libavcodec/c93.c:206: error: Buffer Overrun L2
  Offset: [0, 9] Size: 4 by call to `draw_n_color`.

libavcodec/c93.c:115:1: Array declaration
113. }
114. 
115. static int decode_frame(AVCodecContext *avctx, void *data,
     ^
116.                             int *data_size, AVPacket *avpkt)
117. {

libavcodec/c93.c:206:29: Call
204.                         } else {
205.                             bytestream2_get_buffer(&gb, grps, 4);
206.                             draw_n_color(out + i + j*stride, stride, 4, 4,
                                 ^
207.                                     1, cols, grps, bytestream2_get_le16(&gb));
208.                         }

libavcodec/c93.c:99:1: <Offset trace>
 97. }
 98. 
 99. static inline void draw_n_color(uint8_t *out, int stride, int width,
     ^
100.          int height, int bpp, uint8_t cols[4], uint8_t grps[4], uint32_t col)
101. {

libavcodec/c93.c:99:1: Parameter `height`
   97. }
   98. 
   99. static inline void draw_n_color(uint8_t *out, int stride, int width,
       ^
  100.          int height, int bpp, uint8_t cols[4], uint8_t grps[4], uint32_t col)
  101. {

libavcodec/c93.c:99:1: <Length trace>
 97. }
 98. 
 99. static inline void draw_n_color(uint8_t *out, int stride, int width,
     ^
100.          int height, int bpp, uint8_t cols[4], uint8_t grps[4], uint32_t col)
101. {

libavcodec/c93.c:99:1: Parameter `*grps`
   97. }
   98. 
   99. static inline void draw_n_color(uint8_t *out, int stride, int width,
       ^
  100.          int height, int bpp, uint8_t cols[4], uint8_t grps[4], uint32_t col)
  101. {

libavcodec/c93.c:105:23: Array access: Offset: [0, 9] Size: 4 by call to `draw_n_color` 
  103.     for (y = 0; y < height; y++) {
  104.         if (grps)
  105.             cols[0] = grps[3 * (y >> 1)];
                             ^
  106.         for (x = 0; x < width; x++) {
  107.             if (grps)

