libavformat/matroskadec.c:1987: error: Buffer Overrun L2
  Offset: [-oo, max(16, `matroska->num_levels`)] Size: 16.

libavformat/matroskadec.c:1851:1: <Offset trace>
1849. }
1850. 
1851. static int
      ^
1852. matroska_parse_seekhead (MatroskaDemuxContext *matroska)
1853. {

libavformat/matroskadec.c:1851:1: Parameter `matroska->num_levels`
1849. }
1850. 
1851. static int
      ^
1852. matroska_parse_seekhead (MatroskaDemuxContext *matroska)
1853. {

libavformat/matroskadec.c:1860:20: Call
1858. 
1859.     while (res == 0) {
1860.         if (!(id = ebml_peek_id(matroska, &matroska->level_up))) {
                         ^
1861.             res = AVERROR(EIO);
1862.             break;

libavformat/matroskadec.c:318:1: Parameter `matroska->num_levels`
  316.  */
  317. 
  318. static uint32_t
       ^
  319. ebml_peek_id (MatroskaDemuxContext *matroska,
  320.               int                  *level_up)

libavformat/matroskadec.c:324:9: Call
  322.     uint32_t id;
  323. 
  324.     if (ebml_read_element_id(matroska, &id, level_up) < 0)
               ^
  325.         return 0;
  326. 

libavformat/matroskadec.c:268:1: Parameter `matroska->num_levels`
    266.  */
    267. 
    268. static int
         ^
    269. ebml_read_element_id (MatroskaDemuxContext *matroska,
    270.                       uint32_t             *id,

libavformat/matroskadec.c:1873:28: Call
1871.                 uint64_t seek_pos = (uint64_t) -1, t;
1872. 
1873.                 if ((res = ebml_read_master(matroska, &id)) < 0)
                                 ^
1874.                     break;
1875. 

libavformat/matroskadec.c:544:1: Parameter `matroska->num_levels`
  542.  */
  543. 
  544. static int
       ^
  545. ebml_read_master (MatroskaDemuxContext *matroska,
  546.                   uint32_t             *id)

libavformat/matroskadec.c:553:16: Call
  551.     int res;
  552. 
  553.     if ((res = ebml_read_element_id(matroska, id, NULL)) < 0 ||
                      ^
  554.         (res = ebml_read_element_length(matroska, &length)) < 0)
  555.         return res;

libavformat/matroskadec.c:268:1: Parameter `matroska->num_levels`
    266.  */
    267. 
    268. static int
         ^
    269. ebml_read_element_id (MatroskaDemuxContext *matroska,
    270.                       uint32_t             *id,

libavformat/matroskadec.c:1985:29: Assignment
1983.                         /* remove dummy level */
1984.                         while (matroska->num_levels) {
1985.                             matroska->num_levels--;
                                  ^
1986.                             length =
1987.                                 matroska->levels[matroska->num_levels].length;

libavformat/matroskadec.c:1851:1: <Length trace>
1849. }
1850. 
1851. static int
      ^
1852. matroska_parse_seekhead (MatroskaDemuxContext *matroska)
1853. {

libavformat/matroskadec.c:1851:1: Parameter `matroska->levels[*]`
1849. }
1850. 
1851. static int
      ^
1852. matroska_parse_seekhead (MatroskaDemuxContext *matroska)
1853. {

libavformat/matroskadec.c:1987:33: Array access: Offset: [-oo, max(16, matroska->num_levels)] Size: 16
1985.                             matroska->num_levels--;
1986.                             length =
1987.                                 matroska->levels[matroska->num_levels].length;
                                      ^
1988.                             if (length == (uint64_t)-1)
1989.                                 break;

