libavcodec/vc1dec.c:4851: error: Buffer Overrun L1
  Offset: [6, `v->two_sprites` + 6] (⇐ [0, `v->two_sprites`] + 6) Size: 2 by call to `vc1_sprite_parse_transform`.

libavcodec/vc1dec.c:4845:1: Parameter `sd->coefs[*]`
4843. }
4844. 
4845. static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)
      ^
4846. {
4847.     AVCodecContext *avctx = v->s.avctx;

libavcodec/vc1dec.c:4851:9: Call
4849. 
4850.     for (sprite = 0; sprite <= v->two_sprites; sprite++) {
4851.         vc1_sprite_parse_transform(gb, sd->coefs[sprite]);
              ^
4852.         if (sd->coefs[sprite][1] || sd->coefs[sprite][3])
4853.             avpriv_request_sample(avctx, "Non-zero rotation coefficients");

libavcodec/vc1dec.c:4811:1: <Length trace>
4809. }
4810. 
4811. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      ^
4812. {
4813.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:4811:1: Parameter `*c`
  4809. }
  4810. 
  4811. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
        ^
  4812. {
  4813.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:4840:9: Array access: Offset: [6, v->two_sprites + 6] (⇐ [0, v->two_sprites] + 6) Size: 2 by call to `vc1_sprite_parse_transform` 
  4838.     c[5] = get_fp_val(gb);
  4839.     if (get_bits1(gb))
  4840.         c[6] = get_fp_val(gb);
                ^
  4841.     else
  4842.         c[6] = 1 << 16;

static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
{
    c[1] = c[3] = 0;
    switch (get_bits(gb, 2)) {
    case 0:
        c[0] = 1 << 16;
        c[2] = get_fp_val(gb);
        c[4] = 1 << 16;
        break;
    case 1:
        c[0] = c[4] = get_fp_val(gb);
        c[2] = get_fp_val(gb);
        break;
    case 2:
        c[0] = get_fp_val(gb);
        c[2] = get_fp_val(gb);
        c[4] = get_fp_val(gb);
        break;
    case 3:
        c[0] = get_fp_val(gb);
        c[1] = get_fp_val(gb);
        c[2] = get_fp_val(gb);
        c[3] = get_fp_val(gb);
        c[4] = get_fp_val(gb);
        break;
    }
    c[5] = get_fp_val(gb);
    if (get_bits1(gb))
        c[6] = get_fp_val(gb);
    else
        c[6] = 1 << 16;
}
['static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)\n{\n    AVCodecContext *avctx = v->s.avctx;\n    int sprite, i;\n    for (sprite = 0; sprite <= v->two_sprites; sprite++) {\n        vc1_sprite_parse_transform(gb, sd->coefs[sprite]);\n        if (sd->coefs[sprite][1] || sd->coefs[sprite][3])\n            avpriv_request_sample(avctx, "Non-zero rotation coefficients");\n        av_log(avctx, AV_LOG_DEBUG, sprite ? "S2:" : "S1:");\n        for (i = 0; i < 7; i++)\n            av_log(avctx, AV_LOG_DEBUG, " %d.%.3d",\n                   sd->coefs[sprite][i] / (1<<16),\n                   (abs(sd->coefs[sprite][i]) & 0xFFFF) * 1000 / (1 << 16));\n        av_log(avctx, AV_LOG_DEBUG, "\\n");\n    }\n    skip_bits(gb, 2);\n    if (sd->effect_type = get_bits_long(gb, 30)) {\n        switch (sd->effect_pcount1 = get_bits(gb, 4)) {\n        case 7:\n            vc1_sprite_parse_transform(gb, sd->effect_params1);\n            break;\n        case 14:\n            vc1_sprite_parse_transform(gb, sd->effect_params1);\n            vc1_sprite_parse_transform(gb, sd->effect_params1 + 7);\n            break;\n        default:\n            for (i = 0; i < sd->effect_pcount1; i++)\n                sd->effect_params1[i] = get_fp_val(gb);\n        }\n        if (sd->effect_type != 13 || sd->effect_params1[0] != sd->coefs[0][6]) {\n            av_log(avctx, AV_LOG_DEBUG, "Effect: %d; params: ", sd->effect_type);\n            for (i = 0; i < sd->effect_pcount1; i++)\n                av_log(avctx, AV_LOG_DEBUG, " %d.%.2d",\n                       sd->effect_params1[i] / (1 << 16),\n                       (abs(sd->effect_params1[i]) & 0xFFFF) * 1000 / (1 << 16));\n            av_log(avctx, AV_LOG_DEBUG, "\\n");\n        }\n        sd->effect_pcount2 = get_bits(gb, 16);\n        if (sd->effect_pcount2 > 10) {\n            av_log(avctx, AV_LOG_ERROR, "Too many effect parameters\\n");\n            return;\n        } else if (sd->effect_pcount2) {\n            i = -1;\n            av_log(avctx, AV_LOG_DEBUG, "Effect params 2: ");\n            while (++i < sd->effect_pcount2) {\n                sd->effect_params2[i] = get_fp_val(gb);\n                av_log(avctx, AV_LOG_DEBUG, " %d.%.2d",\n                       sd->effect_params2[i] / (1 << 16),\n                       (abs(sd->effect_params2[i]) & 0xFFFF) * 1000 / (1 << 16));\n            }\n            av_log(avctx, AV_LOG_DEBUG, "\\n");\n        }\n    }\n    if (sd->effect_flag = get_bits1(gb))\n        av_log(avctx, AV_LOG_DEBUG, "Effect flag set\\n");\n    if (get_bits_count(gb) >= gb->size_in_bits +\n       (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE ? 64 : 0))\n        av_log(avctx, AV_LOG_ERROR, "Buffer overrun\\n");\n    if (get_bits_count(gb) < gb->size_in_bits - 8)\n        av_log(avctx, AV_LOG_WARNING, "Buffer not fully read\\n");\n}', 'static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])\n{\n    c[1] = c[3] = 0;\n    switch (get_bits(gb, 2)) {\n    case 0:\n        c[0] = 1 << 16;\n        c[2] = get_fp_val(gb);\n        c[4] = 1 << 16;\n        break;\n    case 1:\n        c[0] = c[4] = get_fp_val(gb);\n        c[2] = get_fp_val(gb);\n        break;\n    case 2:\n        c[0] = get_fp_val(gb);\n        c[2] = get_fp_val(gb);\n        c[4] = get_fp_val(gb);\n        break;\n    case 3:\n        c[0] = get_fp_val(gb);\n        c[1] = get_fp_val(gb);\n        c[2] = get_fp_val(gb);\n        c[3] = get_fp_val(gb);\n        c[4] = get_fp_val(gb);\n        break;\n    }\n    c[5] = get_fp_val(gb);\n    if (get_bits1(gb))\n        c[6] = get_fp_val(gb);\n    else\n        c[6] = 1 << 16;\n}']