) {\n                            c->kempf_flags[(i >> 3) + (j >> 3) * bstride] = 1;\n                            nblocks++;\n                            break;\n                        }\n                    }\n                }\n                in += 8 * estride;\n            }\n            memset(c->jpeg_tile, 0, c->tile_stride * aheight);\n            jpg_decode_data(&c->jc, awidth, aheight, src, src_size,\n                            c->jpeg_tile, c->tile_stride,\n                            c->kempf_flags, bstride, nblocks, c->swapuv);\n            in  = (uint32_t *) c->epic_buf;\n            dst = c->framebuf + tile_x * c->tile_width * 3 +\n                  tile_y * c->tile_height * c->framebuf_stride;\n            jpg = c->jpeg_tile;\n            for (j = 0; j < tile_height; j++) {\n                for (i = 0; i < tile_width; i++)\n                    if (in[i] == tr)\n                        memcpy(dst + i * 3, jpg + i * 3, 3);\n                in  += c->epic_buf_stride >> 2;\n                dst += c->framebuf_stride;\n                jpg += c->tile_stride;\n            }\n        }\n    } else {\n        dst = c->framebuf + tile_x * c->tile_width * 3 +\n              tile_y * c->tile_height * c->framebuf_stride;\n        return jpg_decode_data(&c->jc, tile_width, tile_height, src, src_size,\n                               dst, c->framebuf_stride, NULL, 0, 0, c->swapuv);\n    }\n    return 0;\n}', 'unsigned ff_els_decode_unsigned(ElsDecCtx *ctx, ElsUnsignedRung *ur)\n{\n    int i, n, r, bit;\n    ElsRungNode *rung_node;\n    if (ctx->err)\n        return 0;\n    for (n = 0; n < ELS_EXPGOLOMB_LEN + 1; n++)\n        if (ff_els_decode_bit(ctx, &ur->prefix_rung[n]))\n            break;\n    if (ctx->err || n >= ELS_EXPGOLOMB_LEN) {\n        ctx->err = AVERROR(EOVERFLOW);\n        return 0;\n    }\n    if (!n)\n        return 0;\n    if (!ur->rem_rung_list) {\n        ur->rem_rung_list = av_realloc(NULL, RUNG_SPACE);\n        if (!ur->rem_rung_list) {\n            ctx->err = AVERROR(ENOMEM);\n            return 0;\n        }\n        memset(ur->rem_rung_list, 0, RUNG_SPACE);\n        ur->rung_list_size = RUNG_SPACE;\n        ur->avail_index    = ELS_EXPGOLOMB_LEN;\n    }\n    for (i = 0, r = 0, bit = 0; i < n; i++) {\n        if (!i)\n            rung_node = &ur->rem_rung_list[n];\n        else {\n            if (!rung_node->next_index) {\n                if (ur->rung_list_size <= (ur->avail_index + 2) * sizeof(ElsRungNode)) {\n                    ptrdiff_t pos     = rung_node - ur->rem_rung_list;\n                    ur->rem_rung_list = av_realloc(ur->rem_rung_list,\n                                                   ur->rung_list_size +\n                                                   RUNG_SPACE);\n                    if (!ur->rem_rung_list) {\n                        av_free(ur->rem_rung_list);\n                        ctx->err = AVERROR(ENOMEM);\n                        return 0;\n                    }\n                    memset((uint8_t *) ur->rem_rung_list + ur->rung_list_size, 0,\n                           RUNG_SPACE);\n                    ur->rung_list_size += RUNG_SPACE;\n                    rung_node = &ur->rem_rung_list[pos];\n                }\n                rung_node->next_index = ur->avail_index;\n                ur->avail_index      += 2;\n            }\n            rung_node = &ur->rem_rung_list[rung_node->next_index + bit];\n        }\n        bit = ff_els_decode_bit(ctx, &rung_node->rung);\n        if (ctx->err)\n            return bit;\n        r = (r << 1) + bit;\n    }\n    return (1 << n) - 1 + r;\n}']