libavcodec/ffv1dec.c:522: error: Buffer Overrun L2
  Offset: [22, 62] Size: 32 by call to `get_symbol`.

libavcodec/ffv1dec.c:462:1: Array declaration
460. }
461. 
462. static int read_extra_header(FFV1Context *f)
     ^
463. {
464.     RangeCoder *const c = &f->c;

libavcodec/ffv1dec.c:522:33: Call
520.                     int pred = j ? f->initial_states[i][j - 1][k] : 128;
521.                     f->initial_states[i][j][k] =
522.                         (pred + get_symbol(c, state2[k], 1)) & 0xFF;
                                     ^
523.                 }
524.         }

libavcodec/ffv1dec.c:63:1: Parameter `*state`
  61. }
  62. 
  63. static av_noinline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed)
      ^
  64. {
  65.     return get_symbol_inline(c, state, is_signed);

libavcodec/ffv1dec.c:65:12: Call
  63. static av_noinline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed)
  64. {
  65.     return get_symbol_inline(c, state, is_signed);
                 ^
  66. }
  67. 

libavcodec/ffv1dec.c:43:1: Parameter `*state`
    41. #include "ffv1.h"
    42. 
    43. static inline av_flatten int get_symbol_inline(RangeCoder *c, uint8_t *state,
        ^
    44.                                                int is_signed)
    45. {

libavcodec/ffv1dec.c:56:22: Call
    54.         a = 1;
    55.         for (i = e - 1; i >= 0; i--)
    56.             a += a + get_rac(c, state + 22 + FFMIN(i, 9));  // 22..31
                             ^
    57. 
    58.         e = -(is_signed && get_rac(c, state + 11 + FFMIN(e, 10))); // 11..21

libavcodec/rangecoder.h:115:1: <Length trace>
113. }
114. 
115. static inline int get_rac(RangeCoder *c, uint8_t *const state)
     ^
116. {
117.     int range1 = (c->range * (*state)) >> 8;

libavcodec/rangecoder.h:115:1: Parameter `*state`
      113. }
      114. 
      115. static inline int get_rac(RangeCoder *c, uint8_t *const state)
           ^
      116. {
      117.     int range1 = (c->range * (*state)) >> 8;

libavcodec/rangecoder.h:117:30: Array access: Offset: [22, 62] Size: 32 by call to `get_symbol` 
      115. static inline int get_rac(RangeCoder *c, uint8_t *const state)
      116. {
      117.     int range1 = (c->range * (*state)) >> 8;
                                        ^
      118. 
      119.     c->range -= range1;

