libavformat/mov.c:1875: error: Buffer Overrun L2
  Offset: [0, 7] Size: 3 by call to `dv_produce_packet`.

libavformat/mov.c:1872:5: Call
1870.         return -1;
1871.     }
1872.     av_get_packet(sc->pb, pkt, sample->size);
          ^
1873. #ifdef CONFIG_DV_DEMUXER
1874.     if (mov->dv_demux && sc->dv_audio_container) {

libavformat/utils.c:276:1: Parameter `*pkt->data`
  274. }
  275. 
  276. int av_get_packet(ByteIOContext *s, AVPacket *pkt, int size)
       ^
  277. {
  278.     int ret= av_new_packet(pkt, size);

libavformat/mov.c:1875:9: Call
1873. #ifdef CONFIG_DV_DEMUXER
1874.     if (mov->dv_demux && sc->dv_audio_container) {
1875.         dv_produce_packet(mov->dv_demux, pkt, pkt->data, pkt->size);
              ^
1876.         av_free(pkt->data);
1877.         pkt->size = 0;

libavformat/dv.c:317:1: Parameter `*buf`
  315. }
  316. 
  317. int dv_produce_packet(DVDemuxContext *c, AVPacket *pkt,
       ^
  318.                       uint8_t* buf, int buf_size)
  319. {

libavformat/dv.c:324:20: Call
  322. 
  323.     if (buf_size < DV_PROFILE_BYTES ||
  324.         !(c->sys = dv_frame_profile(buf)) ||
                          ^
  325.         buf_size < c->sys->frame_size) {
  326.           return -1;   /* Broken frame, or not enough data */

libavcodec/dvdata.h:6380:1: Parameter `*frame`
    6378. #define DV_MAX_BPM 8
    6379. 
    6380. static inline const DVprofile* dv_frame_profile(const uint8_t* frame)
          ^
    6381. {
    6382.    int i;

libavformat/dv.c:331:12: Call
  329.     /* Queueing audio packet */
  330.     /* FIXME: in case of no audio/bad audio we have to do something */
  331.     size = dv_extract_audio_info(c, buf);
                  ^
  332.     for (i=0; i<c->ach; i++) {
  333.        c->audio_pkt[i].size = size;

libavformat/dv.c:187:1: Parameter `*frame`
    185. }
    186. 
    187. static int dv_extract_audio_info(DVDemuxContext* c, uint8_t* frame)
         ^
    188. {
    189.     const uint8_t* as_pack;

libavformat/dv.c:192:15: Call
    190.     int freq, stype, smpls, quant, i, ach;
    191. 
    192.     as_pack = dv_extract_pack(frame, dv_audio_source);
                       ^
    193.     if (!as_pack || !c->sys) {    /* No audio ? */
    194.         c->ach = 0;

libavformat/dv.c:73:1: Parameter `t`
      71.  * to have a fallback mechanism for complete search of missing packs.
      72.  */
      73. static const uint8_t* dv_extract_pack(uint8_t* frame, enum dv_pack_type t)
          ^
      74. {
      75.     int offs;

libavformat/dv.c:337:5: Call
  335.        ppcm[i] = c->audio_buf[i];
  336.     }
  337.     dv_extract_audio(buf, ppcm, c->sys);
           ^
  338.     c->abytes += size;
  339. 

libavformat/dv.c:102:1: <Offset trace>
100.  *    are converted into 16bit linear ones.
101.  */
102. static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
     ^
103.                             const DVprofile *sys)
104. {

libavformat/dv.c:102:1: Parameter `*frame`
    100.  *    are converted into 16bit linear ones.
    101.  */
    102. static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
         ^
    103.                             const DVprofile *sys)
    104. {

libavformat/dv.c:110:15: Call
    108.     uint8_t *pcm, ipcm;
    109. 
    110.     as_pack = dv_extract_pack(frame, dv_audio_source);
                       ^
    111.     if (!as_pack)    /* No audio ? */
    112.         return 0;

