libavformat/avidec.c:603: error: Buffer Overrun L2
  Offset: [-528, 2277] Size: 20 by call to `avi_load_index`.

libavformat/avidec.c:227:1: Parameter `s->nb_streams`
225. }
226. 
227. static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap)
     ^
228. {
229.     AVIContext *avi = s->priv_data;

libavformat/avidec.c:603:9: Call
601. 
602.     if(!avi->index_loaded && !url_is_streamed(pb))
603.         avi_load_index(s);
             ^
604.     avi->index_loaded = 1;
605.     avi->non_interleaved |= guess_ni_flag(s);

libavformat/avidec.c:927:1: Parameter `s->nb_streams`
  925. }
  926. 
  927. static int avi_load_index(AVFormatContext *s)
       ^
  928. {
  929.     AVIContext *avi = s->priv_data;

libavformat/avidec.c:953:17: Call
  951.         switch(tag) {
  952.         case MKTAG('i', 'd', 'x', '1'):
  953.             if (avi_read_idx1(s, size) < 0)
                       ^
  954.                 goto skip;
  955.             else

libavformat/avidec.c:856:1: <Offset trace>
854. /* XXX: we make the implicit supposition that the position are sorted
855.    for each stream */
856. static int avi_read_idx1(AVFormatContext *s, int size)
     ^
857. {
858.     AVIContext *avi = s->priv_data;

libavformat/avidec.c:856:1: Parameter `s->nb_streams`
    854. /* XXX: we make the implicit supposition that the position are sorted
    855.    for each stream */
    856. static int avi_read_idx1(AVFormatContext *s, int size)
         ^
    857. {
    858.     AVIContext *avi = s->priv_data;

libavformat/avidec.c:856:1: <Length trace>
854. /* XXX: we make the implicit supposition that the position are sorted
855.    for each stream */
856. static int avi_read_idx1(AVFormatContext *s, int size)
     ^
857. {
858.     AVIContext *avi = s->priv_data;

libavformat/avidec.c:856:1: Parameter `s->streams[*]`
    854. /* XXX: we make the implicit supposition that the position are sorted
    855.    for each stream */
    856. static int avi_read_idx1(AVFormatContext *s, int size)
         ^
    857. {
    858.     AVIContext *avi = s->priv_data;

libavformat/avidec.c:888:14: Array access: Offset: [-528, 2277] Size: 20 by call to `avi_load_index` 
    886.         if (index >= s->nb_streams)
    887.             continue;
    888.         st = s->streams[index];
                      ^
    889.         ast = st->priv_data;
    890. 

