libavformat/nsvdec.c:596: error: Buffer Overrun L3
  Offset: 1 Size: [0, 2147483631].

libavformat/nsvdec.c:531:1: <Length trace>
529. }
530. 
531. static int nsv_read_chunk(AVFormatContext *s, int fill_header)
     ^
532. {
533.     NSVContext *nsv = s->priv_data;

libavformat/nsvdec.c:531:1: Parameter `*s->streams`
529. }
530. 
531. static int nsv_read_chunk(AVFormatContext *s, int fill_header)
     ^
532. {
533.     NSVContext *nsv = s->priv_data;

libavformat/nsvdec.c:596:12: Array access: Offset: 1 Size: [0, 2147483631]
594.         st[s->streams[0]->id] = s->streams[0];
595.     if (s->nb_streams > 1)
596.         st[s->streams[1]->id] = s->streams[1];
                ^
597. 
598.     if (vsize && st[NSV_ST_VIDEO]) {

static int nsv_read_chunk(AVFormatContext *s, int fill_header)
{
    NSVContext *nsv = s->priv_data;
    AVIOContext *pb = s->pb;
    AVStream *st[2] = {NULL, NULL};
    NSVStream *nst;
    AVPacket *pkt;
    int i, err = 0;
    uint8_t auxcount;
    uint32_t vsize;
    uint16_t asize;
    uint16_t auxsize;
    av_dlog(s, "%s(%d)\n", __FUNCTION__, fill_header);
    if (nsv->ahead[0].data || nsv->ahead[1].data)
        return 0;
null_chunk_retry:
    if (pb->eof_reached)
        return -1;
    for (i = 0; i < NSV_MAX_RESYNC_TRIES && nsv->state < NSV_FOUND_NSVS && !err; i++)
        err = nsv_resync(s);
    if (err < 0)
        return err;
    if (nsv->state == NSV_FOUND_NSVS)
        err = nsv_parse_NSVs_header(s);
    if (err < 0)
        return err;
    if (nsv->state != NSV_HAS_READ_NSVS && nsv->state != NSV_FOUND_BEEF)
        return -1;
    auxcount = avio_r8(pb);
    vsize = avio_rl16(pb);
    asize = avio_rl16(pb);
    vsize = (vsize << 4) | (auxcount >> 4);
    auxcount &= 0x0f;
    av_dlog(s, "NSV CHUNK %d aux, %u bytes video, %d bytes audio\n", auxcount, vsize, asize);
    for (i = 0; i < auxcount; i++) {
        uint32_t av_unused auxtag;
        auxsize = avio_rl16(pb);
        auxtag = avio_rl32(pb);
        av_dlog(s, "NSV aux data: '%c%c%c%c', %d bytes\n",
              (auxtag & 0x0ff),
              ((auxtag >> 8) & 0x0ff),
              ((auxtag >> 16) & 0x0ff),
              ((auxtag >> 24) & 0x0ff),
              auxsize);
        avio_skip(pb, auxsize);
        vsize -= auxsize + sizeof(uint16_t) + sizeof(uint32_t);
    }
    if (pb->eof_reached)
        return -1;
    if (!vsize && !asize) {
        nsv->state = NSV_UNSYNC;
        goto null_chunk_retry;
    }
    if (s->nb_streams > 0)
        st[s->streams[0]->id] = s->streams[0];
    if (s->nb_streams > 1)
        st[s->streams[1]->id] = s->streams[1];
    if (vsize && st[NSV_ST_VIDEO]) {
        nst = st[NSV_ST_VIDEO]->priv_data;
        pkt = &nsv->ahead[NSV_ST_VIDEO];
        av_get_packet(pb, pkt, vsize);
        pkt->stream_index = st[NSV_ST_VIDEO]->index;
        pkt->dts = nst->frame_offset;
        pkt->flags |= nsv->state == NSV_HAS_READ_NSVS ? AV_PKT_FLAG_KEY : 0;
        for (i = 0; i < FFMIN(8, vsize); i++)
            av_dlog(s, "NSV video: [%d] = %02x\n", i, pkt->data[i]);
    }
    if(st[NSV_ST_VIDEO])
        ((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset++;