static inline int get_rac(RangeCoder *c, uint8_t *const state)
{
    int range1 = (c->range * (*state)) >> 8;
    c->range -= range1;
#if 1
    if (c->low < c->range) {
        *state = c->zero_state[*state];
        refill(c);
        return 0;
    } else {
        c->low  -= c->range;
        *state   = c->one_state[*state];
        c->range = range1;
        refill(c);
        return 1;
    }
#else
    {
        int one_mask one_mask = (c->range - c->low - 1) >> 31;
        c->low   -=           c->range  & one_mask;
        c->range += (range1 - c->range) & one_mask;
        *state = c->zero_state[(*state) + (256 & one_mask)];
    }
    refill(c);
    return one_mask & 1;
#endif
}
['static int read_extra_header(FFV1Context *f)\n{\n    RangeCoder *const c = &f->c;\n    uint8_t state[CONTEXT_SIZE];\n    int i, j, k, ret;\n    uint8_t state2[32][CONTEXT_SIZE];\n    memset(state2, 128, sizeof(state2));\n    memset(state, 128, sizeof(state));\n    ff_init_range_decoder(c, f->avctx->extradata, f->avctx->extradata_size);\n    ff_build_rac_states(c, 0.05 * (1LL << 32), 256 - 8);\n    f->version = get_symbol(c, state, 0);\n    if (f->version > 2) {\n        c->bytestream_end -= 4;\n        f->minor_version   = get_symbol(c, state, 0);\n    }\n    f->ac = f->avctx->coder_type = get_symbol(c, state, 0);\n    if (f->ac > 1) {\n        for (i = 1; i < 256; i++)\n            f->state_transition[i] = get_symbol(c, state, 1) + c->one_state[i];\n    }\n    f->colorspace                 = get_symbol(c, state, 0);\n    f->avctx->bits_per_raw_sample = get_symbol(c, state, 0);\n    f->chroma_planes              = get_rac(c, state);\n    f->chroma_h_shift             = get_symbol(c, state, 0);\n    f->chroma_v_shift             = get_symbol(c, state, 0);\n    f->transparency               = get_rac(c, state);\n    f->plane_count                = 2 + f->transparency;\n    f->num_h_slices               = 1 + get_symbol(c, state, 0);\n    f->num_v_slices               = 1 + get_symbol(c, state, 0);\n    if (f->num_h_slices > (unsigned)f->width ||\n        f->num_v_slices > (unsigned)f->height) {\n        av_log(f->avctx, AV_LOG_ERROR, "too many slices\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    f->quant_table_count = get_symbol(c, state, 0);\n    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES)\n        return AVERROR_INVALIDDATA;\n    for (i = 0; i < f->quant_table_count; i++) {\n        f->context_count[i] = read_quant_tables(c, f->quant_tables[i]);\n        if (f->context_count[i] < 0) {\n            av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\\n");\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    if ((ret = ffv1_allocate_initial_states(f)) < 0)\n        return ret;\n    for (i = 0; i < f->quant_table_count; i++)\n        if (get_rac(c, state)) {\n            for (j = 0; j < f->context_count[i]; j++)\n                for (k = 0; k < CONTEXT_SIZE; k++) {\n                    int pred = j ? f->initial_states[i][j - 1][k] : 128;\n                    f->initial_states[i][j][k] =\n                        (pred + get_symbol(c, state2[k], 1)) & 0xFF;\n                }\n        }\n    if (f->version > 2) {\n        f->ec = get_symbol(c, state, 0);\n    }\n    if (f->version > 2) {\n        unsigned v;\n        v = av_crc(av_crc_get_table(AV_CRC_32_IEEE), 0,\n                   f->avctx->extradata, f->avctx->extradata_size);\n        if (v) {\n            av_log(f->avctx, AV_LOG_ERROR, "CRC mismatch %X!\\n", v);\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    return 0;\n}', 'static av_noinline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed)\n{\n    return get_symbol_inline(c, state, is_signed);\n}', 'static inline av_flatten int get_symbol_inline(RangeCoder *c, uint8_t *state,\n                                               int is_signed)\n{\n    if (get_rac(c, state + 0))\n        return 0;\n    else {\n        int i, e, a;\n        e = 0;\n        while (get_rac(c, state + 1 + FFMIN(e, 9)))\n            e++;\n        a = 1;\n        for (i = e - 1; i >= 0; i--)\n            a += a + get_rac(c, state + 22 + FFMIN(i, 9));\n        e = -(is_signed && get_rac(c, state + 11 + FFMIN(e, 10)));\n        return (a ^ e) - e;\n    }\n}', 'static inline int get_rac(RangeCoder *c, uint8_t *const state)\n{\n    int range1 = (c->range * (*state)) >> 8;\n    c->range -= range1;\n#if 1\n    if (c->low < c->range) {\n        *state = c->zero_state[*state];\n        refill(c);\n        return 0;\n    } else {\n        c->low  -= c->range;\n        *state   = c->one_state[*state];\n        c->range = range1;\n        refill(c);\n        return 1;\n    }\n#else\n    {\n        int one_mask one_mask = (c->range - c->low - 1) >> 31;\n        c->low   -=           c->range  & one_mask;\n        c->range += (range1 - c->range) & one_mask;\n        *state = c->zero_state[(*state) + (256 & one_mask)];\n    }\n    refill(c);\n    return one_mask & 1;\n#endif\n}']