static int avi_read_idx1(AVFormatContext *s, int size)
{
    AVIContext *avi = s->priv_data;
    ByteIOContext *pb = s->pb;
    int nb_index_entries, i;
    AVStream *st;
    AVIStream *ast;
    unsigned int index, tag, flags, pos, len;
    unsigned last_pos= -1;
    nb_index_entries = size / 16;
    if (nb_index_entries <= 0)
        return -1;
    for(i = 0; i < nb_index_entries; i++) {
        tag = get_le32(pb);
        flags = get_le32(pb);
        pos = get_le32(pb);
        len = get_le32(pb);
#if defined(DEBUG_SEEK)
        av_log(NULL, AV_LOG_DEBUG, "%d: tag=0x%x flags=0x%x pos=0x%x len=%d/",
               i, tag, flags, pos, len);
#endif
        if(i==0 && pos > avi->movi_list)
            avi->movi_list= 0;
        pos += avi->movi_list;
        index = ((tag & 0xff) - '0') * 10;
        index += ((tag >> 8) & 0xff) - '0';
        if (index >= s->nb_streams)
            continue;
        st = s->streams[index];
        ast = st->priv_data;
#if defined(DEBUG_SEEK)
        av_log(NULL, AV_LOG_DEBUG, "%d cum_len=%"PRId64"\n", len, ast->cum_len);
#endif
        if(last_pos == pos)
            avi->non_interleaved= 1;
        else
            av_add_index_entry(st, pos, ast->cum_len / FFMAX(1, ast->sample_size), len, 0, (flags&AVIIF_INDEX) ? AVINDEX_KEYFRAME : 0);
        if(ast->sample_size)
            ast->cum_len += len;
        else
            ast->cum_len ++;
        last_pos= pos;
    }
    return 0;
}
['static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap)\n{\n    AVIContext *avi = s->priv_data;\n    ByteIOContext *pb = s->pb;\n    uint32_t tag, tag1, handler;\n    int codec_type, stream_index, frame_period, bit_rate;\n    unsigned int size, nb_frames;\n    int i;\n    AVStream *st;\n    AVIStream *ast = NULL;\n    char str_track[4];\n    int avih_width=0, avih_height=0;\n    int amv_file_format=0;\n    avi->stream_index= -1;\n    if (get_riff(avi, pb) < 0)\n        return -1;\n    avi->fsize = url_fsize(pb);\n    if(avi->fsize<=0)\n        avi->fsize= avi->riff_end;\n    stream_index = -1;\n    codec_type = -1;\n    frame_period = 0;\n    for(;;) {\n        if (url_feof(pb))\n            goto fail;\n        tag = get_le32(pb);\n        size = get_le32(pb);\n#ifdef DEBUG\n        print_tag("tag", tag, size);\n#endif\n        switch(tag) {\n        case MKTAG(\'L\', \'I\', \'S\', \'T\'):\n            tag1 = get_le32(pb);\n#ifdef DEBUG\n            print_tag("list", tag1, 0);\n#endif\n            if (tag1 == MKTAG(\'m\', \'o\', \'v\', \'i\')) {\n                avi->movi_list = url_ftell(pb) - 4;\n                if(size) avi->movi_end = avi->movi_list + size + (size & 1);\n                else     avi->movi_end = url_fsize(pb);\n#ifdef DEBUG\n                printf("movi end=%"PRIx64"\\n", avi->movi_end);\n#endif\n                goto end_of_header;\n            }\n            break;\n        case MKTAG(\'d\', \'m\', \'l\', \'h\'):\n            avi->is_odml = 1;\n            url_fskip(pb, size + (size & 1));\n            break;\n        case MKTAG(\'a\', \'m\', \'v\', \'h\'):\n            amv_file_format=1;\n        case MKTAG(\'a\', \'v\', \'i\', \'h\'):\n            frame_period = get_le32(pb);\n            bit_rate = get_le32(pb) * 8;\n            get_le32(pb);\n            avi->non_interleaved |= get_le32(pb) & AVIF_MUSTUSEINDEX;\n            url_fskip(pb, 2 * 4);\n            get_le32(pb);\n            get_le32(pb);\n            avih_width=get_le32(pb);\n            avih_height=get_le32(pb);\n            url_fskip(pb, size - 10 * 4);\n            break;\n        case MKTAG(\'s\', \'t\', \'r\', \'h\'):\n            tag1 = get_le32(pb);\n            handler = get_le32(pb);\n            if(tag1 == MKTAG(\'p\', \'a\', \'d\', \'s\')){\n                url_fskip(pb, size - 8);\n                break;\n            }else{\n                stream_index++;\n                st = av_new_stream(s, stream_index);\n                if (!st)\n                    goto fail;\n                ast = av_mallocz(sizeof(AVIStream));\n                if (!ast)\n                    goto fail;\n                st->priv_data = ast;\n            }\n            if(amv_file_format)\n                tag1 = stream_index ? MKTAG(\'a\',\'u\',\'d\',\'s\') : MKTAG(\'v\',\'i\',\'d\',\'s\');\n#ifdef DEBUG\n            print_tag("strh", tag1, -1);\n#endif\n            if(tag1 == MKTAG(\'i\', \'a\', \'v\', \'s\') || tag1 == MKTAG(\'i\', \'v\', \'a\', \'s\')){\n                int64_t dv_dur;\n                if (s->nb_streams != 1)\n                    goto fail;\n                if (handler != MKTAG(\'d\', \'v\', \'s\', \'d\') &&\n                    handler != MKTAG(\'d\', \'v\', \'h\', \'d\') &&\n                    handler != MKTAG(\'d\', \'v\', \'s\', \'l\'))\n                   goto fail;\n                ast = s->streams[0]->priv_data;\n                av_freep(&s->streams[0]->codec->extradata);\n                av_freep(&s->streams[0]);\n                s->nb_streams = 0;\n                if (ENABLE_DV_DEMUXER) {\n                    avi->dv_demux = dv_init_demux(s);\n                    if (!avi->dv_demux)\n                        goto fail;\n                }\n                s->streams[0]->priv_data = ast;\n                url_fskip(pb, 3 * 4);\n                ast->scale = get_le32(pb);\n                ast->rate = get_le32(pb);\n                url_fskip(pb, 4);\n                dv_dur = get_le32(pb);\n                if (ast->scale > 0 && ast->rate > 0 && dv_dur > 0) {\n                    dv_dur *= AV_TIME_BASE;\n                    s->duration = av_rescale(dv_dur, ast->scale, ast->rate);\n                }\n                stream_index = s->nb_streams - 1;\n                url_fskip(pb, size - 9*4);\n                break;\n            }\n            assert(stream_index < s->nb_streams);\n            st->codec->stream_codec_tag= handler;\n            get_le32(pb);\n            get_le16(pb);\n            get_le16(pb);\n            get_le32(pb);\n            ast->scale = get_le32(pb);\n            ast->rate = get_le32(pb);\n            if(ast->scale && ast->rate){\n            }else if(frame_period){\n                ast->rate = 1000000;\n                ast->scale = frame_period;\n            }else{\n                ast->rate = 25;\n                ast->scale = 1;\n            }\n            av_set_pts_info(st, 64, ast->scale, ast->rate);\n            ast->cum_len=get_le32(pb);\n            nb_frames = get_le32(pb);\n            st->start_time = 0;\n            st->duration = nb_frames;\n            get_le32(pb);\n            get_le32(pb);\n            ast->sample_size = get_le32(pb);\n            ast->cum_len *= FFMAX(1, ast->sample_size);\n            switch(tag1) {\n            case MKTAG(\'v\', \'i\', \'d\', \'s\'):\n                codec_type = CODEC_TYPE_VIDEO;\n                ast->sample_size = 0;\n                break;\n            case MKTAG(\'a\', \'u\', \'d\', \'s\'):\n                codec_type = CODEC_TYPE_AUDIO;\n                break;\n            case MKTAG(\'t\', \'x\', \'t\', \'s\'):\n                codec_type = CODEC_TYPE_DATA;\n                break;\n            default:\n                av_log(s, AV_LOG_ERROR, "unknown stream type %X\\n", tag1);\n                goto fail;\n            }\n            ast->frame_offset= ast->cum_len;\n            url_fskip(pb, size - 12 * 4);\n            break;\n        case MKTAG(\'s\', \'t\', \'r\', \'f\'):\n            if (stream_index >= (unsigned)s->nb_streams || avi->dv_demux) {\n                url_fskip(pb, size);\n            } else {\n                st = s->streams[stream_index];\n                switch(codec_type) {\n                case CODEC_TYPE_VIDEO:\n                    if(amv_file_format){\n                        st->codec->width=avih_width;\n                        st->codec->height=avih_height;\n                        st->codec->codec_type = CODEC_TYPE_VIDEO;\n                        st->codec->codec_id = CODEC_ID_AMV;\n                        url_fskip(pb, size);\n                        break;\n                    }\n                    get_le32(pb);\n                    st->codec->width = get_le32(pb);\n                    st->codec->height = get_le32(pb);\n                    get_le16(pb);\n                    st->codec->bits_per_sample= get_le16(pb);\n                    tag1 = get_le32(pb);\n                    get_le32(pb);\n                    get_le32(pb);\n                    get_le32(pb);\n                    get_le32(pb);\n                    get_le32(pb);\n                    if (tag1 == MKTAG(\'D\', \'X\', \'S\', \'B\')) {\n                        st->codec->codec_type = CODEC_TYPE_SUBTITLE;\n                        st->codec->codec_tag = tag1;\n                        