libavcodec/rv34.c:1144: error: Buffer Overrun L2
  Offset: [1, 16843009] Size: 108 by call to `rv34_decode_block`.

libavcodec/rv34.c:1113:5: Call
1111.     // Calculate which neighbours are available. Maybe it's worth optimizing too.
1112.     memset(r->avail_cache, 0, sizeof(r->avail_cache));
1113.     fill_rectangle(r->avail_cache + 6, 2, 2, 4, 1, 4);
          ^
1114.     dist = (s->mb_x - s->resync_mb_x) + (s->mb_y - s->resync_mb_y) * s->mb_width;
1115.     if(s->mb_x && dist)

libavcodec/rectangle.h:42:1: Parameter `val`
  40.  * @param size the size of val (1, 2 or 4), should be a constant
  41.  */
  42. static av_always_inline void fill_rectangle(void *vp, int w, int h, int stride, uint32_t val, int size){
      ^
  43.     uint8_t *p= (uint8_t*)vp;
  44.     assert(size==1 || size==2 || size==4);

libavcodec/rectangle.h:109:9: Assignment
  107.         *(uint32_t*)(p + 4+1*stride)= val;
  108.         *(uint32_t*)(p + 8+1*stride)= val;
  109.         *(uint32_t*)(p +12+1*stride)= val;
               ^
  110.         if(h==2) return;
  111.         *(uint32_t*)(p + 0+2*stride)= val;

libavcodec/rv34.c:1144:9: Call
1142.         q_ac = rv34_qscale_tab[s->qscale];
1143.         memset(block16, 0, 64 * sizeof(*block16));
1144.         rv34_decode_block(block16, gb, r->cur_vlcs, 3, 0, q_dc, q_dc, q_ac);
              ^
1145.         r->rdsp.rv34_inv_transform_tab[1](block16);
1146.     }

libavcodec/rv34.c:285:1: Parameter `(*rvlc->second_pattern[*].table)[*]`
  283.  */
  284. 
  285. static inline void rv34_decode_block(DCTELEM *dst, GetBitContext *gb, RV34VLC *rvlc, int fc, int sc, int q_dc, int q_ac1, int q_ac2)
       ^
  286. {
  287.     int code, pattern;

libavcodec/rv34.c:297:16: Call
  295. 
  296.     if(pattern & 4){
  297.         code = get_vlc2(gb, rvlc->second_pattern[sc].table, 9, 2);
                      ^
  298.         decode_subblock(dst + 2, code, 0, gb, &rvlc->coefficient, q_ac2);
  299.     }

libavcodec/get_bits.h:460:1: Parameter `(*table)[*]`
    458.  *                  = (max_vlc_length + bits - 1) / bits
    459.  */
    460. static av_always_inline int get_vlc2(GetBitContext *s, VLC_TYPE (*table)[2],
         ^
    461.                                      int bits, int max_depth)
    462. {

libavcodec/get_bits.h:468:5: Assignment
    466.     UPDATE_CACHE(re, s);
    467. 
    468.     GET_VLC(code, re, s, table, bits, max_depth);
             ^
    469. 
    470.     CLOSE_READER(re, s);

libavcodec/get_bits.h:471:5: Assignment
    469. 
    470.     CLOSE_READER(re, s);
    471.     return code;
             ^
    472. }
    473. 

libavcodec/rv34.c:297:9: Assignment
  295. 
  296.     if(pattern & 4){
  297.         code = get_vlc2(gb, rvlc->second_pattern[sc].table, 9, 2);
               ^
  298.         decode_subblock(dst + 2, code, 0, gb, &rvlc->coefficient, q_ac2);
  299.     }

libavcodec/rv34.c:298:9: Call
  296.     if(pattern & 4){
  297.         code = get_vlc2(gb, rvlc->second_pattern[sc].table, 9, 2);
  298.         decode_subblock(dst + 2, code, 0, gb, &rvlc->coefficient, q_ac2);
               ^
  299.     }
  300.     if(pattern & 2){ // Looks like coefficients 1 and 2 are swapped for this block

libavcodec/rv34.c:235:1: <Offset trace>
233.  * Decode 2x2 subblock of coefficients.
234.  */
235. static inline void decode_subblock(DCTELEM *dst, int code, const int is_block2, GetBitContext *gb, VLC *vlc, int q)
     ^
236. {
237.     int coeffs[4];

libavcodec/rv34.c:235:1: Parameter `code`
    233.  * Decode 2x2 subblock of coefficients.
    234.  */
    235. static inline void decode_subblock(DCTELEM *dst, int code, const int is_block2, GetBitContext *gb, VLC *vlc, int q)
         ^
    236. {
    237.     int coeffs[4];

