libavcodec/opt.c:164: error: Buffer Overrun L3
  Offset: [0, 1] Size: [1, 256] by call to `ff_eval2`.

libavcodec/opt.c:118:1: Array declaration
116. }
117. 
118. const AVOption *av_set_string2(void *obj, const char *name, const char *val, int alloc){
     ^
119.     const AVOption *o= av_find_opt(obj, name, NULL, 0, 0);
120.     if(o && o->offset==0 && o->type == FF_OPT_TYPE_CONST && o->unit){

libavcodec/opt.c:164:17: Call
162.             buf[i]=0;
163. 
164.             d = ff_eval2(buf, const_values, const_names, NULL, NULL, NULL, NULL, NULL, &error);
                     ^
165.             if(isnan(d)) {
166.                 const AVOption *o_named= av_find_opt(obj, buf, o->unit, 0, 0);

libavcodec/eval.c:415:1: Parameter `s->strlen`
  413. }
  414. 
  415. double ff_eval2(const char *s, double *const_value, const char **const_name,
       ^
  416.                double (**func1)(void *, double), const char **func1_name,
  417.                double (**func2)(void *, double, double), char **func2_name,

libavcodec/eval.c:419:22: Call
  417.                double (**func2)(void *, double, double), char **func2_name,
  418.                void *opaque, const char **error){
  419.     AVEvalExpr * e = ff_parse(s, const_name, func1, func1_name, func2, func2_name, error);
                            ^
  420.     double d;
  421.     if (!e) return NAN;

libavcodec/eval.c:378:1: Parameter `s->strlen`
    376. }
    377. 
    378. AVEvalExpr * ff_parse(const char *s, const char **const_name,
         ^
    379.                double (**func1)(void *, double), const char **func1_name,
    380.                double (**func2)(void *, double, double), char **func2_name,

libavcodec/eval.c:384:12: Array declaration
    382.     Parser p;
    383.     AVEvalExpr * e;
    384.     char w[strlen(s) + 1], * wp = w;
                    ^
    385. 
    386.     while (*s)

libavcodec/eval.c:391:5: Assignment
    389. 
    390.     p.stack_index=100;
    391.     p.s= w;
             ^
    392.     p.const_name = const_name;
    393.     p.func1      = func1;

libavcodec/eval.c:399:9: Call
    397.     p.error= error;
    398. 
    399.     e = parse_expr(&p);
                 ^
    400.     if (!verify_expr(e)) {
    401.         ff_eval_free(e);

libavcodec/eval.c:345:1: Parameter `*p->s`
      343. }
      344. 
      345. static AVEvalExpr * parse_expr(Parser *p) {
           ^
      346.     AVEvalExpr * e;
      347. 

libavcodec/eval.c:352:9: Call
      350.     p->stack_index--;
      351. 
      352.     e = parse_subexpr(p);
                   ^
      353. 
      354.     while(*p->s == ';') {

libavcodec/eval.c:336:1: Parameter `*p->s`
        334. }
        335. 
        336. static AVEvalExpr * parse_subexpr(Parser *p) {
             ^
        337.     AVEvalExpr * e = parse_term(p);
        338.     while(*p->s == '+' || *p->s == '-') {

libavcodec/eval.c:337:22: Call
        335. 
        336. static AVEvalExpr * parse_subexpr(Parser *p) {
        337.     AVEvalExpr * e = parse_term(p);
                                  ^
        338.     while(*p->s == '+' || *p->s == '-') {
        339.         e= new_eval_expr(e_add, 1, e, parse_term(p));

libavcodec/eval.c:327:1: Parameter `*p->s`
          325. }
          326. 
          327. static AVEvalExpr * parse_term(Parser *p){
               ^
          328.     AVEvalExpr * e = parse_factor(p);
          329.     while(p->s[0]=='*' || p->s[0]=='/'){

libavcodec/eval.c:328:22: Call
          326. 
          327. static AVEvalExpr * parse_term(Parser *p){
          328.     AVEvalExpr * e = parse_factor(p);
                                    ^
          329.     while(p->s[0]=='*' || p->s[0]=='/'){
          330.         int c= *p->s++;

