libavcodec/h264.c:4253: error: Buffer Overrun L1
  Offset: 510 Size: 3 by call to `ff_h264_init_cabac_states`.

libavcodec/h264.c:4249:9: Call
4247. 
4248.         /* init cabac */
4249.         ff_init_cabac_decoder(&h->cabac,
              ^
4250.                               h->gb.buffer + get_bits_count(&h->gb) / 8,
4251.                               (get_bits_left(&h->gb) + 7) / 8);

libavcodec/cabac.c:134:5: Assignment
  132. #endif
  133.     c->low+= ((*c->bytestream++)<<2) + 2;
  134.     c->range= 0x1FE;
           ^
  135. }
  136. 

libavcodec/h264.c:4253:9: Call
4251.                               (get_bits_left(&h->gb) + 7) / 8);
4252. 
4253.         ff_h264_init_cabac_states(h);
              ^
4254. 
4255.         for (;;) {

libavcodec/h264_cabac.c:1261:1: <Offset trace>
1259. };
1260. 
1261. void ff_h264_init_cabac_states(H264Context *h) {
      ^
1262.     int i;
1263.     const int8_t (*tab)[2];

libavcodec/h264_cabac.c:1261:1: Parameter `h->cabac_init_idc`
  1259. };
  1260. 
  1261. void ff_h264_init_cabac_states(H264Context *h) {
        ^
  1262.     int i;
  1263.     const int8_t (*tab)[2];

libavcodec/h264_cabac.c:361:1: <Length trace>
359. };
360. 
361. static const int8_t cabac_context_init_PB[3][1024][2] =
     ^
362. {
363.     /* i_cabac_init_idc == 0 */

libavcodec/h264_cabac.c:361:1: Array declaration
  359. };
  360. 
  361. static const int8_t cabac_context_init_PB[3][1024][2] =
       ^
  362. {
  363.     /* i_cabac_init_idc == 0 */

libavcodec/h264_cabac.c:1267:42: Array access: Offset: 510 Size: 3 by call to `ff_h264_init_cabac_states` 
  1265. 
  1266.     if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;
  1267.     else                                 tab = cabac_context_init_PB[h->cabac_init_idc];
                                                 ^
  1268. 
  1269.     /* calculate pre-state */