libavformat/dv.c:73:1: Parameter `t`
      71.  * to have a fallback mechanism for complete search of missing packs.
      72.  */
      73. static const uint8_t* dv_extract_pack(uint8_t* frame, enum dv_pack_type t)
          ^
      74. {
      75.     int offs;

libavformat/dv.c:115:5: Assignment
    113. 
    114.     smpls = as_pack[1] & 0x3f; /* samples in this frame - min. samples */
    115.     freq = (as_pack[4] >> 3) & 0x07; /* 0 - 48KHz, 1 - 44,1kHz, 2 - 32 kHz */
             ^
    116.     quant = as_pack[4] & 0x07; /* 0 - 16bit linear, 1 - 12bit nonlinear */
    117. 

libavformat/dv.c:102:1: <Length trace>
100.  *    are converted into 16bit linear ones.
101.  */
102. static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
     ^
103.                             const DVprofile *sys)
104. {

libavformat/dv.c:102:1: Parameter `sys->audio_min_samples[*]`
    100.  *    are converted into 16bit linear ones.
    101.  */
    102. static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
         ^
    103.                             const DVprofile *sys)
    104. {

libavformat/dv.c:121:13: Array access: Offset: [0, 7] Size: 3 by call to `dv_produce_packet` 
    119.         return -1; /* Unsupported quantization */
    120. 
    121.     size = (sys->audio_min_samples[freq] + smpls) * 4; /* 2ch, 2bytes */
                     ^
    122.     half_ch = sys->difseg_size/2;
    123. 