libavcodec/eval.c:315:1: Parameter `*p->s`
            313. }
            314. 
            315. static AVEvalExpr * parse_factor(Parser *p){
                 ^
            316.     int sign, sign2;
            317.     AVEvalExpr * e = parse_pow(p, &sign);

libavcodec/eval.c:317:22: Call
            315. static AVEvalExpr * parse_factor(Parser *p){
            316.     int sign, sign2;
            317.     AVEvalExpr * e = parse_pow(p, &sign);
                                      ^
            318.     while(p->s[0]=='^'){
            319.         p->s++;

libavcodec/eval.c:309:1: Parameter `*p->s`
              307. }
              308. 
              309. static AVEvalExpr * parse_pow(Parser *p, int *sign){
                   ^
              310.     *sign= (*p->s == '+') - (*p->s == '-');
              311.     p->s += *sign&1;

libavcodec/eval.c:311:5: Assignment
              309. static AVEvalExpr * parse_pow(Parser *p, int *sign){
              310.     *sign= (*p->s == '+') - (*p->s == '-');
              311.     p->s += *sign&1;
                       ^
              312.     return parse_primary(p);
              313. }

libavcodec/eval.c:312:12: Call
              310.     *sign= (*p->s == '+') - (*p->s == '-');
              311.     p->s += *sign&1;
              312.     return parse_primary(p);
                              ^
              313. }
              314. 

libavcodec/eval.c:194:1: <Length trace>
192. }
193. 
194. static AVEvalExpr * parse_primary(Parser *p) {
     ^
195.     AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
196.     char *next= p->s;

libavcodec/eval.c:194:1: Parameter `*p->s`
                192. }
                193. 
                194. static AVEvalExpr * parse_primary(Parser *p) {
                     ^
                195.     AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
                196.     char *next= p->s;

libavcodec/eval.c:226:9: Array access: Offset: [0, 1] Size: [1, 256] by call to `ff_eval2` 
                224.     }
                225.     p->s++; // "("
                226.     if (*next == '(') { // special case do-nothing
                             ^
                227.         av_freep(&d);
                228.         d = parse_expr(p);