void ff_h264_init_cabac_states(H264Context *h) {
    int i;
    const int8_t (*tab)[2];
    const int slice_qp = av_clip(h->qscale - 6*(h->sps.bit_depth_luma-8), 0, 51);
    if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;
    else                                 tab = cabac_context_init_PB[h->cabac_init_idc];
    for( i= 0; i < 1024; i++ ) {
        int pre = 2*(((tab[i][0] * slice_qp) >>4 ) + tab[i][1]) - 127;
        pre^= pre>>31;
        if(pre > 124)
            pre= 124 + (pre&1);
        h->cabac_state[i] =  pre;
    }
}
['static int decode_slice(struct AVCodecContext *avctx, void *arg)\n{\n    H264Context *h = *(void **)arg;\n    int lf_x_start = h->mb_x;\n    h->mb_skip_run = -1;\n    h->is_complex = FRAME_MBAFF(h) || h->picture_structure != PICT_FRAME ||\n                    avctx->codec_id != AV_CODEC_ID_H264 ||\n                    (CONFIG_GRAY && (h->flags & CODEC_FLAG_GRAY));\n    if (h->pps.cabac) {\n        align_get_bits(&h->gb);\n        ff_init_cabac_decoder(&h->cabac,\n                              h->gb.buffer + get_bits_count(&h->gb) / 8,\n                              (get_bits_left(&h->gb) + 7) / 8);\n        ff_h264_init_cabac_states(h);\n        for (;;) {\n            int ret = ff_h264_decode_mb_cabac(h);\n            int eos;\n            if (ret >= 0)\n                ff_h264_hl_decode_mb(h);\n            if (ret >= 0 && FRAME_MBAFF(h)) {\n                h->mb_y++;\n                ret = ff_h264_decode_mb_cabac(h);\n                if (ret >= 0)\n                    ff_h264_hl_decode_mb(h);\n                h->mb_y--;\n            }\n            eos = get_cabac_terminate(&h->cabac);\n            if ((h->workaround_bugs & FF_BUG_TRUNCATED) &&\n                h->cabac.bytestream > h->cabac.bytestream_end + 2) {\n                er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x - 1,\n                             h->mb_y, ER_MB_END);\n                if (h->mb_x >= lf_x_start)\n                    loop_filter(h, lf_x_start, h->mb_x + 1);\n                return 0;\n            }\n            if (ret < 0 || h->cabac.bytestream > h->cabac.bytestream_end + 2) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "error while decoding MB %d %d, bytestream (%td)\\n",\n                       h->mb_x, h->mb_y,\n                       h->cabac.bytestream_end - h->cabac.bytestream);\n                er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x,\n                             h->mb_y, ER_MB_ERROR);\n                return AVERROR_INVALIDDATA;\n            }\n            if (++h->mb_x >= h->mb_width) {\n                loop_filter(h, lf_x_start, h->mb_x);\n                h->mb_x = lf_x_start = 0;\n                decode_finish_row(h);\n                ++h->mb_y;\n                if (FIELD_OR_MBAFF_PICTURE(h)) {\n                    ++h->mb_y;\n                    if (FRAME_MBAFF(h) && h->mb_y < h->mb_height)\n                        predict_field_decoding_flag(h);\n                }\n            }\n            if (eos || h->mb_y >= h->mb_height) {\n                tprintf(h->avctx, "slice end %d %d\\n",\n                        get_bits_count(&h->gb), h->gb.size_in_bits);\n                er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x - 1,\n                             h->mb_y, ER_MB_END);\n                if (h->mb_x > lf_x_start)\n                    loop_filter(h, lf_x_start, h->mb_x);\n                return 0;\n            }\n        }\n    } else {\n        for (;;) {\n            int ret = ff_h264_decode_mb_cavlc(h);\n            if (ret >= 0)\n                ff_h264_hl_decode_mb(h);\n            if (ret >= 0 && FRAME_MBAFF(h)) {\n                h->mb_y++;\n                ret = ff_h264_decode_mb_cavlc(h);\n                if (ret >= 0)\n                    ff_h264_hl_decode_mb(h);\n                h->mb_y--;\n            }\n            if (ret < 0) {\n                av_log(h->avctx, AV_LOG_ERROR,\n                       "error while decoding MB %d %d\\n", h->mb_x, h->mb_y);\n                er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x,\n                             h->mb_y, ER_MB_ERROR);\n                return ret;\n            }\n            if (++h->mb_x >= h->mb_width) {\n                loop_filter(h, lf_x_start, h->mb_x);\n                h->mb_x = lf_x_start = 0;\n                decode_finish_row(h);\n                ++h->mb_y;\n                if (FIELD_OR_MBAFF_PICTURE(h)) {\n                    ++h->mb_y;\n                    if (FRAME_MBAFF(h) && h->mb_y < h->mb_height)\n                        predict_field_decoding_flag(h);\n                }\n                if (h->mb_y >= h->mb_height) {\n                    tprintf(h->avctx, "slice end %d %d\\n",\n                            get_bits_count(&h->gb), h->gb.size_in_bits);\n                    if (get_bits_left(&h->gb) == 0) {\n                        er_add_slice(h, h->resync_mb_x, h->resync_mb_y,\n                                     h->mb_x - 1, h->mb_y,\n                                     ER_MB_END);\n                        return 0;\n                    } else {\n                        er_add_slice(h, h->resync_mb_x, h->resync_mb_y,\n                                     h->mb_x - 1, h->mb_y,\n                                     ER_MB_END);\n                        return AVERROR_INVALIDDATA;\n                    }\n                }\n            }\n            if (get_bits_left(&h->gb) <= 0 && h->mb_skip_run <= 0) {\n                tprintf(h->avctx, "slice end %d %d\\n",\n                        get_bits_count(&h->gb), h->gb.size_in_bits);\n                if (get_bits_left(&h->gb) == 0) {\n                    er_add_slice(h, h->resync_mb_x, h->resync_mb_y,\n                                 h->mb_x - 1, h->mb_y,\n                                 ER_MB_END);\n                    if (h->mb_x > lf_x_start)\n                        loop_filter(h, lf_x_start, h->mb_x);\n                    return 0;\n                } else {\n                    er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x,\n                                 h->mb_y, ER_MB_ERROR);\n                    return AVERROR_INVALIDDATA;\n                }\n            }\n        }\n    }\n}', 'void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){\n    c->bytestream_start=\n    c->bytestream= buf;\n    c->bytestream_end= buf + buf_size;\n#if CABAC_BITS == 16\n    c->low =  (*c->bytestream++)<<18;\n    c->low+=  (*c->bytestream++)<<10;\n#else\n    c->low =  (*c->bytestream++)<<10;\n#endif\n    c->low+= ((*c->bytestream++)<<2) + 2;\n    c->range= 0x1FE;\n}', 'void ff_h264_init_cabac_states(H264Context *h) {\n    int i;\n    const int8_t (*tab)[2];\n    const int slice_qp = av_clip(h->qscale - 6*(h->sps.bit_depth_luma-8), 0, 51);\n    if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;\n    else                                 tab = cabac_context_init_PB[h->cabac_init_idc];\n    for( i= 0; i < 1024; i++ ) {\n        int pre = 2*(((tab[i][0] * slice_qp) >>4 ) + tab[i][1]) - 127;\n        pre^= pre>>31;\n        if(pre > 124)\n            pre= 124 + (pre&1);\n        h->cabac_state[i] =  pre;\n    }\n}']