libavformat/rtpdec_qdm2.c:205: error: Buffer Overrun L2
  Offset: [0, 128] Size: 128.

libavformat/rtpdec_qdm2.c:193:10: <Offset trace>
191.     /* create packet to hold subpkts into a superblock */
192.     assert(qdm->cache > 0);
193.     for (n = 0; n < 0x80; n++)
              ^
194.         if (qdm->len[n] > 0)
195.             break;

libavformat/rtpdec_qdm2.c:193:10: Assignment
191.     /* create packet to hold subpkts into a superblock */
192.     assert(qdm->cache > 0);
193.     for (n = 0; n < 0x80; n++)
              ^
194.         if (qdm->len[n] > 0)
195.             break;

libavformat/rtpdec_qdm2.c:186:1: <Length trace>
184.  * @return <0 on error, else 0.
185.  */
186. static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt)
     ^
187. {
188.     int to_copy, n, res, include_csum;

libavformat/rtpdec_qdm2.c:186:1: Parameter `qdm->len[*]`
184.  * @return <0 on error, else 0.
185.  */
186. static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt)
     ^
187. {
188.     int to_copy, n, res, include_csum;

libavformat/rtpdec_qdm2.c:205:9: Array access: Offset: [0, 128] Size: 128
203. 
204.     /* superblock header */
205.     if (qdm->len[n] > 0xff) {
             ^
206.         *p++ = qdm->block_type | 0x80;
207.         AV_WB16(p, qdm->len[n]);

static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt)
{
    int to_copy, n, res, include_csum;
    uint8_t *p, *csum_pos = NULL;
    assert(qdm->cache > 0);
    for (n = 0; n < 0x80; n++)
        if (qdm->len[n] > 0)
            break;
    assert(n < 0x80);
    if ((res = av_new_packet(pkt, qdm->block_size)) < 0)
        return res;
    memset(pkt->data, 0, pkt->size);
    pkt->stream_index  = st->index;
    p                  = pkt->data;
    if (qdm->len[n] > 0xff) {
        *p++ = qdm->block_type | 0x80;
        AV_WB16(p, qdm->len[n]);
        p   += 2;
    } else {
        *p++ = qdm->block_type;
        *p++ = qdm->len[n];
    }
    if ((include_csum = (qdm->block_type == 2 || qdm->block_type == 4))) {
        csum_pos = p;
        p       += 2;
    }
    to_copy = FFMIN(qdm->len[n], pkt->size - (p - pkt->data));
    memcpy(p, qdm->buf[n], to_copy);
    qdm->len[n] = 0;
    if (include_csum) {
        unsigned int total = 0;
        uint8_t *q;
        for (q = pkt->data; q < &pkt->data[qdm->block_size]; q++)
            total += *q;
        AV_WB16(csum_pos, (uint16_t) total);
    }
    return 0;
}
['static int qdm2_restore_block(PayloadContext *qdm, AVStream *st, AVPacket *pkt)\n{\n    int to_copy, n, res, include_csum;\n    uint8_t *p, *csum_pos = NULL;\n    assert(qdm->cache > 0);\n    for (n = 0; n < 0x80; n++)\n        if (qdm->len[n] > 0)\n            break;\n    assert(n < 0x80);\n    if ((res = av_new_packet(pkt, qdm->block_size)) < 0)\n        return res;\n    memset(pkt->data, 0, pkt->size);\n    pkt->stream_index  = st->index;\n    p                  = pkt->data;\n    if (qdm->len[n] > 0xff) {\n        *p++ = qdm->block_type | 0x80;\n        AV_WB16(p, qdm->len[n]);\n        p   += 2;\n    } else {\n        *p++ = qdm->block_type;\n        *p++ = qdm->len[n];\n    }\n    if ((include_csum = (qdm->block_type == 2 || qdm->block_type == 4))) {\n        csum_pos = p;\n        p       += 2;\n    }\n    to_copy = FFMIN(qdm->len[n], pkt->size - (p - pkt->data));\n    memcpy(p, qdm->buf[n], to_copy);\n    qdm->len[n] = 0;\n    if (include_csum) {\n        unsigned int total = 0;\n        uint8_t *q;\n        for (q = pkt->data; q < &pkt->data[qdm->block_size]; q++)\n            total += *q;\n        AV_WB16(csum_pos, (uint16_t) total);\n    }\n    return 0;\n}']