static AVEvalExpr * parse_primary(Parser *p) {
    AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
    char *next= p->s;
    int i;
    d->value = av_strtod(p->s, &next);
    if(next != p->s){
        d->type = e_value;
        p->s= next;
        return d;
    }
    d->value = 1;
    for(i=0; p->const_name && p->const_name[i]; i++){
        if(strmatch(p->s, p->const_name[i])){
            p->s+= strlen(p->const_name[i]);
            d->type = e_const;
            d->a.const_index = i;
            return d;
        }
    }
    p->s= strchr(p->s, '(');
    if(p->s==NULL){
        *p->error = "undefined constant or missing (";
        p->s= next;
        ff_eval_free(d);
        return NULL;
    }
    p->s++;
    if (*next == '(') {
        av_freep(&d);
        d = parse_expr(p);
        if(p->s[0] != ')'){
            *p->error = "missing )";
            ff_eval_free(d);
            return NULL;
        }
        p->s++;
        return d;
    }
    d->param[0] = parse_expr(p);
    if(p->s[0]== ','){
        p->s++;
        d->param[1] = parse_expr(p);
    }
    if(p->s[0] != ')'){
        *p->error = "missing )";
        ff_eval_free(d);
        return NULL;
    }
    p->s++;
    d->type = e_func0;
         if( strmatch(next, "sinh"  ) ) d->a.func0 = sinh;
    else if( strmatch(next, "cosh"  ) ) d->a.func0 = cosh;
    else if( strmatch(next, "tanh"  ) ) d->a.func0 = tanh;
    else if( strmatch(next, "sin"   ) ) d->a.func0 = sin;
    else if( strmatch(next, "cos"   ) ) d->a.func0 = cos;
    else if( strmatch(next, "tan"   ) ) d->a.func0 = tan;
    else if( strmatch(next, "atan"  ) ) d->a.func0 = atan;
    else if( strmatch(next, "asin"  ) ) d->a.func0 = asin;
    else if( strmatch(next, "acos"  ) ) d->a.func0 = acos;
    else if( strmatch(next, "exp"   ) ) d->a.func0 = exp;
    else if( strmatch(next, "log"   ) ) d->a.func0 = log;
    else if( strmatch(next, "abs"   ) ) d->a.func0 = fabs;
    else if( strmatch(next, "squish") ) d->type = e_squish;
    else if( strmatch(next, "gauss" ) ) d->type = e_gauss;
    else if( strmatch(next, "mod"   ) ) d->type = e_mod;
    else if( strmatch(next, "max"   ) ) d->type = e_max;
    else if( strmatch(next, "min"   ) ) d->type = e_min;
    else if( strmatch(next, "eq"    ) ) d->type = e_eq;
    else if( strmatch(next, "gte"   ) ) d->type = e_gte;
    else if( strmatch(next, "gt"    ) ) d->type = e_gt;
    else if( strmatch(next, "lte"   ) ) { AVEvalExpr * tmp = d->param[1]; d->param[1] = d->param[0]; d->param[0] = tmp; d->type = e_gt; }
    else if( strmatch(next, "lt"    ) ) { AVEvalExpr * tmp = d->param[1]; d->param[1] = d->param[0]; d->param[0] = tmp; d->type = e_gte; }
    else if( strmatch(next, "ld"    ) ) d->type = e_ld;
    else if( strmatch(next, "st"    ) ) d->type = e_st;
    else if( strmatch(next, "while" ) ) d->type = e_while;
    else {
        for(i=0; p->func1_name && p->func1_name[i]; i++){
            if(strmatch(next, p->func1_name[i])){
                d->a.func1 = p->func1[i];
                d->type = e_func1;
                return d;
            }
        }
        for(i=0; p->func2_name && p->func2_name[i]; i++){
            if(strmatch(next, p->func2_name[i])){
                d->a.func2 = p->func2[i];
                d->type = e_func2;
                return d;
            }
        }
        *p->error = "unknown function";
        ff_eval_free(d);
        return NULL;
    }
    return d;
}
['const AVOption *av_set_string2(void *obj, const char *name, const char *val, int alloc){\n    const AVOption *o= av_find_opt(obj, name, NULL, 0, 0);\n    if(o && o->offset==0 && o->type == FF_OPT_TYPE_CONST && o->unit){\n        return set_all_opt(obj, o->unit, o->default_val);\n    }\n    if(!o || !val || o->offset<=0)\n        return NULL;\n    if(o->type == FF_OPT_TYPE_BINARY){\n        uint8_t **dst = (uint8_t **)(((uint8_t*)obj) + o->offset);\n        int *lendst = (int *)(dst + 1);\n        uint8_t *bin, *ptr;\n        int len = strlen(val);\n        av_freep(dst);\n        *lendst = 0;\n        if (len & 1) return NULL;\n        len /= 2;\n        ptr = bin = av_malloc(len);\n        while (*val) {\n            int a = hexchar2int(*val++);\n            int b = hexchar2int(*val++);\n            if (a < 0 || b < 0) {\n                av_free(bin);\n                return NULL;\n            }\n            *ptr++ = (a << 4) | b;\n        }\n        *dst = bin;\n        *lendst = len;\n        return o;\n    }\n    if(o->type != FF_OPT_TYPE_STRING){\n        int notfirst=0;\n        for(;;){\n            int i;\n            char buf[256];\n            int cmd=0;\n            double d;\n            const char *error = NULL;\n            if(*val == \'+\' || *val == \'-\')\n                cmd= *(val++);\n            for(i=0; i<sizeof(buf)-1 && val[i] && val[i]!