libavcodec/h264.c:3885: error: Buffer Overrun L1
  Offset: 510 Size: 3 by call to `ff_h264_init_cabac_states`.

libavcodec/h264.c:3881:9: Call
3879.         /* init cabac */
3880.         ff_init_cabac_states(&h->cabac);
3881.         ff_init_cabac_decoder(&h->cabac,
              ^
3882.                               s->gb.buffer + get_bits_count(&s->gb) / 8,
3883.                               (get_bits_left(&s->gb) + 7) / 8);

libavcodec/cabac.c:131:5: Assignment
  129. #endif
  130.     c->low+= ((*c->bytestream++)<<2) + 2;
  131.     c->range= 0x1FE;
           ^
  132. }
  133. 

libavcodec/h264.c:3885:9: Call
3883.                               (get_bits_left(&s->gb) + 7) / 8);
3884. 
3885.         ff_h264_init_cabac_states(h);
              ^
3886. 
3887.         for (;;) {

libavcodec/h264_cabac.c:1262:1: <Offset trace>
1260. };
1261. 
1262. void ff_h264_init_cabac_states(H264Context *h) {
      ^
1263.     MpegEncContext * const s = &h->s;
1264.     int i;

libavcodec/h264_cabac.c:1262:1: Parameter `h->cabac_init_idc`
  1260. };
  1261. 
  1262. void ff_h264_init_cabac_states(H264Context *h) {
        ^
  1263.     MpegEncContext * const s = &h->s;
  1264.     int i;

libavcodec/h264_cabac.c:362:1: <Length trace>
360. };
361. 
362. static const int8_t cabac_context_init_PB[3][1024][2] =
     ^
363. {
364.     /* i_cabac_init_idc == 0 */

libavcodec/h264_cabac.c:362:1: Array declaration
  360. };
  361. 
  362. static const int8_t cabac_context_init_PB[3][1024][2] =
       ^
  363. {
  364.     /* i_cabac_init_idc == 0 */

libavcodec/h264_cabac.c:1269:42: Array access: Offset: 510 Size: 3 by call to `ff_h264_init_cabac_states` 
  1267. 
  1268.     if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;
  1269.     else                                 tab = cabac_context_init_PB[h->cabac_init_idc];
                                                 ^
  1270. 
  1271.     /* calculate pre-state */