st->codec->codec_id = CODEC_ID_XSUB;\n                        break;\n                    }\n                    if(size > 10*4 && size<(1<<30)){\n                        st->codec->extradata_size= size - 10*4;\n                        st->codec->extradata= av_malloc(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);\n                        get_buffer(pb, st->codec->extradata, st->codec->extradata_size);\n                    }\n                    if(st->codec->extradata_size & 1)\n                        get_byte(pb);\n                    if (st->codec->extradata_size && (st->codec->bits_per_sample <= 8)) {\n                        st->codec->palctrl = av_mallocz(sizeof(AVPaletteControl));\n#ifdef WORDS_BIGENDIAN\n                        for (i = 0; i < FFMIN(st->codec->extradata_size, AVPALETTE_SIZE)/4; i++)\n                            st->codec->palctrl->palette[i] = bswap_32(((uint32_t*)st->codec->extradata)[i]);\n#else\n                        memcpy(st->codec->palctrl->palette, st->codec->extradata,\n                               FFMIN(st->codec->extradata_size, AVPALETTE_SIZE));\n#endif\n                        st->codec->palctrl->palette_changed = 1;\n                    }\n#ifdef DEBUG\n                    print_tag("video", tag1, 0);\n#endif\n                    st->codec->codec_type = CODEC_TYPE_VIDEO;\n                    st->codec->codec_tag = tag1;\n                    st->codec->codec_id = codec_get_id(codec_bmp_tags, tag1);\n                    st->need_parsing = AVSTREAM_PARSE_HEADERS;\n                    break;\n                case CODEC_TYPE_AUDIO:\n                    get_wav_header(pb, st->codec, size);\n                    if(ast->sample_size && st->codec->block_align && ast->sample_size != st->codec->block_align){\n                        av_log(s, AV_LOG_WARNING, "sample size (%d) != block align (%d)\\n", ast->sample_size, st->codec->block_align);\n                        ast->sample_size= st->codec->block_align;\n                    }\n                    if (size%2)\n                        url_fskip(pb, 1);\n                    st->need_parsing = AVSTREAM_PARSE_TIMESTAMPS;\n                    if (st->codec->codec_id == CODEC_ID_AAC && st->codec->extradata_size)\n                        st->need_parsing = AVSTREAM_PARSE_NONE;\n                    if (st->codec->stream_codec_tag == ff_get_fourcc("Axan")){\n                        st->codec->codec_id  = CODEC_ID_XAN_DPCM;\n                        st->codec->codec_tag = 0;\n                    }\n                    if (amv_file_format)\n                        st->codec->codec_id  = CODEC_ID_ADPCM_IMA_AMV;\n                    break;\n                default:\n                    st->codec->codec_type = CODEC_TYPE_DATA;\n                    st->codec->codec_id= CODEC_ID_NONE;\n                    st->codec->codec_tag= 0;\n                    url_fskip(pb, size);\n                    break;\n                }\n            }\n            break;\n        case MKTAG(\'i\', \'n\', \'d\', \'x\'):\n            i= url_ftell(pb);\n            if(!url_is_streamed(pb) && !(s->flags & AVFMT_FLAG_IGNIDX)){\n                read_braindead_odml_indx(s, 0);\n            }\n            url_fseek(pb, i+size, SEEK_SET);\n            break;\n        case MKTAG(\'v\', \'p\', \'r\', \'p\'):\n            if(stream_index < (unsigned)s->nb_streams && size > 9*4){\n                AVRational active, active_aspect;\n                st = s->streams[stream_index];\n                get_le32(pb);\n                get_le32(pb);\n                get_le32(pb);\n                get_le32(pb);\n                get_le32(pb);\n                active_aspect.den= get_le16(pb);\n                active_aspect.num= get_le16(pb);\n                active.num       = get_le32(pb);\n                active.den       = get_le32(pb);\n                get_le32(pb);\n                if(active_aspect.num && active_aspect.den && active.num && active.den){\n                    st->codec->sample_aspect_ratio= av_div_q(active_aspect, active);\n                }\n                size -= 9*4;\n            }\n            url_fseek(pb, size, SEEK_CUR);\n            break;\n        case MKTAG(\'I\', \'N\', \'A\', \'M\'):\n            avi_read_tag(pb, s->title, sizeof(s->title), size);\n            break;\n        case MKTAG(\'I\', \'A\', \'R\', \'T\'):\n            