=\'+\' && val[i]!=\'-\'; i++)\n                buf[i]= val[i];\n            buf[i]=0;\n            d = ff_eval2(buf, const_values, const_names, NULL, NULL, NULL, NULL, NULL, &error);\n            if(isnan(d)) {\n                const AVOption *o_named= av_find_opt(obj, buf, o->unit, 0, 0);\n                if(o_named && o_named->type == FF_OPT_TYPE_CONST)\n                    d= o_named->default_val;\n                else if(!strcmp(buf, "default")) d= o->default_val;\n                else if(!strcmp(buf, "max"    )) d= o->max;\n                else if(!strcmp(buf, "min"    )) d= o->min;\n                else if(!strcmp(buf, "none"   )) d= 0;\n                else if(!strcmp(buf, "all"    )) d= ~0;\n                else {\n                    if (error)\n                        av_log(NULL, AV_LOG_ERROR, "Unable to parse option value \\"%s\\": %s\\n", val, error);\n                    return NULL;\n                }\n            }\n            if(o->type == FF_OPT_TYPE_FLAGS){\n                if     (cmd==\'+\') d= av_get_int(obj, name, NULL) | (int64_t)d;\n                else if(cmd==\'-\') d= av_get_int(obj, name, NULL) &~(int64_t)d;\n            }else{\n                if     (cmd==\'+\') d= notfirst*av_get_double(obj, name, NULL) + d;\n                else if(cmd==\'-\') d= notfirst*av_get_double(obj, name, NULL) - d;\n            }\n            if (!av_set_number(obj, name, d, 1, 1))\n                return NULL;\n            val+= i;\n            if(!*val)\n                return o;\n            notfirst=1;\n        }\n        return NULL;\n    }\n    if(alloc){\n        av_free(*(void**)(((uint8_t*)obj) + o->offset));\n        val= av_strdup(val);\n    }\n    memcpy(((uint8_t*)obj) + o->offset, &val, sizeof(val));\n    return o;\n}', 'double ff_eval2(const char *s, double *const_value, const char **const_name,\n               double (**func1)(void *, double), const char **func1_name,\n               double (**func2)(void *, double, double), char **func2_name,\n               void *opaque, const char **error){\n    AVEvalExpr * e = ff_parse(s, const_name, func1, func1_name, func2, func2_name, error);\n    double d;\n    if (!e) return NAN;\n    d = ff_parse_eval(e, const_value, opaque);\n    ff_eval_free(e);\n    return d;\n}', 'AVEvalExpr * ff_parse(const char *s, const char **const_name,\n               double (**func1)(void *, double), const char **func1_name,\n               double (**func2)(void *, double, double), char **func2_name,\n               const char **error){\n    Parser p;\n    AVEvalExpr * e;\n    char w[strlen(s) + 1], * wp = w;\n    while (*s)\n        if (!isspace(*s++)) *wp++ = s[-1];\n    *wp++ = 0;\n    p.stack_index=100;\n    p.s= w;\n    p.const_name = const_name;\n    p.func1      = func1;\n    p.func1_name = func1_name;\n    p.func2      = func2;\n    p.func2_name = func2_name;\n    p.error= error;\n    e = parse_expr(&p);\n    if (!verify_expr(e)) {\n        ff_eval_free(e);\n        return NULL;\n    }\n    return e;\n}', "static AVEvalExpr * parse_expr(Parser *p) {\n    AVEvalExpr * e;\n    if(p->stack_index <= 0)\n        return NULL;\n    p->stack_index--;\n    e = parse_subexpr(p);\n    while(*p->s == ';') {\n        p->s++;\n        e= new_eval_expr(e_last, 1, e, parse_subexpr(p));\n    };\n    p->stack_index++;\n    return e;\n}", "static AVEvalExpr * parse_subexpr(Parser *p) {\n    AVEvalExpr * e = parse_term(p);\n    while(*p->s == '+' || *p->s == '-') {\n        e= new_eval_expr(e_add, 1, e, parse_term(p));\n    };\n    return e;\n}", "static AVEvalExpr * parse_term(Parser *p){\n    AVEvalExpr * e = parse_factor(p);\n    while(p->s[0]=='*' || p->s[0]=='/'){\n        int c= *p->s++;\n        e= new_eval_expr(c == '*' ? e_mul : e_div, 1, e, parse_factor(p));\n    }\n    return e;\n}", "static AVEvalExpr * parse_factor(Parser *p){\n    int sign, sign2;\n    AVEvalExpr * e = parse_pow(p, &sign);\n    while(p->s[0]=='^'){\n        p->s++;\n        e= new_eval_expr(e_pow, 1, e, parse_pow(p, &sign2));\n        if (e->param[1]) e->param[1]->value *= (sign2|1);\n    }\n    if (e) e->value *= (sign|1);\n    return e;\n}", "static AVEvalExpr * parse_pow(Parser *p, int *sign){\n    *sign= (*p->s == '+') - (*p->s == '-');\n    p->s += *sign&1;\n    return parse_primary(p);\n}", 'static AVEvalExpr * parse_primary(Parser *p) {\n    AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));\n    char *next= p->s;\n    int i;\n    d->value = av_strtod(p->s, &next);\n    if(next != p->s){\n        d->type = e_value;\n        p->s= next;\n        return d;\n    }\n    d->value = 1;\n    for(i=0; p->const_name && p->const_name[i]; i++){\n        if(strmatch(p->s, p->const_name[i])){\n            p->s+= strlen(p->const_name[i]);\n            d->type = e_const;\n            d->a.const_index = i;\n            return d;\n        }\n    }\n    p->s= strchr(p->s, \'(\');\n    if(p->s==NULL){\n        *p->error = "undefined constant or missing (";\n        p->s= next;\n        ff_eval_free(d);\n        return NULL;\n    }\n    p->s++;\n    if (*next == \'(\') {\n        av_freep(&d);\n        d = parse_expr(p);\n        if(p->s[0] != \')\'){\n            *p->error = "missing )";\n            ff_eval_free(d);\n            return NULL;\n        }\n        p->s++;\n        return d;\n    }\n    d->param[0] = parse_expr(p);\n    if(p->s[0]== \',\'){\n        p->s++;\n        d->param[1] = parse_expr(p);\n    }\n    if(p->s[0] != \')\'){\n        *p->error = "missing )";\n        ff_eval_free(d);\n        return NULL;\n    }\n    p->s++;\n    d->type = e_func0;\n         if( strmatch(next, "sinh"  ) ) d->a.func0 = sinh;\n    else if( strmatch(next, "cosh"  ) ) d->a.func0 = cosh;\n    else if( strmatch(next, "tanh"  ) ) d->a.func0 = tanh;\n    else if( strmatch(next, "sin"   ) ) d->a.func0 = sin;\n    else if( strmatch(next, "cos"   ) ) d->a.func0 = cos;\n    else if( strmatch(next, "tan"   ) ) d->a.func0 = tan;\n    else if( strmatch(next, "atan"  ) ) d->a.func0 = atan;\n    else if( strmatch(next, "asin"  ) ) d->a.func0 = asin;\n    else if( strmatch(next, "acos"  ) ) d->a.func0 = acos;\n    else if( strmatch(next, "exp"   ) ) d->a.func0 = exp;\n    else if( strmatch(next, "log"   ) ) d->a.func0 = log;\n    else if( strmatch(next, "abs"   ) ) d->a.func0 = fabs;\n    else if( strmatch(next, "squish") ) d->type = e_squish;\n    else if( strmatch(next, "gauss" ) ) d->type = e_gauss;\n    else if( strmatch(next, "mod"   ) ) d->type = e_mod;\n    else if( strmatch(next, "max"   ) ) d->type = e_max;\n    else if( strmatch(next, "min"   ) ) d->type = e_min;\n    else if( strmatch(next, "eq"    ) ) d->type = e_eq;\n    else if( strmatch(next, "gte"   ) ) d->type = e_gte;\n    else if( strmatch(next, "gt"    ) ) d->type = e_gt;\n    else if( strmatch(next, "lte"   ) ) { AVEvalExpr * tmp = d->param[1]; d->param[1] = d->param[0]; d->param[0] = tmp; d->type = e_gt; }\n    else if( strmatch(next, "lt"    ) ) { AVEvalExpr * tmp = d->param[1]; d->param[1] = d->param[0]; d->param[0] = tmp; d->type = e_gte; }\n    else if( strmatch(next, "ld"    ) ) d->type = e_ld;\n    else if( strmatch(next, "st"    ) ) d->type = e_st;\n    else if( strmatch(next, "while" ) ) d->type = e_while;\n    else {\n        for(i=0; p->func1_name && p->func1_name[i]; i++){\n            if(strmatch(next, p->func1_name[i])){\n                d->a.func1 = p->func1[i];\n                d->type = e_func1;\n                return d;\n            }\n        }\n        for(i=0; p->func2_name && p->func2_name[i]; i++){\n            if(strmatch(next, p->func2_name[i])){\n                d->a.func2 = p->func2[i];\n                d->type = e_func2;\n                return d;\n            }\n        }\n        *p->error = "unknown function";\n        ff_eval_free(d);\n        return NULL;\n    }\n    return d;\n}']