static int
matroska_parse_seekhead (MatroskaDemuxContext *matroska)
{
    int res = 0;
    uint32_t id;
    av_log(matroska->ctx, AV_LOG_DEBUG, "parsing seekhead...\n");
    while (res == 0) {
        if (!(id = ebml_peek_id(matroska, &matroska->level_up))) {
            res = AVERROR(EIO);
            break;
        } else if (matroska->level_up) {
            matroska->level_up--;
            break;
        }
        switch (id) {
            case MATROSKA_ID_SEEKENTRY: {
                uint32_t seek_id = 0, peek_id_cache = 0;
                uint64_t seek_pos = (uint64_t) -1, t;
                if ((res = ebml_read_master(matroska, &id)) < 0)
                    break;
                while (res == 0) {
                    if (!(id = ebml_peek_id(matroska, &matroska->level_up))) {
                        res = AVERROR(EIO);
                        break;
                    } else if (matroska->level_up) {
                        matroska->level_up--;
                        break;
                    }
                    switch (id) {
                        case MATROSKA_ID_SEEKID:
                            res = ebml_read_uint(matroska, &id, &t);
                            seek_id = t;
                            break;
                        case MATROSKA_ID_SEEKPOSITION:
                            res = ebml_read_uint(matroska, &id, &seek_pos);
                            break;
                        default:
                            av_log(matroska->ctx, AV_LOG_INFO,
                                   "Unknown seekhead ID 0x%x\n", id);
                        case EBML_ID_VOID:
                            res = ebml_read_skip(matroska);
                            break;
                    }
                    if (matroska->level_up) {
                        matroska->level_up--;
                        break;
                    }
                }
                if (!seek_id || seek_pos == (uint64_t) -1) {
                    av_log(matroska->ctx, AV_LOG_INFO,
                           "Incomplete seekhead entry (0x%x/%"PRIu64")\n",
                           seek_id, seek_pos);
                    break;
                }
                switch (seek_id) {
                    case MATROSKA_ID_CUES:
                    case MATROSKA_ID_TAGS: {
                        uint32_t level_up = matroska->level_up;
                        offset_t before_pos;
                        uint64_t length;
                        MatroskaLevel level;
                        peek_id_cache = matroska->peek_id;
                        before_pos = url_ftell(matroska->ctx->pb);
                        if ((res = ebml_read_seek(matroska, seek_pos +
                                               matroska->segment_start)) < 0)
                            goto finish;
                        if (matroska->num_levels == EBML_MAX_DEPTH) {
                            av_log(matroska->ctx, AV_LOG_INFO,
                                   "Max EBML element depth (%d) reached, "
                                   "cannot parse further.\n", EBML_MAX_DEPTH);
                            return AVERROR_UNKNOWN;
                        }
                        level.start = 0;
                        level.length = (uint64_t)-1;
                        matroska->levels[matroska->num_levels] = level;
                        matroska->num_levels++;
                        if (!(id = ebml_peek_id (matroska,
                                                 &matroska->level_up)))
                            goto finish;
                        if (id != seek_id) {
                            av_log(matroska->ctx, AV_LOG_INFO,
                                   "We looked for ID=0x%x but got "
                                   "ID=0x%x (pos=%"PRIu64")",
                                   seek_id, id, seek_pos +
                                   matroska->segment_start);
                            goto finish;
                        }
                        if ((res = ebml_read_master(matroska, &id)) < 0)
                            goto finish;
                        switch (id) {
                            case MATROSKA_ID_CUES:
                                if (!(res = matroska_parse_index(matroska)) ||
                                    url_feof(matroska->ctx->pb)) {
                                    matroska->index_parsed = 1;
                                    res = 0;
                                }
                                break;
                            case MATROSKA_ID_TAGS:
                                if (!(res = matroska_parse_metadata(matroska)) ||
                                   url_feof(matroska->ctx->pb)) {