static inline void draw_n_color(uint8_t *out, int stride, int width,
         int height, int bpp, uint8_t cols[4], uint8_t grps[4], uint32_t col)
{
    int x, y;
    for (y = 0; y < height; y++) {
        if (grps)
            cols[0] = grps[3 * (y >> 1)];
        for (x = 0; x < width; x++) {
            if (grps)
                cols[1]= grps[(x >> 1) + 1];
            out[x + y*stride] = cols[col & ((1 << bpp) - 1)];
            col >>= bpp;
        }
    }
}
['static int decode_frame(AVCodecContext *avctx, void *data,\n                            int *data_size, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    C93DecoderContext * const c93 = avctx->priv_data;\n    AVFrame * const newpic = &c93->pictures[c93->currentpic];\n    AVFrame * const oldpic = &c93->pictures[c93->currentpic^1];\n    AVFrame *picture = data;\n    GetByteContext gb;\n    uint8_t *out;\n    int stride, i, x, y, b, bt = 0;\n    c93->currentpic ^= 1;\n    newpic->reference = 1;\n    newpic->buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE |\n                         FF_BUFFER_HINTS_REUSABLE | FF_BUFFER_HINTS_READABLE;\n    if (avctx->reget_buffer(avctx, newpic)) {\n        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\\n");\n        return -1;\n    }\n    stride = newpic->linesize[0];\n    bytestream2_init(&gb, buf, buf_size);\n    b = bytestream2_get_byte(&gb);\n    if (b & C93_FIRST_FRAME) {\n        newpic->pict_type = AV_PICTURE_TYPE_I;\n        newpic->key_frame = 1;\n    } else {\n        newpic->pict_type = AV_PICTURE_TYPE_P;\n        newpic->key_frame = 0;\n    }\n    for (y = 0; y < HEIGHT; y += 8) {\n        out = newpic->data[0] + y * stride;\n        for (x = 0; x < WIDTH; x += 8) {\n            uint8_t *copy_from = oldpic->data[0];\n            unsigned int offset, j;\n            uint8_t cols[4], grps[4];\n            C93BlockType block_type;\n            if (!bt)\n                bt = bytestream2_get_byte(&gb);\n            block_type= bt & 0x0F;\n            switch (block_type) {\n            case C93_8X8_FROM_PREV:\n                offset = bytestream2_get_le16(&gb);\n                if (copy_block(avctx, out, copy_from, offset, 8, stride))\n                    return -1;\n                break;\n            case C93_4X4_FROM_CURR:\n                copy_from = newpic->data[0];\n            case C93_4X4_FROM_PREV:\n                for (j = 0; j < 8; j += 4) {\n                    for (i = 0; i < 8; i += 4) {\n                        offset = bytestream2_get_le16(&gb);\n                        if (copy_block(avctx, &out[j*stride+i],\n                                           copy_from, offset, 4, stride))\n                            return -1;\n                    }\n                }\n                break;\n            case C93_8X8_2COLOR:\n                bytestream2_get_buffer(&gb, cols, 2);\n                for (i = 0; i < 8; i++) {\n                    draw_n_color(out + i*stride, stride, 8, 1, 1, cols,\n                                     NULL, bytestream2_get_byte(&gb));\n                }\n                break;\n            case C93_4X4_2COLOR:\n            case C93_4X4_4COLOR:\n            case C93_4X4_4COLOR_GRP:\n                for (j = 0; j < 8; j += 4) {\n                    for (i = 0; i < 8; i += 4) {\n                        if (block_type == C93_4X4_2COLOR) {\n                            bytestream2_get_buffer(&gb, cols, 2);\n                            draw_n_color(out + i + j*stride, stride, 4, 4,\n                                    1, cols, NULL, bytestream2_get_le16(&gb));\n                        } else if (block_type == C93_4X4_4COLOR) {\n                            bytestream2_get_buffer(&gb, cols, 4);\n                            draw_n_color(out + i + j*stride, stride, 4, 4,\n                                    2, cols, NULL, bytestream2_get_le32(&gb));\n                        } else {\n                            bytestream2_get_buffer(&gb, grps, 4);\n                            draw_n_color(out + i + j*stride, stride, 4, 4,\n                                    1, cols, grps, bytestream2_get_le16(&gb));\n                        }\n                    }\n                }\n                break;\n            case C93_NOOP:\n                break;\n            case C93_8X8_INTRA:\n                for (j = 0; j < 8; j++)\n                    bytestream2_get_buffer(&gb, out + j*stride, 8);\n                break;\n            default:\n                av_log(avctx, AV_LOG_ERROR, "unexpected type %x at %dx%d\\n",\n                       block_type, x, y);\n                return -1;\n            }\n            bt >>= 4;\n            out += 8;\n        }\n    }\n    if (b & C93_HAS_PALETTE) {\n        uint32_t *palette = (uint32_t *) newpic->data[1];\n        for (i = 0; i < 256; i++) {\n            palette[i] = bytestream2_get_be24(&gb);\n        }\n    } else {\n        if (oldpic->data[1])\n            memcpy(newpic->data[1], oldpic->data[1], 256 * 4);\n    }\n    *picture = *newpic;\n    *data_size = sizeof(AVFrame);\n    return buf_size;\n}', 'static inline void draw_n_color(uint8_t *out, int stride, int width,\n         int height, int bpp, uint8_t cols[4], uint8_t grps[4], uint32_t col)\n{\n    int x, y;\n    for (y = 0; y < height; y++) {\n        if (grps)\n            cols[0] = grps[3 * (y >> 1)];\n        for (x = 0; x < width; x++) {\n            if (grps)\n                cols[1]= grps[(x >> 1) + 1];\n            out[x + y*stride] = cols[col & ((1 << bpp) - 1)];\n            col >>= bpp;\n        }\n    }\n}']