libavcodec/ffv1.c:1175: error: Buffer Overrun L3
  Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: 2 by call to `decode_rgb_frame`.

libavcodec/ffv1.c:1158:5: Assignment
1156.     FFV1Context *fs= *(void**)arg;
1157.     FFV1Context *f= fs->avctx->priv_data;
1158.     int width = fs->slice_width;
          ^
1159.     int height= fs->slice_height;
1160.     int x= fs->slice_x;

libavcodec/ffv1.c:1175:9: Call
1173.         decode_plane(fs, p->data[2] + cx+cy*p->linesize[1], chroma_width, chroma_height, p->linesize[2], 1);
1174.     }else{
1175.         decode_rgb_frame(fs, (uint32_t*)p->data[0] + x + y*(p->linesize[0]/4), width, height, p->linesize[0]/4);
              ^
1176.     }
1177. 

libavcodec/ffv1.c:1113:1: Array declaration
  1111. }
  1112. 
  1113. static void decode_rgb_frame(FFV1Context *s, uint32_t *src, int w, int h, int stride){
        ^
  1114.     int x, y, p;
  1115.     int_fast16_t *sample[3][2];

libavcodec/ffv1.c:1134:13: Call
  1132.             sample[p][1][-1]= sample[p][0][0  ];
  1133.             sample[p][0][ w]= sample[p][0][w-1];
  1134.             decode_line(s, w, sample[p], FFMIN(p, 1), 9);
                    ^
  1135.         }
  1136.         for(x=0; x<w; x++){

libavcodec/ffv1.c:1020:1: Parameter `w`
    1018. }
    1019. 
    1020. static av_always_inline void decode_line(FFV1Context *s, int w, int_fast16_t *sample[2], int plane_index, int bits){
          ^
    1021.     PlaneContext * const p= &s->plane[plane_index];
    1022.     RangeCoder * const c= &s->c;

libavcodec/ffv1.c:1073:24: Call
    1071.         if(sign) diff= -diff;
    1072. 
    1073.         sample[1][x]= (predict(sample[1] + x, sample[0] + x) + diff) & ((1<<bits)-1);
                                 ^
    1074.     }
    1075.     s->run_index= run_index;

libavcodec/ffv1.c:276:1: <Length trace>
274. }
275. 
276. static inline int predict(int_fast16_t *src, int_fast16_t *last){
     ^
277.     const int LT= last[-1];
278.     const int  T= last[ 0];

libavcodec/ffv1.c:276:1: Parameter `*last`
      274. }
      275. 
      276. static inline int predict(int_fast16_t *src, int_fast16_t *last){
           ^
      277.     const int LT= last[-1];
      278.     const int  T= last[ 0];

libavcodec/ffv1.c:277:19: Array access: Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: 2 by call to `decode_rgb_frame` 
      275. 
      276. static inline int predict(int_fast16_t *src, int_fast16_t *last){
      277.     const int LT= last[-1];
                             ^
      278.     const int  T= last[ 0];
      279.     const int L =  src[-1];