                                    matroska->metadata_parsed = 1;
                                    res = 0;
                                }
                                break;
                        }
                    finish:
                        while (matroska->num_levels) {
                            matroska->num_levels--;
                            length =
                                matroska->levels[matroska->num_levels].length;
                            if (length == (uint64_t)-1)
                                break;
                        }
                        if ((res = ebml_read_seek(matroska, before_pos)) < 0)
                            return res;
                        matroska->peek_id = peek_id_cache;
                        matroska->level_up = level_up;
                        break;
                    }
                    default:
                        av_log(matroska->ctx, AV_LOG_INFO,
                               "Ignoring seekhead entry for ID=0x%x\n",
                               seek_id);
                        break;
                }
                break;
            }
            default:
                av_log(matroska->ctx, AV_LOG_INFO,
                       "Unknown seekhead ID 0x%x\n", id);
            case EBML_ID_VOID:
                res = ebml_read_skip(matroska);
                break;
        }
        if (matroska->level_up) {
            matroska->level_up--;
            break;
        }
    }
    return res;
}
['static int\nmatroska_parse_seekhead (MatroskaDemuxContext *matroska)\n{\n    int res = 0;\n    uint32_t id;\n    av_log(matroska->ctx, AV_LOG_DEBUG, "parsing seekhead...\\n");\n    while (res == 0) {\n        if (!(id = ebml_peek_id(matroska, &matroska->level_up))) {\n            res = AVERROR(EIO);\n            break;\n        } else if (matroska->level_up) {\n            matroska->level_up--;\n            break;\n        }\n        switch (id) {\n            case MATROSKA_ID_SEEKENTRY: {\n                uint32_t seek_id = 0, peek_id_cache = 0;\n                uint64_t seek_pos = (uint64_t) -1, t;\n                if ((res = ebml_read_master(matroska, &id)) < 0)\n                    break;\n                while (res == 0) {\n                    if (!(id = ebml_peek_id(matroska, &matroska->level_up))) {\n                        res = AVERROR(EIO);\n                        break;\n                    } else if (matroska->level_up) {\n                        matroska->level_up--;\n                        break;\n                    }\n                    switch (id) {\n                        case MATROSKA_ID_SEEKID:\n                            res = ebml_read_uint(matroska, &id, &t);\n                            seek_id = t;\n                            break;\n                        case MATROSKA_ID_SEEKPOSITION:\n                            res = ebml_read_uint(matroska, &id, &seek_pos);\n                            break;\n                        default:\n                            av_log(matroska->ctx, AV_LOG_INFO,\n                                   "Unknown seekhead ID 0x%x\\n", id);\n                        case EBML_ID_VOID:\n                            res = ebml_read_skip(matroska);\n                            break;\n                    }\n                    if (matroska->level_up) {\n                        matroska->level_up--;\n                        break;\n                    }\n                }\n                if (!seek_id || seek_pos == (uint64_t) -1) {\n                    av_log(matroska->ctx, AV_LOG_INFO,\n                           "Incomplete seekhead entry (0x%x/%"PRIu64")\\n",\n                           seek_id, seek_pos);\n                    break;\n                }\n                switch (seek_id) {\n                    case MATROSKA_ID_CUES:\n                    case MATROSKA_ID_TAGS: {\n                        uint32_t level_up = matroska->level_up;\n                        offset_t before_pos;\n                        uint64_t length;\n                        MatroskaLevel level;\n                        peek_id_cache = matroska->peek_id;\n                        before_pos = url_ftell(matroska->ctx->pb);\n                        if ((res = ebml_read_seek(matroska, seek_pos +\n                                               matroska->segment_start)) < 0)\n                            goto finish;\n                        if (matroska->num_levels == EBML_MAX_DEPTH) {\n                            av_log(matroska->ctx, AV_LOG_INFO,\n                                   "Max EBML element depth (%d) reached, "\n                                   "cannot parse further.