static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
                            const DVprofile *sys)
{
    int size, chan, i, j, d, of, smpls, freq, quant, half_ch;
    uint16_t lc, rc;
    const uint8_t* as_pack;
    uint8_t *pcm, ipcm;
    as_pack = dv_extract_pack(frame, dv_audio_source);
    if (!as_pack)
        return 0;
    smpls = as_pack[1] & 0x3f;
    freq = (as_pack[4] >> 3) & 0x07;
    quant = as_pack[4] & 0x07;
    if (quant > 1)
        return -1;
    size = (sys->audio_min_samples[freq] + smpls) * 4;
    half_ch = sys->difseg_size/2;
    ipcm = (sys->height == 720 && ((frame[1]>>2)&0x3) == 0)?2:0;
    pcm = ppcm[ipcm++];
    for (chan = 0; chan < sys->n_difchan; chan++) {
        for (i = 0; i < sys->difseg_size; i++) {
            frame += 6 * 80;
            if (quant == 1 && i == half_ch) {
                pcm = ppcm[ipcm++];
                if (!pcm)
                    break;
            }
            for (j = 0; j < 9; j++) {
                for (d = 8; d < 80; d += 2) {
                    if (quant == 0) {
                        of = sys->audio_shuffle[i][j] + (d - 8)/2 * sys->audio_stride;
                        if (of*2 >= size)
                            continue;
                        pcm[of*2] = frame[d+1];
                        pcm[of*2+1] = frame[d];
                        if (pcm[of*2+1] == 0x80 && pcm[of*2] == 0x00)
                            pcm[of*2+1] = 0;
                    } else {
                        lc = ((uint16_t)frame[d] << 4) |
                             ((uint16_t)frame[d+2] >> 4);
                        rc = ((uint16_t)frame[d+1] << 4) |
                             ((uint16_t)frame[d+2] & 0x0f);
                        lc = (lc == 0x800 ? 0 : dv_audio_12to16(lc));
                        rc = (rc == 0x800 ? 0 : dv_audio_12to16(rc));
                        of = sys->audio_shuffle[i%half_ch][j] + (d - 8)/3 * sys->audio_stride;
                        if (of*2 >= size)
                            continue;
                        pcm[of*2] = lc & 0xff;
                        pcm[of*2+1] = lc >> 8;
                        of = sys->audio_shuffle[i%half_ch+half_ch][j] +
                            (d - 8)/3 * sys->audio_stride;
                        pcm[of*2] = rc & 0xff;
                        pcm[of*2+1] = rc >> 8;
                        ++d;
                    }
                }
                frame += 16 * 80;
            }
        }
        pcm = ppcm[ipcm++];
        if (!pcm)
            break;
    }
    return size;
}
['static int mov_read_packet(AVFormatContext *s, AVPacket *pkt)\n{\n    MOVContext *mov = s->priv_data;\n    MOVStreamContext *sc = 0;\n    AVIndexEntry *sample = 0;\n    int64_t best_dts = INT64_MAX;\n    int i;\n retry:\n    for (i = 0; i < s->nb_streams; i++) {\n        AVStream *st = s->streams[i];\n        MOVStreamContext *msc = st->priv_data;\n        if (st->discard != AVDISCARD_ALL && msc->pb && msc->current_sample < msc->sample_count) {\n            AVIndexEntry *current_sample = &st->index_entries[msc->current_sample];\n            int64_t dts = av_rescale(current_sample->timestamp * (int64_t)msc->time_rate,\n                                     AV_TIME_BASE, msc->time_scale);\n            dprintf(s, "stream %d, sample %d, dts %"PRId64"\\n", i, msc->current_sample, dts);\n            if (!sample || (url_is_streamed(s->pb) && current_sample->pos < sample->pos) ||\n                (!url_is_streamed(s->pb) &&\n                 ((msc->pb != s->pb && dts < best_dts) || (msc->pb == s->pb &&\n                 ((FFABS(best_dts - dts) <= AV_TIME_BASE && current_sample->pos < sample->pos) ||\n                  (FFABS(best_dts - dts) > AV_TIME_BASE && dts < best_dts)))))) {\n                sample = current_sample;\n                best_dts = dts;\n                sc = msc;\n            }\n        }\n    }\n    if (!sample) {\n        mov->found_mdat = 0;\n        if (!url_is_streamed(s->pb) ||\n            mov_read_default(mov, s->pb, (MOV_atom_t){ 0, 0, INT64_MAX }) < 0 ||\n            url_feof(s->pb))\n            return -1;\n        