libavcodec/on2avc.c:181: error: Buffer Overrun L2
  Offset: [0, 128] Size: 128.

libavcodec/on2avc.c:141:1: <Offset trace>
139. // completely not like Table 18 in ISO/IEC 13818-7
140. // (no intensity stereo, different coding for the first coefficient)
141. static int on2avc_decode_band_scales(On2AVCContext *c, GetBitContext *gb)
     ^
142. {
143.     int w, w2, b, scale, first = 1;

libavcodec/on2avc.c:141:1: Parameter `(*c->scale_diff.table)[*]`
139. // completely not like Table 18 in ISO/IEC 13818-7
140. // (no intensity stereo, different coding for the first coefficient)
141. static int on2avc_decode_band_scales(On2AVCContext *c, GetBitContext *gb)
     ^
142. {
143.     int w, w2, b, scale, first = 1;

libavcodec/on2avc.c:174:26: Call
172.                 first = 0;
173.             } else {
174.                 scale += get_vlc2(gb, c->scale_diff.table, 9, 3) - 60;
                              ^
175.             }
176.             if (scale < 0 || scale > 128) {

libavcodec/get_bits.h:522:1: Parameter `(*table)[*]`
  520.  *                  = (max_vlc_length + bits - 1) / bits
  521.  */
  522. static av_always_inline int get_vlc2(GetBitContext *s, VLC_TYPE (*table)[2],
       ^
  523.                                      int bits, int max_depth)
  524. {

libavcodec/get_bits.h:530:5: Assignment
  528.     UPDATE_CACHE(re, s);
  529. 
  530.     GET_VLC(code, re, s, table, bits, max_depth);
           ^
  531. 
  532.     CLOSE_READER(re, s);

libavcodec/get_bits.h:534:5: Assignment
  532.     CLOSE_READER(re, s);
  533. 
  534.     return code;
           ^
  535. }
  536. 

libavcodec/on2avc.c:174:17: Assignment
172.                 first = 0;
173.             } else {
174.                 scale += get_vlc2(gb, c->scale_diff.table, 9, 3) - 60;
                     ^
175.             }
176.             if (scale < 0 || scale > 128) {

libavcodec/on2avc.c:141:1: <Length trace>
139. // completely not like Table 18 in ISO/IEC 13818-7
140. // (no intensity stereo, different coding for the first coefficient)
141. static int on2avc_decode_band_scales(On2AVCContext *c, GetBitContext *gb)
     ^
142. {
143.     int w, w2, b, scale, first = 1;

libavcodec/on2avc.c:141:1: Parameter `c->scale_tab[*]`
139. // completely not like Table 18 in ISO/IEC 13818-7
140. // (no intensity stereo, different coding for the first coefficient)
141. static int on2avc_decode_band_scales(On2AVCContext *c, GetBitContext *gb)
     ^
142. {
143.     int w, w2, b, scale, first = 1;

libavcodec/on2avc.c:181:42: Array access: Offset: [0, 128] Size: 128
179.                 return AVERROR_INVALIDDATA;
180.             }
181.             c->band_scales[band_off++] = c->scale_tab[scale];
                                              ^
182.         }
183.     }

static int on2avc_decode_band_scales(On2AVCContext *c, GetBitContext *gb)
{
    int w, w2, b, scale, first = 1;
    int band_off = 0;
    for (w = 0; w < c->num_windows; w++) {
        if (!c->grouping[w]) {
            memcpy(c->band_scales + band_off,
                   c->band_scales + band_off - c->num_bands,
                   c->num_bands * sizeof(*c->band_scales));
            band_off += c->num_bands;
            continue;
        }
        for (b = 0; b < c->num_bands; b++) {
            if (!c->band_type[band_off]) {
                int all_zero = 1;
                for (w2 = w + 1; w2 < c->num_windows; w2++) {
                    if (c->grouping[w2])
                        break;
                    if (c->band_type[w2 * c->num_bands + b]) {
                        all_zero = 0;
                        break;
                    }
                }
                if (all_zero) {
                    c->band_scales[band_off++] = 0;
                    continue;
                }
            }
            if (first) {
                scale = get_bits(gb, 7);
                first = 0;
            } else {
                scale += get_vlc2(gb, c->scale_diff.table, 9, 3) - 60;
            }
            if (scale < 0 || scale > 128) {
                av_log(c->avctx, AV_LOG_ERROR, "Invalid scale value %d\n",
                       scale);
                return AVERROR_INVALIDDATA;
            }
            c->band_scales[band_off++] = c->scale_tab[scale];
        }
    }
    return 0;
}
['static int on2avc_decode_band_scales(On2AVCContext *c, GetBitContext *gb)\n{\n    int w, w2, b, scale, first = 1;\n    int band_off = 0;\n    for (w = 0; w < c->num_windows; w++) {\n        if (!c->grouping[w]) {\n            memcpy(c->band_scales + band_off,\n                   c->band_scales + band_off - c->num_bands,\n                   c->num_bands * sizeof(*c->band_scales));\n            band_off += c->num_bands;\n            continue;\n        }\n        for (b = 0; b < c->num_bands; b++) {\n            if (!c->band_type[band_off]) {\n                int all_zero = 1;\n                for (w2 = w + 1; w2 < c->num_windows; w2++) {\n                    if (c->grouping[w2])\n                        break;\n                    if (c->band_type[w2 * c->num_bands + b]) {\n                        all_zero = 0;\n                        break;\n                    }\n                }\n                if (all_zero) {\n                    c->band_scales[band_off++] = 0;\n                    continue;\n                }\n            }\n            if (first) {\n                scale = get_bits(gb, 7);\n                first = 0;\n            } else {\n                scale += get_vlc2(gb, c->scale_diff.table, 9, 3) - 60;\n            }\n            if (scale < 0 || scale > 128) {\n                av_log(c->avctx, AV_LOG_ERROR, "Invalid scale value %d\\n",\n                       scale);\n                return AVERROR_INVALIDDATA;\n            }\n            c->band_scales[band_off++] = c->scale_tab[scale];\n        }\n    }\n    return 0;\n}', 'static av_always_inline int get_vlc2(GetBitContext *s, VLC_TYPE (*table)[2],\n                                     int bits, int max_depth)\n{\n    int code;\n    OPEN_READER(re, s);\n    UPDATE_CACHE(re, s);\n    GET_VLC(code, re, s, table, bits, max_depth);\n    CLOSE_READER(re, s);\n    return code;\n}']