libavcodec/rv34data.h:53:1: <Length trace>
51.  * This table allows conversion from a value back to a vector.
52.  */
53. static const uint8_t modulo_three_table[108][4] = {
    ^
54.  { 0, 0, 0, 0 }, { 0, 0, 0, 1 }, { 0, 0, 0, 2 }, { 0, 0, 1, 0 },
55.  { 0, 0, 1, 1 }, { 0, 0, 1, 2 }, { 0, 0, 2, 0 }, { 0, 0, 2, 1 },

libavcodec/rv34data.h:53:1: Array declaration
    51.  * This table allows conversion from a value back to a vector.
    52.  */
    53. static const uint8_t modulo_three_table[108][4] = {
        ^
    54.  { 0, 0, 0, 0 }, { 0, 0, 0, 1 }, { 0, 0, 0, 2 }, { 0, 0, 1, 0 },
    55.  { 0, 0, 1, 1 }, { 0, 0, 1, 2 }, { 0, 0, 2, 0 }, { 0, 0, 2, 1 },

libavcodec/rv34.c:239:17: Array access: Offset: [1, 16843009] Size: 108 by call to `rv34_decode_block` 
    237.     int coeffs[4];
    238. 
    239.     coeffs[0] = modulo_three_table[code][0];
                         ^
    240.     coeffs[1] = modulo_three_table[code][1];
    241.     coeffs[2] = modulo_three_table[code][2];

