libavcodec/cook.c:994: error: Buffer Overrun L1
  Offset: [-oo, -1] Size: 256 by call to `decode_subpacket`.

libavcodec/cook.c:956:5: Assignment
954.     int i, ret;
955.     int offset = 0;
956.     int chidx = 0;
         ^
957. 
958.     if (buf_size < avctx->block_align)

libavcodec/cook.c:988:9: Assignment
986.         q->subpacket[i].bits_per_subpacket = (q->subpacket[i].size * 8) >>
987.                                               q->subpacket[i].bits_per_subpdiv;
988.         q->subpacket[i].ch_idx = chidx;
             ^
989.         av_log(avctx, AV_LOG_DEBUG,
990.                "subpacket[%i] size %i js %i %i block_align %i\n",

libavcodec/cook.c:994:20: Call
992.                avctx->block_align);
993. 
994.         if ((ret = decode_subpacket(q, &q->subpacket[i], buf + offset, samples)) < 0)
                        ^
995.             return ret;
996.         offset += q->subpacket[i].size;

libavcodec/cook.c:906:1: Parameter `p->numvector_size`
  904.  * @param outbuffer         pointer to the outbuffer
  905.  */
  906. static int decode_subpacket(COOKContext *q, COOKSubpacket *p,
       ^
  907.                             const uint8_t *inbuffer, float **outbuffer)
  908. {

libavcodec/cook.c:919:20: Call
  917.             return res;
  918.     } else {
  919.         if ((res = mono_decode(q, p, q->decode_buffer_1)) < 0)
                          ^
  920.             return res;
  921. 

libavcodec/cook.c:631:1: Parameter `p->numvector_size`
    629. 
    630. 
    631. static int mono_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer)
         ^
    632. {
    633.     int category_index[128] = { 0 };

libavcodec/cook.c:641:5: Call
    639.         return res;
    640.     q->num_vectors = get_bits(&q->gb, p->log2_numvector_size);
    641.     categorize(q, p, quant_index_table, category, category_index);
             ^
    642.     expand_category(q, category, category_index);
    643.     decode_vectors(q, p, category, quant_index_table, mlt_buffer);

libavcodec/cook.c:403:1: <Offset trace>
401.  * @param category_index        pointer to the category_index array
402.  */
403. static void categorize(COOKContext *q, COOKSubpacket *p, int *quant_index_table,
     ^
404.                        int *category, int *category_index)
405. {

libavcodec/cook.c:403:1: Parameter `p->numvector_size`
      401.  * @param category_index        pointer to the category_index array
      402.  */
      403. static void categorize(COOKContext *q, COOKSubpacket *p, int *quant_index_table,
           ^
      404.                        int *category, int *category_index)
      405. {

libavcodec/cook.c:412:5: Assignment
      410.     int tmp_categorize_array[128 * 2] = { 0 };
      411.     int tmp_categorize_array1_idx = p->numvector_size;
      412.     int tmp_categorize_array2_idx = p->numvector_size;
               ^
      413. 
      414.     bits_left = p->bits_per_subpacket - get_bits_count(&q->gb);

libavcodec/cook.c:403:1: <Length trace>
401.  * @param category_index        pointer to the category_index array
402.  */
403. static void categorize(COOKContext *q, COOKSubpacket *p, int *quant_index_table,
     ^
404.                        int *category, int *category_index)
405. {

libavcodec/cook.c:403:1: Array declaration
      401.  * @param category_index        pointer to the category_index array
      402.  */
      403. static void categorize(COOKContext *q, COOKSubpacket *p, int *quant_index_table,
           ^
      404.                        int *category, int *category_index)
      405. {

libavcodec/cook.c:478:13: Array access: Offset: [-oo, -1] Size: 256 by call to `decode_subpacket` 
      476.             if (index == -1)
      477.                 break;
      478.             tmp_categorize_array[--tmp_categorize_array2_idx] = index;
                       ^
      479.             tmpbias2 -= expbits_tab[exp_index2[index]] -
      480.                         expbits_tab[exp_index2[index] - 1];