void ff_h264_init_cabac_states(H264Context *h) {
    MpegEncContext * const s = &h->s;
    int i;
    const int8_t (*tab)[2];
    const int slice_qp = av_clip(s->qscale - 6*(h->sps.bit_depth_luma-8), 0, 51);
    if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;
    else                                 tab = cabac_context_init_PB[h->cabac_init_idc];
    for( i= 0; i < 1024; i++ ) {
        int pre = 2*(((tab[i][0] * slice_qp) >>4 ) + tab[i][1]) - 127;
        pre^= pre>>31;
        if(pre > 124)
            pre= 124 + (pre&1);
        h->cabac_state[i] =  pre;
    }
}
['static int decode_slice(struct AVCodecContext *avctx, void *arg)\n{\n    H264Context *h = *(void **)arg;\n    MpegEncContext *const s = &h->s;\n    const int part_mask     = s->partitioned_frame ? (ER_AC_END | ER_AC_ERROR)\n                                                   : 0x7F;\n    int lf_x_start = s->mb_x;\n    s->mb_skip_run = -1;\n    h->is_complex = FRAME_MBAFF || s->picture_structure != PICT_FRAME ||\n                    s->codec_id != CODEC_ID_H264 ||\n                    (CONFIG_GRAY && (s->flags & CODEC_FLAG_GRAY));\n    if (h->pps.cabac) {\n        align_get_bits(&s->gb);\n        ff_init_cabac_states(&h->cabac);\n        ff_init_cabac_decoder(&h->cabac,\n                              s->gb.buffer + get_bits_count(&s->gb) / 8,\n                              (get_bits_left(&s->gb) + 7) / 8);\n        ff_h264_init_cabac_states(h);\n        for (;;) {\n            int ret = ff_h264_decode_mb_cabac(h);\n            int eos;\n            if (ret >= 0)\n                ff_h264_hl_decode_mb(h);\n            if (ret >= 0 && FRAME_MBAFF) {\n                s->mb_y++;\n                ret = ff_h264_decode_mb_cabac(h);\n                if (ret >= 0)\n                    ff_h264_hl_decode_mb(h);\n                s->mb_y--;\n            }\n            eos = get_cabac_terminate(&h->cabac);\n            if ((s->workaround_bugs & FF_BUG_TRUNCATED) &&\n                h->cabac.bytestream > h->cabac.bytestream_end + 2) {\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x - 1,\n                                s->mb_y, ER_MB_END & part_mask);\n                if (s->mb_x >= lf_x_start)\n                    loop_filter(h, lf_x_start, s->mb_x + 1);\n                return 0;\n            }\n            if (ret < 0 || h->cabac.bytestream > h->cabac.bytestream_end + 2) {\n                av_log(h->s.avctx, AV_LOG_ERROR,\n                       "error while decoding MB %d %d, bytestream (%td)\\n",\n                       s->mb_x, s->mb_y,\n                       h->cabac.bytestream_end - h->cabac.bytestream);\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x,\n                                s->mb_y, ER_MB_ERROR & part_mask);\n                return -1;\n            }\n            if (++s->mb_x >= s->mb_width) {\n                loop_filter(h, lf_x_start, s->mb_x);\n                s->mb_x = lf_x_start = 0;\n                decode_finish_row(h);\n                ++s->mb_y;\n                if (FIELD_OR_MBAFF_PICTURE) {\n                    ++s->mb_y;\n                    if (FRAME_MBAFF && s->mb_y < s->mb_height)\n                        predict_field_decoding_flag(h);\n                }\n            }\n            if (eos || s->mb_y >= s->mb_height) {\n                tprintf(s->avctx, "slice end %d %d\\n",\n                        get_bits_count(&s->gb), s->gb.size_in_bits);\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x - 1,\n                                s->mb_y, ER_MB_END & part_mask);\n                if (s->mb_x > lf_x_start)\n                    loop_filter(h, lf_x_start, s->mb_x);\n                return 0;\n            }\n        }\n    } else {\n        for (;;) {\n            int ret = ff_h264_decode_mb_cavlc(h);\n            if (ret >= 0)\n                ff_h264_hl_decode_mb(h);\n            if (ret >= 0 && FRAME_MBAFF) {\n                s->mb_y++;\n                ret = ff_h264_decode_mb_cavlc(h);\n                if (ret >= 0)\n                    ff_h264_hl_decode_mb(h);\n                s->mb_y--;\n            }\n            if (ret < 0) {\n                av_log(h->s.avctx, AV_LOG_ERROR,\n                       "error while decoding MB %d %d\\n", s->mb_x, s->mb_y);\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x,\n                                s->mb_y, ER_MB_ERROR & part_mask);\n                return -1;\n            }\n            if (++s->mb_x >= s->mb_width) {\n                loop_filter(h, lf_x_start, s->mb_x);\n                s->mb_x = lf_x_start = 0;\n                decode_finish_row(h);\n                ++s->mb_y;\n                if (FIELD_OR_MBAFF_PICTURE) {\n                    ++s->mb_y;\n                    if (FRAME_MBAFF && s->mb_y < s->mb_height)\n                        predict_field_decoding_flag(h);\n                }\n                if (s->mb_y >= s->mb_height) {\n                    tprintf(s->avctx, "slice end %d %d\\n",\n                            get_bits_count(&s->gb), s->gb.size_in_bits);\n                    if (get_bits_left(&s->gb) == 0) {\n                        ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y,\n                                        s->mb_x - 1, s->mb_y,\n                                        ER_MB_END & part_mask);\n                        return 0;\n                    } else {\n                        ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y,\n                                        s->mb_x, s->mb_y,\n                                        ER_MB_END & part_mask);\n                        return -1;\n                    }\n                }\n            }\n            if (get_bits_left(&s->gb) <= 0 && s->mb_skip_run <= 0) {\n                tprintf(s->avctx, "slice end %d %d\\n",\n                        get_bits_count(&s->gb), s->gb.size_in_bits);\n                if (get_bits_left(&s->gb) == 0) {\n                    ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y,\n                                    s->mb_x - 1, s->mb_y,\n                                    ER_MB_END & part_mask);\n                    if (s->mb_x > lf_x_start)\n                        loop_filter(h, lf_x_start, s->mb_x);\n                    return 0;\n                } else {\n                    ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x,\n                                    s->mb_y, ER_MB_ERROR & part_mask);\n                    return -1;\n                }\n            }\n        }\n    }\n}', 'void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){\n    c->bytestream_start=\n    c->bytestream= buf;\n    c->bytestream_end= buf + buf_size;\n#if CABAC_BITS == 16\n    c->low =  (*c->bytestream++)<<18;\n    c->low+=  (*c->bytestream++)<<10;\n#else\n    c->low =  (*c->bytestream++)<<10;\n#endif\n    c->low+= ((*c->bytestream++)<<2) + 2;\n    c->range= 0x1FE;\n}', 'void ff_h264_init_cabac_states(H264Context *h) {\n    MpegEncContext * const s = &h->s;\n    int i;\n    const int8_t (*tab)[2];\n    const int slice_qp = av_clip(s->qscale - 6*(h->sps.bit_depth_luma-8), 0, 51);\n    if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;\n    else                                 tab = cabac_context_init_PB[h->cabac_init_idc];\n    for( i= 0; i < 1024; i++ ) {\n        int pre = 2*(((tab[i][0] * slice_qp) >>4 ) + tab[i][1]) - 127;\n        pre^= pre>>31;\n        if(pre > 124)\n            pre= 124 + (pre&1);\n        h->cabac_state[i] =  pre;\n    }\n}']