libavcodec/vp8.c:1348: error: Buffer Overrun L1
  Offset: [9, 10] Size: 3 by call to `vp8_decode_block_coeffs_internal`.

libavcodec/vp8.c:1337:1: Parameter `(*probs)[*]`
1335.  *         otherwise, the index of the last coeff decoded plus one
1336.  */
1337. static av_always_inline
      ^
1338. int decode_block_coeffs(VP56RangeCoder *c, int16_t block[16],
1339.                         uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:1343:5: Assignment
1341.                         const uint8_t scan[16], int vp7)
1342. {
1343.     uint8_t *token_prob = probs[i][zero_nhood];
          ^
1344.     if (!vp56_rac_get_prob_branchy(c, token_prob[0]))   // DCT_EOB
1345.         return 0;

libavcodec/vp8.c:1348:18: Call
1346.     return vp7 ? vp7_decode_block_coeffs_internal(c, block, probs, i,
1347.                                                   token_prob, qmul, scan)
1348.                : vp8_decode_block_coeffs_internal(c, block, probs, i,
                       ^
1349.                                                   token_prob, qmul);
1350. }

libavcodec/vp8.c:1314:1: Parameter `*token_prob`
  1312. 
  1313. #ifndef vp8_decode_block_coeffs_internal
  1314. static int vp8_decode_block_coeffs_internal(VP56RangeCoder *r,
        ^
  1315.                                             int16_t block[16],
  1316.                                             uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:1320:12: Call
  1318.                                             int16_t qmul[2])
  1319. {
  1320.     return decode_block_coeffs_internal(r, block, probs, i,
                   ^
  1321.                                         token_prob, qmul, ff_zigzag_scan, IS_VP8);
  1322. }

libavcodec/vp8.c:1263:31: <Offset trace>
1261.                     }
1262.                 } else {    // DCT_CAT3 and up
1263.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                                    ^
1264.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
1265.                     int cat = (a << 1) + b;

libavcodec/vp8.c:1263:31: Call
    1261.                     }
    1262.                 } else {    // DCT_CAT3 and up
    1263.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                                        ^
    1264.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
    1265.                     int cat = (a << 1) + b;

libavcodec/vp56.h:249:15: Assignment
      247.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
      248.     unsigned int low_shift = low << 16;
      249.     int bit = code_word >= low_shift;
                         ^
      250. 
      251.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:249:5: Assignment
      247.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
      248.     unsigned int low_shift = low << 16;
      249.     int bit = code_word >= low_shift;
               ^
      250. 
      251.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:254:5: Assignment
      252.     c->code_word = bit ? code_word - low_shift : code_word;
      253. 
      254.     return bit;
               ^
      255. }
      256. #endif

libavcodec/vp8.c:1263:21: Assignment
    1261.                     }
    1262.                 } else {    // DCT_CAT3 and up
    1263.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                              ^
    1264.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
    1265.                     int cat = (a << 1) + b;

libavcodec/vp8.c:1219:1: <Length trace>
1217.  *         otherwise, the index of the last coeff decoded plus one
1218.  */
1219. static av_always_inline
      ^
1220. int decode_block_coeffs_internal(VP56RangeCoder *r, int16_t block[16],
1221.                                  uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:1219:1: Parameter `*token_prob`
    1217.  *         otherwise, the index of the last coeff decoded plus one
    1218.  */
    1219. static av_always_inline
          ^
    1220. int decode_block_coeffs_internal(VP56RangeCoder *r, int16_t block[16],
    1221.                                  uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:1264:53: Array access: Offset: [9, 10] Size: 3 by call to `vp8_decode_block_coeffs_internal` 
    1262.                 } else {    // DCT_CAT3 and up
    1263.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
    1264.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
                                                              ^
    1265.                     int cat = (a << 1) + b;
    1266.                     coeff  = 3 + (8 << cat);