static void categorize(COOKContext *q, COOKSubpacket *p, int *quant_index_table,
                       int *category, int *category_index)
{
    int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;
    int exp_index2[102] = { 0 };
    int exp_index1[102] = { 0 };
    int tmp_categorize_array[128 * 2] = { 0 };
    int tmp_categorize_array1_idx = p->numvector_size;
    int tmp_categorize_array2_idx = p->numvector_size;
    bits_left = p->bits_per_subpacket - get_bits_count(&q->gb);
    if (bits_left > q->samples_per_channel)
        bits_left = q->samples_per_channel +
                    ((bits_left - q->samples_per_channel) * 5) / 8;
    bias = -32;
    for (i = 32; i > 0; i = i / 2) {
        num_bits = 0;
        index    = 0;
        for (j = p->total_subbands; j > 0; j--) {
            exp_idx = av_clip((i - quant_index_table[index] + bias) / 2, 0, 7);
            index++;
            num_bits += expbits_tab[exp_idx];
        }
        if (num_bits >= bits_left - 32)
            bias += i;
    }
    num_bits = 0;
    for (i = 0; i < p->total_subbands; i++) {
        exp_idx = av_clip((bias - quant_index_table[i]) / 2, 0, 7);
        num_bits += expbits_tab[exp_idx];
        exp_index1[i] = exp_idx;
        exp_index2[i] = exp_idx;
    }
    tmpbias1 = tmpbias2 = num_bits;
    for (j = 1; j < p->numvector_size; j++) {
        if (tmpbias1 + tmpbias2 > 2 * bits_left) {
            int max = -999999;
            index = -1;
            for (i = 0; i < p->total_subbands; i++) {
                if (exp_index1[i] < 7) {
                    v = (-2 * exp_index1[i]) - quant_index_table[i] + bias;
                    if (v >= max) {
                        max   = v;
                        index = i;
                    }
                }
            }
            if (index == -1)
                break;
            tmp_categorize_array[tmp_categorize_array1_idx++] = index;
            tmpbias1 -= expbits_tab[exp_index1[index]] -
                        expbits_tab[exp_index1[index] + 1];
            ++exp_index1[index];
        } else {
            int min = 999999;
            index = -1;
            for (i = 0; i < p->total_subbands; i++) {
                if (exp_index2[i] > 0) {
                    v = (-2 * exp_index2[i]) - quant_index_table[i] + bias;
                    if (v < min) {
                        min   = v;
                        index = i;
                    }
                }
            }
            if (index == -1)
                break;
            tmp_categorize_array[--tmp_categorize_array2_idx] = index;
            tmpbias2 -= expbits_tab[exp_index2[index]] -
                        expbits_tab[exp_index2[index] - 1];
            --exp_index2[index];
        }
    }
    for (i = 0; i < p->total_subbands; i++)
        category[i] = exp_index2[i];
    for (i = 0; i < p->numvector_size - 1; i++)
        category_index[i] = tmp_categorize_array[tmp_categorize_array2_idx++];
}
['static int cook_decode_frame(AVCodecContext *avctx, void *data,\n                             int *got_frame_ptr, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    COOKContext *q = avctx->priv_data;\n    float **samples = NULL;\n    int i, ret;\n    int offset = 0;\n    int chidx = 0;\n    if (buf_size < avctx->block_align)\n        return buf_size;\n    if (q->discarded_packets >= 2) {\n        q->frame.nb_samples = q->samples_per_channel;\n        if ((ret = avctx->get_buffer(avctx, &q->frame)) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n            return ret;\n        }\n        samples = (float **)q->frame.extended_data;\n    }\n    q->subpacket[0].size = avctx->block_align;\n    for (i = 1; i < q->num_subpackets; i++) {\n        q->subpacket[i].size = 2 * buf[avctx->block_align - q->num_subpackets + i];\n        q->subpacket[0].size -= q->subpacket[i].size + 1;\n        if (q->subpacket[0].size < 0) {\n            av_log(avctx, AV_LOG_DEBUG,\n                   "frame subpacket size total > avctx->block_align!\\n");\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    for (i = 0; i < q->num_subpackets; i++) {\n        q->subpacket[i].bits_per_subpacket = (q->subpacket[i].size * 8) >>\n                                              q->subpacket[i].bits_per_subpdiv;\n        q->subpacket[i].ch_idx = chidx;\n        av_log(avctx, AV_LOG_DEBUG,\n               "subpacket[%i] size %i js %i %i block_align %i\\n",\n               i, q->subpacket[i].size, q->subpacket[i].joint_stereo, offset,\n               avctx->block_align);\n        if ((ret = decode_subpacket(q, &q->subpacket[i], buf + offset, samples)) < 0)\n            return ret;\n        offset += q->subpacket[i].size;\n        chidx += q->subpacket[i].num_channels;\n        av_log(avctx, AV_LOG_DEBUG, "subpacket[%i] %i %i\\n",\n               i, q->subpacket[i].size * 8, get_bits_count(&q->gb));\n    }\n    if (q->discarded_packets < 2) {\n        q->discarded_packets++;\n        *got_frame_ptr = 0;\n        return avctx->block_align;\n    }\n    *got_frame_ptr    = 1;\n    *(AVFrame *) data = q->frame;\n    return