\\n", EBML_MAX_DEPTH);\n                            return AVERROR_UNKNOWN;\n                        }\n                        level.start = 0;\n                        level.length = (uint64_t)-1;\n                        matroska->levels[matroska->num_levels] = level;\n                        matroska->num_levels++;\n                        if (!(id = ebml_peek_id (matroska,\n                                                 &matroska->level_up)))\n                            goto finish;\n                        if (id != seek_id) {\n                            av_log(matroska->ctx, AV_LOG_INFO,\n                                   "We looked for ID=0x%x but got "\n                                   "ID=0x%x (pos=%"PRIu64")",\n                                   seek_id, id, seek_pos +\n                                   matroska->segment_start);\n                            goto finish;\n                        }\n                        if ((res = ebml_read_master(matroska, &id)) < 0)\n                            goto finish;\n                        switch (id) {\n                            case MATROSKA_ID_CUES:\n                                if (!(res = matroska_parse_index(matroska)) ||\n                                    url_feof(matroska->ctx->pb)) {\n                                    matroska->index_parsed = 1;\n                                    res = 0;\n                                }\n                                break;\n                            case MATROSKA_ID_TAGS:\n                                if (!(res = matroska_parse_metadata(matroska)) ||\n                                   url_feof(matroska->ctx->pb)) {\n                                    matroska->metadata_parsed = 1;\n                                    res = 0;\n                                }\n                                break;\n                        }\n                    finish:\n                        while (matroska->num_levels) {\n                            matroska->num_levels--;\n                            length =\n                                matroska->levels[matroska->num_levels].length;\n                            if (length == (uint64_t)-1)\n                                break;\n                        }\n                        if ((res = ebml_read_seek(matroska, before_pos)) < 0)\n                            return res;\n                        matroska->peek_id = peek_id_cache;\n                        matroska->level_up = level_up;\n                        break;\n                    }\n                    default:\n                        av_log(matroska->ctx, AV_LOG_INFO,\n                               "Ignoring seekhead entry for ID=0x%x\\n",\n                               seek_id);\n                        break;\n                }\n                break;\n            }\n            default:\n                av_log(matroska->ctx, AV_LOG_INFO,\n                       "Unknown seekhead ID 0x%x\\n", id);\n            case EBML_ID_VOID:\n                res = ebml_read_skip(matroska);\n                break;\n        }\n        if (matroska->level_up) {\n            matroska->level_up--;\n            break;\n        }\n    }\n    return res;\n}', 'static uint32_t\nebml_peek_id (MatroskaDemuxContext *matroska,\n              int                  *level_up)\n{\n    uint32_t id;\n    if (ebml_read_element_id(matroska, &id, level_up) < 0)\n        return 0;\n    return id;\n}', 'static int\nebml_read_element_id (MatroskaDemuxContext *matroska,\n                      uint32_t             *id,\n                      int                  *level_up)\n{\n    int read;\n    uint64_t total;\n    if (matroska->peek_id != 0) {\n        if (level_up)\n            *level_up = 0;\n        *id = matroska->peek_id;\n        return 0;\n    }\n    if ((read = ebml_read_num(matroska, 4, &total)) < 0)\n        return read;\n    *id = matroska->peek_id  = total | (1 << (read * 7));\n    if (level_up)\n        *level_up = ebml_read_element_level_up(matroska);\n    return read;\n}', 'static int\nebml_read_master (MatroskaDemuxContext *matroska,\n                  uint32_t             *id)\n{\n    ByteIOContext *pb = matroska->ctx->pb;\n    uint64_t length;\n    MatroskaLevel *level;\n    int res;\n    if ((res = ebml_read_element_id(matroska, id, NULL)) < 0 ||\n        (res = ebml_read_element_length(matroska, &length)) < 0)\n        return res;\n    if (matroska->num_levels >= EBML_MAX_DEPTH) {\n        av_log(matroska->ctx, AV_LOG_ERROR,\n               "File moves beyond max. allowed depth (%d)\\n", EBML_MAX_DEPTH);\n        return AVERROR(ENOSYS);\n    }\n    level = &matroska->levels[matroska->num_levels++];\n    level->start = url_ftell(pb);\n    level->length = length;\n    return 0;\n}']