static inline void decode_subblock(DCTELEM *dst, int code, const int is_block2, GetBitContext *gb, VLC *vlc, int q)
{
    int coeffs[4];
    coeffs[0] = modulo_three_table[code][0];
    coeffs[1] = modulo_three_table[code][1];
    coeffs[2] = modulo_three_table[code][2];
    coeffs[3] = modulo_three_table[code][3];
    decode_coeff(dst  , coeffs[0], 3, gb, vlc, q);
    if(is_block2){
        decode_coeff(dst+8, coeffs[1], 2, gb, vlc, q);
        decode_coeff(dst+1, coeffs[2], 2, gb, vlc, q);
    }else{
        decode_coeff(dst+1, coeffs[1], 2, gb, vlc, q);
        decode_coeff(dst+8, coeffs[2], 2, gb, vlc, q);
    }
    decode_coeff(dst+9, coeffs[3], 2, gb, vlc, q);
}
['static int rv34_decode_macroblock(RV34DecContext *r, int8_t *intra_types)\n{\n    MpegEncContext *s = &r->s;\n    GetBitContext *gb = &s->gb;\n    int cbp, cbp2;\n    int q_dc, q_ac;\n    int i, blknum, blkoff;\n    LOCAL_ALIGNED_16(DCTELEM, block16, [64]);\n    int luma_dc_quant;\n    int dist;\n    int mb_pos = s->mb_x + s->mb_y * s->mb_stride;\n    memset(r->avail_cache, 0, sizeof(r->avail_cache));\n    fill_rectangle(r->avail_cache + 6, 2, 2, 4, 1, 4);\n    dist = (s->mb_x - s->resync_mb_x) + (s->mb_y - s->resync_mb_y) * s->mb_width;\n    if(s->mb_x && dist)\n        r->avail_cache[5] =\n        r->avail_cache[9] = s->current_picture_ptr->f.mb_type[mb_pos - 1];\n    if(dist >= s->mb_width)\n        r->avail_cache[2] =\n        r->avail_cache[3] = s->current_picture_ptr->f.mb_type[mb_pos - s->mb_stride];\n    if(((s->mb_x+1) < s->mb_width) && dist >= s->mb_width - 1)\n        r->avail_cache[4] = s->current_picture_ptr->f.mb_type[mb_pos - s->mb_stride + 1];\n    if(s->mb_x && dist > s->mb_width)\n        r->avail_cache[1] = s->current_picture_ptr->f.mb_type[mb_pos - s->mb_stride - 1];\n    s->qscale = r->si.quant;\n    cbp = cbp2 = rv34_decode_mb_header(r, intra_types);\n    r->cbp_luma  [mb_pos] = cbp;\n    r->cbp_chroma[mb_pos] = cbp >> 16;\n    if(s->pict_type == AV_PICTURE_TYPE_I)\n        r->deblock_coefs[mb_pos] = 0xFFFF;\n    else\n        r->deblock_coefs[mb_pos] = rv34_set_deblock_coef(r) | r->cbp_luma[mb_pos];\n    s->current_picture_ptr->f.qscale_table[mb_pos] = s->qscale;\n    if(cbp == -1)\n        return -1;\n    luma_dc_quant = r->block_type == RV34_MB_P_MIX16x16 ? r->luma_dc_quant_p[s->qscale] : r->luma_dc_quant_i[s->qscale];\n    if(r->is16){\n        q_dc = rv34_qscale_tab[luma_dc_quant];\n        q_ac = rv34_qscale_tab[s->qscale];\n        memset(block16, 0, 64 * sizeof(*block16));\n        rv34_decode_block(block16, gb, r->cur_vlcs, 3, 0, q_dc, q_dc, q_ac);\n        r->rdsp.rv34_inv_transform_tab[1](block16);\n    }\n    q_ac = rv34_qscale_tab[s->qscale];\n    for(i = 0; i < 16; i++, cbp >>= 1){\n        if(!r->is16 && !(cbp & 1)) continue;\n        blknum = ((i & 2) >> 1) + ((i & 8) >> 2);\n        blkoff = ((i & 1) << 2) + ((i & 4) << 3);\n        if(cbp & 1)\n            rv34_decode_block(s->block[blknum] + blkoff, gb,\n                              r->cur_vlcs, r->luma_vlc, 0, q_ac, q_ac, q_ac);\n        if(r->is16)\n            s->block[blknum][blkoff] = block16[(i & 3) | ((i & 0xC) << 1)];\n        r->rdsp.rv34_inv_transform_tab[0](s->block[blknum] + blkoff);\n    }\n    if(r->block_type == RV34_MB_P_MIX16x16)\n        r->cur_vlcs = choose_vlc_set(r->si.quant, r->si.vlc_set, 1);\n    q_dc = rv34_qscale_tab[rv34_chroma_quant[1][s->qscale]];\n    q_ac = rv34_qscale_tab[rv34_chroma_quant[0][s->qscale]];\n    for(; i < 24; i++, cbp >>= 1){\n        if(!(cbp & 1)) continue;\n        blknum = ((i & 4) >> 2) + 4;\n        blkoff = ((i & 1) << 2) + ((i & 2) << 4);\n        rv34_decode_block(s->block[blknum] + blkoff, gb, r->cur_vlcs, r->chroma_vlc, 1, q_dc, q_ac, q_ac);\n        r->rdsp.rv34_inv_transform_tab[0](s->block[blknum] + blkoff);\n    }\n    if (IS_INTRA(s->current_picture_ptr->f.mb_type[mb_pos]))\n        rv34_output_macroblock(r, intra_types, cbp2, r->is16);\n    else\n        rv34_apply_differences(r, cbp2);\n    return 0;\n}', 'static av_always_inline void fill_rectangle(void *vp, int w, int h, int stride, uint32_t val, int size){\n    uint8_t *p= (uint8_t*)vp;\n    assert(size==1 || size==2 || size==4);\n    assert(w<=4);\n    w      *= size;\n    stride *= size;\n    assert((((long)vp)&(FFMIN(w, STRIDE_ALIGN)-1)) == 0);\n    assert((stride&(w-1))==0);\n    if(w==2){\n        const uint16_t v= size==4 ? val : val*0x0101;\n        *(uint16_t*)(p + 0*stride)= v;\n        if(h==1) return;\n        *(uint16_t*)(p + 1*stride)= v;\n        if(h==2) return;\n        *(uint16_t*)(p + 2*stride)= v;\n        *(uint16_t*)(p + 3*stride)= v;\n    }else if(w==4){\n        const uint32_t v= size==4 ? val : size==2 ? val*0x00010001 : val*0x01010101;\n        *(uint32_t*)(p + 0*stride)= v;\n        if(h==1) return;\n        *(uint32_t*)(p + 1*stride)= v;\n        if(h==2) return;\n        *(uint32_t*)(p + 2*stride)= v;\n        *(uint32_t*)(p + 3*stride)= v;\n    }else if(w==8){\n#if HAVE_FAST_64BIT\n        const uint64_t v=  size==2 ? val*0x0001000100010001ULL : val*0x0100000001ULL;\n        *(uint64_t*)(p + 0*stride)= v;\n        if(h==1) return;\n        *(uint64_t*)(p + 1*stride)= v;\n        if(h==2) return;\n        *(uint64_t*)(p + 2*stride)= v;\n        *(uint64_t*)(p + 3*stride)= v;\n    }else if(w==16){\n        const uint64_t v= val*0x0100000001ULL;\n        *(uint64_t*)(p + 0+0*stride)= v;\n        *(uint64_t*)(p + 8+0*stride)= v;\n        *(uint64_t*)(p + 0+1*stride)= v;\n        *(uint64_t*)(p + 8+1*stride)= v;\n        if(h==2) return;\n        *(uint64_t*)(p + 0+2*stride)= v;\n        *(uint64_t*)(p + 8+2*stride)= v;\n        *(uint64_t*)(p + 0+3*stride)= v;\n        *(uint64_t*)(p + 8+3*stride)= v;\n#else\n        const uint32_t v= size==2 ? val*0x00010001 : val;\n        *(uint32_t*)(p + 0+0*stride)= v;\n        *(uint32_t*)(p + 4+0*stride)= v;\n        if(h==1) return;\n        *(uint32_t*)(p + 0+1*stride)= v;\n        *(uint32_t*)(p + 4+1*stride)= v;\n        if(h==2) return;\n        *(uint32_t*)(p + 0+2*stride)= v;\n        *(uint32_t*)(p + 4+2*stride)= v;\n        *(uint32_t*)(p + 0+3*stride)= v;\n        *(uint32_t*)(p + 4+3*stride)= v;\n    }else if(w==16){\n        *(uint32_t*)(p + 0+0*stride)= val;\n        *(uint32_t*)(p + 4+0*stride)= val;\n        *(uint32_t*)(p + 8+0*stride)= val;\n        *(uint32_t*)(p +12+0*stride)= val;\n        *(uint32_t*)(p + 0+1*stride)= val;\n        *(uint32_t*)(p + 4+1*stride)= val;\n        *(uint32_t*)(p + 8+1*stride)= val;\n        *(uint32_t*)(p +12+1*stride)= val;\n        if(h==2) return;\n        *(uint32_t*)(p + 0+2*stride)= val;\n        *(uint32_t*)(p + 4+2*stride)= val;\n        *(uint32_t*)(p + 8+2*stride)= val;\n        *(uint32_t*)(p +12+2*stride)= val;\n        *(uint32_t*)(p + 0+3*stride)= val;\n        *(uint32_t*)(p + 4+3*stride)= val;\n        *(uint32_t*)(p + 8+3*stride)= val;\n        *(uint32_t*)(p +12+3*stride)= val;\n#endif\n    }else\n        assert(0);\n    assert(h==4);\n}', 'static inline void rv34_decode_block(DCTELEM *dst, GetBitContext *gb, RV34VLC *rvlc, int fc, int sc, int q_dc, int q_ac1, int q_ac2)\n{\n    int code, pattern;\n    code = get_vlc2(gb, rvlc->first_pattern[fc].table, 9, 2);\n    pattern = code & 0x7;\n    code >>= 3;\n    decode_subblock3(dst, code, 0, gb, &rvlc->coefficient, q_dc, q_ac1, q_ac2);\n    if(pattern & 4){\n        code = get_vlc2(gb, rvlc->second_pattern[sc].table, 9, 2);\n        decode_subblock(dst + 2, code, 0, gb, &rvlc->coefficient, q_ac2);\n    }\n    if(pattern & 2){\n        code = get_vlc2(gb, rvlc->second_pattern[sc].table, 9, 2);\n        decode_subblock(dst + 8*2, code, 1, gb, &rvlc->coefficient, q_ac2);\n    }\n    if(pattern & 1){\n        code = get_vlc2(gb, rvlc->third_pattern[sc].table, 9, 2);\n        decode_subblock(dst + 8*2+2, code, 0, gb, &rvlc->coefficient, q_ac2);\n    }\n}', 'static av_always_inline int get_vlc2(GetBitContext *s, VLC_TYPE (*table)[2],\n                                     int bits, int max_depth)\n{\n    int code;\n    OPEN_READER(re, s);\n    UPDATE_CACHE(re, s);\n    GET_VLC(code, re, s, table, bits, max_depth);\n    CLOSE_READER(re, s);\n    return code;\n}', 'static inline void decode_subblock(DCTELEM *dst, int code, const int is_block2, GetBitContext *gb, VLC *vlc, int q)\n{\n    int coeffs[4];\n    coeffs[0] = modulo_three_table[code][0];\n    coeffs[1] = modulo_three_table[code][1];\n    coeffs[2] = modulo_three_table[code][2];\n    coeffs[3] = modulo_three_table[code][3];\n    decode_coeff(dst  , coeffs[0], 3, gb, vlc, q);\n    if(is_block2){\n        decode_coeff(dst+8, coeffs[1], 2, gb, vlc, q);\n        decode_coeff(dst+1, coeffs[2], 2, gb, vlc, q);\n    }else{\n        decode_coeff(dst+1, coeffs[1], 2, gb, vlc, q);\n        decode_coeff(dst+8, coeffs[2], 2, gb, vlc, q);\n    }\n    decode_coeff(dst+9, coeffs[3], 2, gb, vlc, q);\n}']