avctx->block_align;\n}', 'static int decode_subpacket(COOKContext *q, COOKSubpacket *p,\n                            const uint8_t *inbuffer, float **outbuffer)\n{\n    int sub_packet_size = p->size;\n    int res;\n    memset(q->decode_buffer_1, 0, sizeof(q->decode_buffer_1));\n    decode_bytes_and_gain(q, p, inbuffer, &p->gains1);\n    if (p->joint_stereo) {\n        if ((res = joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2)) < 0)\n            return res;\n    } else {\n        if ((res = mono_decode(q, p, q->decode_buffer_1)) < 0)\n            return res;\n        if (p->num_channels == 2) {\n            decode_bytes_and_gain(q, p, inbuffer + sub_packet_size / 2, &p->gains2);\n            if ((res = mono_decode(q, p, q->decode_buffer_2)) < 0)\n                return res;\n        }\n    }\n    mlt_compensate_output(q, q->decode_buffer_1, &p->gains1,\n                          p->mono_previous_buffer1,\n                          outbuffer ? outbuffer[p->ch_idx] : NULL);\n    if (p->num_channels == 2)\n        if (p->joint_stereo)\n            mlt_compensate_output(q, q->decode_buffer_2, &p->gains1,\n                                  p->mono_previous_buffer2,\n                                  outbuffer ? outbuffer[p->ch_idx + 1] : NULL);\n        else\n            mlt_compensate_output(q, q->decode_buffer_2, &p->gains2,\n                                  p->mono_previous_buffer2,\n                                  outbuffer ? outbuffer[p->ch_idx + 1] : NULL);\n    return 0;\n}', 'static int mono_decode(COOKContext *q, COOKSubpacket *p, float *mlt_buffer)\n{\n    int category_index[128] = { 0 };\n    int category[128]       = { 0 };\n    int quant_index_table[102];\n    int res;\n    if ((res = decode_envelope(q, p, quant_index_table)) < 0)\n        return res;\n    q->num_vectors = get_bits(&q->gb, p->log2_numvector_size);\n    categorize(q, p, quant_index_table, category, category_index);\n    expand_category(q, category, category_index);\n    decode_vectors(q, p, category, quant_index_table, mlt_buffer);\n    return 0;\n}', 'static void categorize(COOKContext *q, COOKSubpacket *p, int *quant_index_table,\n                       int *category, int *category_index)\n{\n    int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;\n    int exp_index2[102] = { 0 };\n    int exp_index1[102] = { 0 };\n    int tmp_categorize_array[128 * 2] = { 0 };\n    int tmp_categorize_array1_idx = p->numvector_size;\n    int tmp_categorize_array2_idx = p->numvector_size;\n    bits_left = p->bits_per_subpacket - get_bits_count(&q->gb);\n    if (bits_left > q->samples_per_channel)\n        bits_left = q->samples_per_channel +\n                    ((bits_left - q->samples_per_channel) * 5) / 8;\n    bias = -32;\n    for (i = 32; i > 0; i = i / 2) {\n        num_bits = 0;\n        index    = 0;\n        for (j = p->total_subbands; j > 0; j--) {\n            exp_idx = av_clip((i - quant_index_table[index] + bias) / 2, 0, 7);\n            index++;\n            num_bits += expbits_tab[exp_idx];\n        }\n        if (num_bits >= bits_left - 32)\n            bias += i;\n    }\n    num_bits = 0;\n    for (i = 0; i < p->total_subbands; i++) {\n        exp_idx = av_clip((bias - quant_index_table[i]) / 2, 0, 7);\n        num_bits += expbits_tab[exp_idx];\n        exp_index1[i] = exp_idx;\n        exp_index2[i] = exp_idx;\n    }\n    tmpbias1 = tmpbias2 = num_bits;\n    for (j = 1; j < p->numvector_size; j++) {\n        if (tmpbias1 + tmpbias2 > 2 * bits_left) {\n            int max = -999999;\n            index = -1;\n            for (i = 0; i < p->total_subbands; i++) {\n                if (exp_index1[i] < 7) {\n                    v = (-2 * exp_index1[i]) - quant_index_table[i] + bias;\n                    if (v >= max) {\n                        max   = v;\n                        index = i;\n                    }\n                }\n            }\n            if (index == -1)\n                break;\n            tmp_categorize_array[tmp_categorize_array1_idx++] = index;\n            tmpbias1 -= expbits_tab[exp_index1[index]] -\n                        expbits_tab[exp_index1[index] + 1];\n            ++exp_index1[index];\n        } else {\n            int min = 999999;\n            index = -1;\n            for (i = 0; i < p->total_subbands; i++) {\n                if (exp_index2[i] > 0) {\n                    v = (-2 * exp_index2[i]) - quant_index_table[i] + bias;\n                    if (v < min) {\n                        min   = v;\n                        index = i;\n                    }\n                }\n            }\n            if (index == -1)\n                break;\n            tmp_categorize_array[--tmp_categorize_array2_idx] = index;\n            tmpbias2 -= expbits_tab[exp_index2[index]] -\n                        expbits_tab[exp_index2[index] - 1];\n            --exp_index2[index];\n        }\n    }\n    for (i = 0; i < p->total_subbands; i++)\n        category[i] = exp_index2[i];\n    for (i = 0; i < p->numvector_size - 1; i++)\n        category_index[i] = tmp_categorize_array[tmp_categorize_array2_idx++];\n}']