static av_always_inline
int decode_block_coeffs_internal(VP56RangeCoder *r, int16_t block[16],
                                 uint8_t probs[16][3][NUM_DCT_TOKENS - 1],
                                 int i, uint8_t *token_prob, int16_t qmul[2],
                                 const uint8_t scan[16], int vp7)
{
    VP56RangeCoder c = *r;
    goto skip_eob;
    do {
        int coeff;
restart:
        if (!vp56_rac_get_prob_branchy(&c, token_prob[0]))
            break;
skip_eob:
        if (!vp56_rac_get_prob_branchy(&c, token_prob[1])) {
            if (++i == 16)
                break;
            token_prob = probs[i][0];
            if (vp7)
                goto restart;
            goto skip_eob;
        }
        if (!vp56_rac_get_prob_branchy(&c, token_prob[2])) {
            coeff = 1;
            token_prob = probs[i + 1][1];
        } else {
            if (!vp56_rac_get_prob_branchy(&c, token_prob[3])) {
                coeff = vp56_rac_get_prob_branchy(&c, token_prob[4]);
                if (coeff)
                    coeff += vp56_rac_get_prob(&c, token_prob[5]);
                coeff += 2;
            } else {
                if (!vp56_rac_get_prob_branchy(&c, token_prob[6])) {
                    if (!vp56_rac_get_prob_branchy(&c, token_prob[7])) {
                        coeff = 5 + vp56_rac_get_prob(&c, vp8_dct_cat1_prob[0]);
                    } else {
                        coeff  = 7;
                        coeff += vp56_rac_get_prob(&c, vp8_dct_cat2_prob[0]) << 1;
                        coeff += vp56_rac_get_prob(&c, vp8_dct_cat2_prob[1]);
                    }
                } else {
                    int a   = vp56_rac_get_prob(&c, token_prob[8]);
                    int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
                    int cat = (a << 1) + b;
                    coeff  = 3 + (8 << cat);
                    coeff += vp8_rac_get_coeff(&c, ff_vp8_dct_cat_prob[cat]);
                }
            }
            token_prob = probs[i + 1][2];
        }
        block[scan[i]] = (vp8_rac_get(&c) ? -coeff : coeff) * qmul[!!i];
    } while (++i < 16);
    *r = c;
    return i;
}
['static av_always_inline\nint decode_block_coeffs(VP56RangeCoder *c, int16_t block[16],\n                        uint8_t probs[16][3][NUM_DCT_TOKENS - 1],\n                        int i, int zero_nhood, int16_t qmul[2],\n                        const uint8_t scan[16], int vp7)\n{\n    uint8_t *token_prob = probs[i][zero_nhood];\n    if (!vp56_rac_get_prob_branchy(c, token_prob[0]))\n        return 0;\n    return vp7 ? vp7_decode_block_coeffs_internal(c, block, probs, i,\n                                                  token_prob, qmul, scan)\n               : vp8_decode_block_coeffs_internal(c, block, probs, i,\n                                                  token_prob, qmul);\n}', 'static int vp8_decode_block_coeffs_internal(VP56RangeCoder *r,\n                                            int16_t block[16],\n                                            uint8_t probs[16][3][NUM_DCT_TOKENS - 1],\n                                            int i, uint8_t *token_prob,\n                                            int16_t qmul[2])\n{\n    return decode_block_coeffs_internal(r, block, probs, i,\n                                        token_prob, qmul, ff_zigzag_scan, IS_VP8);\n}', 'static av_always_inline\nint decode_block_coeffs_internal(VP56RangeCoder *r, int16_t block[16],\n                                 uint8_t probs[16][3][NUM_DCT_TOKENS - 1],\n                                 int i, uint8_t *token_prob, int16_t qmul[2],\n                                 const uint8_t scan[16], int vp7)\n{\n    VP56RangeCoder c = *r;\n    goto skip_eob;\n    do {\n        int coeff;\nrestart:\n        if (!vp56_rac_get_prob_branchy(&c, token_prob[0]))\n            break;\nskip_eob:\n        if (!vp56_rac_get_prob_branchy(&c, token_prob[1])) {\n            if (++i == 16)\n                break;\n            token_prob = probs[i][0];\n            if (vp7)\n                goto restart;\n            goto skip_eob;\n        }\n        if (!vp56_rac_get_prob_branchy(&c, token_prob[2])) {\n            coeff = 1;\n            token_prob = probs[i + 1][1];\n        } else {\n            if (!vp56_rac_get_prob_branchy(&c, token_prob[3])) {\n                coeff = vp56_rac_get_prob_branchy(&c, token_prob[4]);\n                if (coeff)\n                    coeff += vp56_rac_get_prob(&c, token_prob[5]);\n                coeff += 2;\n            } else {\n                if (!vp56_rac_get_prob_branchy(&c, token_prob[6])) {\n                    if (!vp56_rac_get_prob_branchy(&c, token_prob[7])) {\n                        coeff = 5 + vp56_rac_get_prob(&c, vp8_dct_cat1_prob[0]);\n                    } else {\n                        coeff  = 7;\n                        coeff += vp56_rac_get_prob(&c, vp8_dct_cat2_prob[0]) << 1;\n                        coeff += vp56_rac_get_prob(&c, vp8_dct_cat2_prob[1]);\n                    }\n                } else {\n                    int a   = vp56_rac_get_prob(&c, token_prob[8]);\n                    int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);\n                    int cat = (a << 1) + b;\n                    coeff  = 3 + (8 << cat);\n                    coeff += vp8_rac_get_coeff(&c, ff_vp8_dct_cat_prob[cat]);\n                }\n            }\n            token_prob = probs[i + 1][2];\n        }\n        block[scan[i]] = (vp8_rac_get(&c) ? -coeff : coeff) * qmul[!!i];\n    } while (++i < 16);\n    *r = c;\n    return i;\n}', 'static av_always_inline int vp56_rac_get_prob(VP56RangeCoder *c, uint8_t prob)\n{\n    unsigned int code_word = vp56_rac_renorm(c);\n    unsigned int low = 1 + (((c->high - 1) * prob) >> 8);\n    unsigned int low_shift = low << 16;\n    int bit = code_word >= low_shift;\n    c->high = bit ? c->high - low : low;\n    c->code_word = bit ? code_word - low_shift : code_word;\n    return bit;\n}']