avi_read_tag(pb, s->author, sizeof(s->author), size);\n            break;\n        case MKTAG(\'I\', \'C\', \'O\', \'P\'):\n            avi_read_tag(pb, s->copyright, sizeof(s->copyright), size);\n            break;\n        case MKTAG(\'I\', \'C\', \'M\', \'T\'):\n            avi_read_tag(pb, s->comment, sizeof(s->comment), size);\n            break;\n        case MKTAG(\'I\', \'G\', \'N\', \'R\'):\n            avi_read_tag(pb, s->genre, sizeof(s->genre), size);\n            break;\n        case MKTAG(\'I\', \'P\', \'R\', \'D\'):\n            avi_read_tag(pb, s->album, sizeof(s->album), size);\n            break;\n        case MKTAG(\'I\', \'P\', \'R\', \'T\'):\n            avi_read_tag(pb, str_track, sizeof(str_track), size);\n            sscanf(str_track, "%d", &s->track);\n            break;\n        default:\n            if(size > 1000000){\n                av_log(s, AV_LOG_ERROR, "well something went wrong during header parsing, "\n                                        "ill ignore it and try to continue anyway\\n");\n                avi->movi_list = url_ftell(pb) - 4;\n                avi->movi_end  = url_fsize(pb);\n                goto end_of_header;\n            }\n            size += (size & 1);\n            url_fskip(pb, size);\n            break;\n        }\n    }\n end_of_header:\n    if (stream_index != s->nb_streams - 1) {\n    fail:\n        for(i=0;i<s->nb_streams;i++) {\n            av_freep(&s->streams[i]->codec->extradata);\n            av_freep(&s->streams[i]);\n        }\n        return -1;\n    }\n    if(!avi->index_loaded && !url_is_streamed(pb))\n        avi_load_index(s);\n    avi->index_loaded = 1;\n    avi->non_interleaved |= guess_ni_flag(s);\n    if(avi->non_interleaved)\n        clean_index(s);\n    return 0;\n}', 'static int avi_load_index(AVFormatContext *s)\n{\n    AVIContext *avi = s->priv_data;\n    ByteIOContext *pb = s->pb;\n    uint32_t tag, size;\n    offset_t pos= url_ftell(pb);\n    url_fseek(pb, avi->movi_end, SEEK_SET);\n#ifdef DEBUG_SEEK\n    printf("movi_end=0x%"PRIx64"\\n", avi->movi_end);\n#endif\n    for(;;) {\n        if (url_feof(pb))\n            break;\n        tag = get_le32(pb);\n        size = get_le32(pb);\n#ifdef DEBUG_SEEK\n        printf("tag=%c%c%c%c size=0x%x\\n",\n               tag & 0xff,\n               (tag >> 8) & 0xff,\n               (tag >> 16) & 0xff,\n               (tag >> 24) & 0xff,\n               size);\n#endif\n        switch(tag) {\n        case MKTAG(\'i\', \'d\', \'x\', \'1\'):\n            if (avi_read_idx1(s, size) < 0)\n                goto skip;\n            else\n                goto the_end;\n            break;\n        default:\n        skip:\n            size += (size & 1);\n            url_fskip(pb, size);\n            break;\n        }\n    }\n the_end:\n    url_fseek(pb, pos, SEEK_SET);\n    return 0;\n}', 'static int avi_read_idx1(AVFormatContext *s, int size)\n{\n    AVIContext *avi = s->priv_data;\n    ByteIOContext *pb = s->pb;\n    int nb_index_entries, i;\n    AVStream *st;\n    AVIStream *ast;\n    unsigned int index, tag, flags, pos, len;\n    unsigned last_pos= -1;\n    nb_index_entries = size / 16;\n    if (nb_index_entries <= 0)\n        return -1;\n    for(i = 0; i < nb_index_entries; i++) {\n        tag = get_le32(pb);\n        flags = get_le32(pb);\n        pos = get_le32(pb);\n        len = get_le32(pb);\n#if defined(DEBUG_SEEK)\n        av_log(NULL, AV_LOG_DEBUG, "%d: tag=0x%x flags=0x%x pos=0x%x len=%d/",\n               i, tag, flags, pos, len);\n#endif\n        if(i==0 && pos > avi->movi_list)\n            avi->movi_list= 0;\n        pos += avi->movi_list;\n        index = ((tag & 0xff) - \'0\') * 10;\n        index += ((tag >> 8) & 0xff) - \'0\';\n        if (index >= s->nb_streams)\n            continue;\n        st = s->streams[index];\n        ast = st->priv_data;\n#if defined(DEBUG_SEEK)\n        av_log(NULL, AV_LOG_DEBUG, "%d cum_len=%"PRId64"\\n", len, ast->cum_len);\n#endif\n        if(last_pos == pos)\n            avi->non_interleaved= 1;\n        else\n            av_add_index_entry(st, pos, ast->cum_len / FFMAX(1, ast->sample_size), len, 0, (flags&AVIIF_INDEX) ? AVINDEX_KEYFRAME : 0);\n        if(ast->sample_size)\n            ast->cum_len += len;\n        else\n            ast->cum_len ++;\n        last_pos= pos;\n    }\n    return 0;\n}']