dprintf(s, "read fragments, offset 0x%llx\\n", url_ftell(s->pb));\n        goto retry;\n    }\n    sc->current_sample++;\n    if (url_fseek(sc->pb, sample->pos, SEEK_SET) != sample->pos) {\n        av_log(mov->fc, AV_LOG_ERROR, "stream %d, offset 0x%"PRIx64": partial file\\n",\n               sc->ffindex, sample->pos);\n        return -1;\n    }\n    av_get_packet(sc->pb, pkt, sample->size);\n#ifdef CONFIG_DV_DEMUXER\n    if (mov->dv_demux && sc->dv_audio_container) {\n        dv_produce_packet(mov->dv_demux, pkt, pkt->data, pkt->size);\n        av_free(pkt->data);\n        pkt->size = 0;\n        if (dv_get_packet(mov->dv_demux, pkt) < 0)\n            return -1;\n    }\n#endif\n    pkt->stream_index = sc->ffindex;\n    pkt->dts = sample->timestamp;\n    if (sc->ctts_data) {\n        assert(sc->ctts_data[sc->sample_to_ctime_index].duration % sc->time_rate == 0);\n        pkt->pts = pkt->dts + sc->ctts_data[sc->sample_to_ctime_index].duration / sc->time_rate;\n        sc->sample_to_ctime_sample++;\n        if (sc->sample_to_ctime_index < sc->ctts_count &&\n            sc->ctts_data[sc->sample_to_ctime_index].count == sc->sample_to_ctime_sample) {\n            sc->sample_to_ctime_index++;\n            sc->sample_to_ctime_sample = 0;\n        }\n    } else {\n        AVStream *st = s->streams[sc->ffindex];\n        int64_t next_dts = (sc->current_sample < sc->sample_count) ?\n            st->index_entries[sc->current_sample].timestamp : st->duration;\n        pkt->duration = next_dts - pkt->dts;\n        pkt->pts = pkt->dts;\n    }\n    pkt->flags |= sample->flags & AVINDEX_KEYFRAME ? PKT_FLAG_KEY : 0;\n    pkt->pos = sample->pos;\n    dprintf(s, "stream %d, pts %"PRId64", dts %"PRId64", pos 0x%"PRIx64", duration %d\\n",\n            pkt->stream_index, pkt->pts, pkt->dts, pkt->pos, pkt->duration);\n    return 0;\n}', 'int av_get_packet(ByteIOContext *s, AVPacket *pkt, int size)\n{\n    int ret= av_new_packet(pkt, size);\n    if(ret<0)\n        return ret;\n    pkt->pos= url_ftell(s);\n    ret= get_buffer(s, pkt->data, size);\n    if(ret<=0)\n        av_free_packet(pkt);\n    else\n        pkt->size= ret;\n    return ret;\n}', 'int dv_produce_packet(DVDemuxContext *c, AVPacket *pkt,\n                      uint8_t* buf, int buf_size)\n{\n    int size, i;\n    uint8_t *ppcm[4] = {0};\n    if (buf_size < DV_PROFILE_BYTES ||\n        !(c->sys = dv_frame_profile(buf)) ||\n        buf_size < c->sys->frame_size) {\n          return -1;\n    }\n    size = dv_extract_audio_info(c, buf);\n    for (i=0; i<c->ach; i++) {\n       c->audio_pkt[i].size = size;\n       c->audio_pkt[i].pts  = c->abytes * 30000*8 / c->ast[i]->codec->bit_rate;\n       ppcm[i] = c->audio_buf[i];\n    }\n    dv_extract_audio(buf, ppcm, c->sys);\n    c->abytes += size;\n    if (c->sys->height == 720) {\n        if (((buf[1]>>2)&0x3))\n            c->audio_pkt[2].size = c->audio_pkt[3].size = 0;\n        else\n            c->audio_pkt[0].size = c->audio_pkt[1].size = 0;\n    }\n    size = dv_extract_video_info(c, buf);\n    av_init_packet(pkt);\n    pkt->data     = buf;\n    pkt->size     = size;\n    pkt->flags   |= PKT_FLAG_KEY;\n    pkt->stream_index = c->vst->id;\n    pkt->pts      = c->frames;\n    c->frames++;\n    return size;\n}', 'static inline const DVprofile* dv_frame_profile(const uint8_t* frame)\n{\n   int i;\n   int dsf = (frame[3] & 0x80) >> 7;\n   int stype = frame[80*5 + 48 + 3] & 0x1f;\n   if (dsf == 1 && stype == 0 && frame[5] & 0x07) {\n       return &dv_profiles[2];\n   }\n   for (i=0; i<sizeof(dv_profiles)/sizeof(DVprofile); i++)\n       if (dsf == dv_profiles[i].dsf && stype == dv_profiles[i].video_stype)\n           return &dv_profiles[i];\n   return NULL;\n}', 'static int dv_extract_audio_info(DVDemuxContext* c, uint8_t* frame)\n{\n    const uint8_t* as_pack;\n    int freq, stype, smpls, quant, i, ach;\n    as_pack = dv_extract_pack(frame, dv_audio_source);\n    if (!as_pack || !c->sys) {\n        c->ach = 0;\n        return 0;\n    }\n    smpls = as_pack[1] & 0x3f;\n    freq = (as_pack[4] >> 3) & 0x07;\n    stype = (as_pack[3] & 0x1f);\n    quant = as_pack[4] & 0x07;\n    if (stype == 3) {\n        ach = 4;\n    } else\n    ach = (stype == 2 || (quant && (freq == 2))) ? 