    if (asize && st[NSV_ST_AUDIO]) {
        nst = st[NSV_ST_AUDIO]->priv_data;
        pkt = &nsv->ahead[NSV_ST_AUDIO];
        if (asize && st[NSV_ST_AUDIO]->codec->codec_tag == MKTAG('P', 'C', 'M', ' ') ) {
            uint8_t bps;
            uint8_t channels;
            uint16_t samplerate;
            bps = avio_r8(pb);
            channels = avio_r8(pb);
            samplerate = avio_rl16(pb);
            asize-=4;
            av_dlog(s, "NSV RAWAUDIO: bps %d, nchan %d, srate %d\n", bps, channels, samplerate);
            if (fill_header) {
                st[NSV_ST_AUDIO]->need_parsing = AVSTREAM_PARSE_NONE;
                if (bps != 16) {
                    av_dlog(s, "NSV AUDIO bit/sample != 16 (%d)!!!\n", bps);
                }
                bps /= channels;
                if (bps == 8)
                    st[NSV_ST_AUDIO]->codec->codec_id = AV_CODEC_ID_PCM_U8;
                samplerate /= 4;
                channels = 1;
                st[NSV_ST_AUDIO]->codec->channels = channels;
                st[NSV_ST_AUDIO]->codec->sample_rate = samplerate;
                av_dlog(s, "NSV RAWAUDIO: bps %d, nchan %d, srate %d\n", bps, channels, samplerate);
            }
        }
        av_get_packet(pb, pkt, asize);
        pkt->stream_index = st[NSV_ST_AUDIO]->index;
        pkt->flags |= nsv->state == NSV_HAS_READ_NSVS ? AV_PKT_FLAG_KEY : 0;
        if( nsv->state == NSV_HAS_READ_NSVS && st[NSV_ST_VIDEO] ) {
            pkt->dts = (((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset-1);
            pkt->dts *= (int64_t)1000        * nsv->framerate.den;
            pkt->dts += (int64_t)nsv->avsync * nsv->framerate.num;
            av_dlog(s, "NSV AUDIO: sync:%d, dts:%"PRId64, nsv->avsync, pkt->dts);
        }
        nst->frame_offset++;
    }
    nsv->state = NSV_UNSYNC;
    return 0;
}
['static int nsv_read_chunk(AVFormatContext *s, int fill_header)\n{\n    NSVContext *nsv = s->priv_data;\n    AVIOContext *pb = s->pb;\n    AVStream *st[2] = {NULL, NULL};\n    NSVStream *nst;\n    AVPacket *pkt;\n    int i, err = 0;\n    uint8_t auxcount;\n    uint32_t vsize;\n    uint16_t asize;\n    uint16_t auxsize;\n    av_dlog(s, "%s(%d)\\n", __FUNCTION__, fill_header);\n    if (nsv->ahead[0].data || nsv->ahead[1].data)\n        return 0;\nnull_chunk_retry:\n    if (pb->eof_reached)\n        return -1;\n    for (i = 0; i < NSV_MAX_RESYNC_TRIES && nsv->state < NSV_FOUND_NSVS && !err; i++)\n        err = nsv_resync(s);\n    if (err < 0)\n        return err;\n    if (nsv->state == NSV_FOUND_NSVS)\n        err = nsv_parse_NSVs_header(s);\n    if (err < 0)\n        return err;\n    if (nsv->state != NSV_HAS_READ_NSVS && nsv->state != NSV_FOUND_BEEF)\n        return -1;\n    auxcount = avio_r8(pb);\n    vsize = avio_rl16(pb);\n    asize = avio_rl16(pb);\n    vsize = (vsize << 4) | (auxcount >> 4);\n    auxcount &= 0x0f;\n    av_dlog(s, "NSV CHUNK %d aux, %u bytes video, %d bytes audio\\n", auxcount, vsize, asize);\n    for (i = 0; i < auxcount; i++) {\n        uint32_t av_unused auxtag;\n        auxsize = avio_rl16(pb);\n        auxtag = avio_rl32(pb);\n        av_dlog(s, "NSV aux data: \'%c%c%c%c\', %d bytes\\n",\n              (auxtag & 0x0ff),\n              ((auxtag >> 8) & 0x0ff),\n              ((auxtag >> 16) & 0x0ff),\n              ((auxtag >> 24) & 0x0ff),\n              auxsize);\n        avio_skip(pb, auxsize);\n        vsize -= auxsize + sizeof(uint16_t) + sizeof(uint32_t);\n    }\n    if (pb->eof_reached)\n        return -1;\n    if (!vsize && !asize) {\n        nsv->state = NSV_UNSYNC;\n        goto null_chunk_retry;\n    }\n    if (s->nb_streams > 0)\n        st[s->streams[0]->id] = s->streams[0];\n    if (s->nb_streams > 1)\n        st[s->streams[1]->id] = s->streams[1];\n    if (vsize && st[NSV_ST_VIDEO]) {\n        nst = st[NSV_ST_VIDEO]->priv_data;\n        pkt = &nsv->ahead[NSV_ST_VIDEO];\n        av_get_packet(pb, pkt, vsize);\n        pkt->stream_index = st[NSV_ST_VIDEO]->index;\n        pkt->dts = nst->frame_offset;\n        pkt->flags |= nsv->state == NSV_HAS_READ_NSVS ? AV_PKT_FLAG_KEY : 0;\n        for (i = 0; i < FFMIN(8, vsize); i++)\n            av_dlog(s, "NSV video: [%d] = %02x\\n", i, pkt->data[i]);\n    }\n    if(st[NSV_ST_VIDEO])\n        ((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset++;\n    if (asize && st[NSV_ST_AUDIO]) {\n        nst = st[NSV_ST_AUDIO]->priv_data;\n        pkt = &nsv->ahead[NSV_ST_AUDIO];\n        if (asize && st[NSV_ST_AUDIO]->codec->codec_tag == MKTAG(\'P\', \'C\', \'M\', \' \') ) {\n            uint8_t bps;\n            uint8_t channels;\n            uint16_t samplerate;\n            bps = avio_r8(pb);\n            channels = avio_r8(pb);\n            samplerate = avio_rl16(pb);\n            asize-=4;\n            av_dlog(s, "NSV RAWAUDIO: bps %d, nchan %d, srate %d\\n", bps, channels, samplerate);\n            if (fill_header) {\n                st[NSV_ST_AUDIO]->need_parsing = AVSTREAM_PARSE_NONE;\n                if (bps != 16) {\n                    av_dlog(s, "NSV AUDIO bit/sample != 16 (%d)!!!\\n", bps);\n                }\n                bps /= channels;\n                if (bps == 8)\n                    st[NSV_ST_AUDIO]->codec->codec_id = AV_CODEC_ID_PCM_U8;\n                samplerate /= 4;\n                channels = 1;\n                st[NSV_ST_AUDIO]->codec->channels = channels;\n                st[NSV_ST_AUDIO]->codec->sample_rate = samplerate;\n                av_dlog(s, "NSV RAWAUDIO: bps %d, nchan %d, srate %d\\n", bps, channels, samplerate);\n            }\n        }\n        av_get_packet(pb, pkt, asize);\n        pkt->stream_index = st[NSV_ST_AUDIO]->index;\n        pkt->flags |= nsv->state == NSV_HAS_READ_NSVS ? AV_PKT_FLAG_KEY : 0;\n        if( nsv->state == NSV_HAS_READ_NSVS && st[NSV_ST_VIDEO] ) {\n            pkt->dts = (((NSVStream*)st[NSV_ST_VIDEO]->priv_data)->frame_offset-1);\n            pkt->dts *= (int64_t)1000        * nsv->framerate.den;\n            pkt->dts += (int64_t)nsv->avsync * nsv->framerate.num;\n            av_dlog(s, "NSV AUDIO: sync:%d, dts:%"PRId64, nsv->avsync, pkt->dts);\n        }\n        nst->frame_offset++;\n    }\n    nsv->state = NSV_UNSYNC;\n    return 0;\n}']