static inline int predict(int_fast16_t *src, int_fast16_t *last){
    const int LT= last[-1];
    const int  T= last[ 0];
    const int L =  src[-1];
    return mid_pred(L, L + T - LT, T);
}
['static int decode_slice(AVCodecContext *c, void *arg){\n    FFV1Context *fs= *(void**)arg;\n    FFV1Context *f= fs->avctx->priv_data;\n    int width = fs->slice_width;\n    int height= fs->slice_height;\n    int x= fs->slice_x;\n    int y= fs->slice_y;\n    AVFrame * const p= &f->picture;\n    av_assert1(width && height);\n    if(f->colorspace==0){\n        const int chroma_width = -((-width )>>f->chroma_h_shift);\n        const int chroma_height= -((-height)>>f->chroma_v_shift);\n        const int cx= x>>f->chroma_h_shift;\n        const int cy= y>>f->chroma_v_shift;\n        decode_plane(fs, p->data[0] + x + y*p->linesize[0], width, height, p->linesize[0], 0);\n        decode_plane(fs, p->data[1] + cx+cy*p->linesize[1], chroma_width, chroma_height, p->linesize[1], 1);\n        decode_plane(fs, p->data[2] + cx+cy*p->linesize[1], chroma_width, chroma_height, p->linesize[2], 1);\n    }else{\n        decode_rgb_frame(fs, (uint32_t*)p->data[0] + x + y*(p->linesize[0]/4), width, height, p->linesize[0]/4);\n    }\n    emms_c();\n    return 0;\n}', 'static void decode_rgb_frame(FFV1Context *s, uint32_t *src, int w, int h, int stride){\n    int x, y, p;\n    int_fast16_t *sample[3][2];\n    for(x=0; x<3; x++){\n        sample[x][0] = s->sample_buffer +  x*2   *(w+6) + 3;\n        sample[x][1] = s->sample_buffer + (x*2+1)*(w+6) + 3;\n    }\n    s->run_index=0;\n    memset(s->sample_buffer, 0, 6*(w+6)*sizeof(*s->sample_buffer));\n    for(y=0; y<h; y++){\n        for(p=0; p<3; p++){\n            int_fast16_t *temp= sample[p][0];\n            sample[p][0]= sample[p][1];\n            sample[p][1]= temp;\n            sample[p][1][-1]= sample[p][0][0  ];\n            sample[p][0][ w]= sample[p][0][w-1];\n            decode_line(s, w, sample[p], FFMIN(p, 1), 9);\n        }\n        for(x=0; x<w; x++){\n            int g= sample[0][1][x];\n            int b= sample[1][1][x];\n            int r= sample[2][1][x];\n            b -= 0x100;\n            r -= 0x100;\n            g -= (b + r)>>2;\n            b += g;\n            r += g;\n            src[x + stride*y]= b + (g<<8) + (r<<16) + (0xFF<<24);\n        }\n    }\n}', 'static av_always_inline void decode_line(FFV1Context *s, int w, int_fast16_t *sample[2], int plane_index, int bits){\n    PlaneContext * const p= &s->plane[plane_index];\n    RangeCoder * const c= &s->c;\n    int x;\n    int run_count=0;\n    int run_mode=0;\n    int run_index= s->run_index;\n    for(x=0; x<w; x++){\n        int diff, context, sign;\n        context= get_context(p, sample[1] + x, sample[0] + x, sample[1] + x);\n        if(context < 0){\n            context= -context;\n            sign=1;\n        }else\n            sign=0;\n        av_assert2(context < p->context_count);\n        if(s->ac){\n            diff= get_symbol_inline(c, p->state[context], 1);\n        }else{\n            if(context == 0 && run_mode==0) run_mode=1;\n            if(run_mode){\n                if(run_count==0 && run_mode==1){\n                    if(get_bits1(&s->gb)){\n                        run_count = 1<<ff_log2_run[run_index];\n                        if(x + run_count <= w) run_index++;\n                    }else{\n                        if(ff_log2_run[run_index]) run_count = get_bits(&s->gb, ff_log2_run[run_index]);\n                        else run_count=0;\n                        if(run_index) run_index--;\n                        run_mode=2;\n                    }\n                }\n                run_count--;\n                if(run_count < 0){\n                    run_mode=0;\n                    run_count=0;\n                    diff= get_vlc_symbol(&s->gb, &p->vlc_state[context], bits);\n                    if(diff>=0) diff++;\n                }else\n                    diff=0;\n            }else\n                diff= get_vlc_symbol(&s->gb, &p->vlc_state[context], bits);\n        }\n        if(sign) diff= -diff;\n        sample[1][x]= (predict(sample[1] + x, sample[0] + x) + diff) & ((1<<bits)-1);\n    }\n    s->run_index= run_index;\n}', 'static inline int predict(int_fast16_t *src, int_fast16_t *last){\n    const int LT= last[-1];\n    const int  T= last[ 0];\n    const int L =  src[-1];\n    return mid_pred(L, L + T - LT, T);\n}']