2 : 1;\n    for (i=0; i<ach; i++) {\n       if (!c->ast[i]) {\n           c->ast[i] = av_new_stream(c->fctx, 0);\n           if (!c->ast[i])\n               break;\n           av_set_pts_info(c->ast[i], 64, 1, 30000);\n           c->ast[i]->codec->codec_type = CODEC_TYPE_AUDIO;\n           c->ast[i]->codec->codec_id = CODEC_ID_PCM_S16LE;\n           av_init_packet(&c->audio_pkt[i]);\n           c->audio_pkt[i].size     = 0;\n           c->audio_pkt[i].data     = c->audio_buf[i];\n           c->audio_pkt[i].stream_index = c->ast[i]->index;\n           c->audio_pkt[i].flags |= PKT_FLAG_KEY;\n       }\n       c->ast[i]->codec->sample_rate = dv_audio_frequency[freq];\n       c->ast[i]->codec->channels = 2;\n       c->ast[i]->codec->bit_rate = 2 * dv_audio_frequency[freq] * 16;\n       c->ast[i]->start_time = 0;\n    }\n    c->ach = i;\n    return (c->sys->audio_min_samples[freq] + smpls) * 4;  ;\n}', 'static const uint8_t* dv_extract_pack(uint8_t* frame, enum dv_pack_type t)\n{\n    int offs;\n    switch (t) {\n    case dv_audio_source:\n          offs = (80*6 + 80*16*3 + 3);\n          break;\n    case dv_audio_control:\n          offs = (80*6 + 80*16*4 + 3);\n          break;\n    case dv_video_control:\n          offs = (80*5 + 48 + 5);\n          break;\n    default:\n          return NULL;\n    }\n    return frame[offs] == t ? &frame[offs] : NULL;\n}', 'static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],\n                            const DVprofile *sys)\n{\n    int size, chan, i, j, d, of, smpls, freq, quant, half_ch;\n    uint16_t lc, rc;\n    const uint8_t* as_pack;\n    uint8_t *pcm, ipcm;\n    as_pack = dv_extract_pack(frame, dv_audio_source);\n    if (!as_pack)\n        return 0;\n    smpls = as_pack[1] & 0x3f;\n    freq = (as_pack[4] >> 3) & 0x07;\n    quant = as_pack[4] & 0x07;\n    if (quant > 1)\n        return -1;\n    size = (sys->audio_min_samples[freq] + smpls) * 4;\n    half_ch = sys->difseg_size/2;\n    ipcm = (sys->height == 720 && ((frame[1]>>2)&0x3) == 0)?2:0;\n    pcm = ppcm[ipcm++];\n    for (chan = 0; chan < sys->n_difchan; chan++) {\n        for (i = 0; i < sys->difseg_size; i++) {\n            frame += 6 * 80;\n            if (quant == 1 && i == half_ch) {\n                pcm = ppcm[ipcm++];\n                if (!pcm)\n                    break;\n            }\n            for (j = 0; j < 9; j++) {\n                for (d = 8; d < 80; d += 2) {\n                    if (quant == 0) {\n                        of = sys->audio_shuffle[i][j] + (d - 8)/2 * sys->audio_stride;\n                        if (of*2 >= size)\n                            continue;\n                        pcm[of*2] = frame[d+1];\n                        pcm[of*2+1] = frame[d];\n                        if (pcm[of*2+1] == 0x80 && pcm[of*2] == 0x00)\n                            pcm[of*2+1] = 0;\n                    } else {\n                        lc = ((uint16_t)frame[d] << 4) |\n                             ((uint16_t)frame[d+2] >> 4);\n                        rc = ((uint16_t)frame[d+1] << 4) |\n                             ((uint16_t)frame[d+2] & 0x0f);\n                        lc = (lc == 0x800 ? 0 : dv_audio_12to16(lc));\n                        rc = (rc == 0x800 ? 0 : dv_audio_12to16(rc));\n                        of = sys->audio_shuffle[i%half_ch][j] + (d - 8)/3 * sys->audio_stride;\n                        if (of*2 >= size)\n                            continue;\n                        pcm[of*2] = lc & 0xff;\n                        pcm[of*2+1] = lc >> 8;\n                        of = sys->audio_shuffle[i%half_ch+half_ch][j] +\n                            (d - 8)/3 * sys->audio_stride;\n                        pcm[of*2] = rc & 0xff;\n                        pcm[of*2+1] = rc >> 8;\n                        ++d;\n                    }\n                }\n                frame += 16 * 80;\n            }\n        }\n        pcm = ppcm[ipcm++];\n        if (!pcm)\n            break;\n    }\n    return size;\n}']