libavcodec/cavsdec.c:538: error: Buffer Overrun L3
  Offset: [-3, +oo] Size: 9 by call to `decode_mb_i`.

libavcodec/cavsdec.c:538:13: Call
536.         do {
537.             check_for_slice(h);
538.             decode_mb_i(h, 0);
                 ^
539.         } while(ff_cavs_next_mb(h));
540.     } else if(h->pic_type == FF_P_TYPE) {

libavcodec/cavsdec.c:190:1: <Offset trace>
188.  ****************************************************************************/
189. 
190. static int decode_mb_i(AVSContext *h, int cbp_code) {
     ^
191.     GetBitContext *gb = &h->s.gb;
192.     int block, pred_mode_uv;

libavcodec/cavsdec.c:190:1: Global `ff_cavs_scan3x3`
  188.  ****************************************************************************/
  189. 
  190. static int decode_mb_i(AVSContext *h, int cbp_code) {
       ^
  191.     GetBitContext *gb = &h->s.gb;
  192.     int block, pred_mode_uv;

libavcodec/cavsdec.c:202:9: Assignment
  200.     for(block=0;block<4;block++) {
  201.         int nA,nB,predpred;
  202.         int pos = ff_cavs_scan3x3[block];
               ^
  203. 
  204.         nA = h->pred_mode_Y[pos-1];

libavcodec/cavsdec.c:190:1: <Length trace>
188.  ****************************************************************************/
189. 
190. static int decode_mb_i(AVSContext *h, int cbp_code) {
     ^
191.     GetBitContext *gb = &h->s.gb;
192.     int block, pred_mode_uv;

libavcodec/cavsdec.c:190:1: Parameter `h->pred_mode_Y[*]`
  188.  ****************************************************************************/
  189. 
  190. static int decode_mb_i(AVSContext *h, int cbp_code) {
       ^
  191.     GetBitContext *gb = &h->s.gb;
  192.     int block, pred_mode_uv;

libavcodec/cavsdec.c:205:14: Array access: Offset: [-3, +oo] Size: 9 by call to `decode_mb_i` 
  203. 
  204.         nA = h->pred_mode_Y[pos-1];
  205.         nB = h->pred_mode_Y[pos-3];
                    ^
  206.         predpred = FFMIN(nA,nB);
  207.         if(predpred == NOT_AVAIL) // if either is not available

static int decode_mb_i(AVSContext *h, int cbp_code) {
    GetBitContext *gb = &h->s.gb;
    int block, pred_mode_uv;
    uint8_t top[18];
    uint8_t *left = NULL;
    uint8_t *d;
    ff_cavs_init_mb(h);
    for(block=0;block<4;block++) {
        int nA,nB,predpred;
        int pos = ff_cavs_scan3x3[block];
        nA = h->pred_mode_Y[pos-1];
        nB = h->pred_mode_Y[pos-3];
        predpred = FFMIN(nA,nB);
        if(predpred == NOT_AVAIL)
            predpred = INTRA_L_LP;
        if(!get_bits1(gb)){
            int rem_mode= get_bits(gb, 2);
            predpred = rem_mode + (rem_mode >= predpred);
        }
        h->pred_mode_Y[pos] = predpred;
    }
    pred_mode_uv = get_ue_golomb(gb);
    if(pred_mode_uv > 6) {
        av_log(h->s.avctx, AV_LOG_ERROR, "illegal intra chroma pred mode\n");
        return -1;
    }
    ff_cavs_modify_mb_i(h, &pred_mode_uv);
    if(h->pic_type == FF_I_TYPE)
        cbp_code = get_ue_golomb(gb);
    if(cbp_code > 63){
        av_log(h->s.avctx, AV_LOG_ERROR, "illegal intra cbp\n");
        return -1;
    }
    h->cbp = cbp_tab[cbp_code][0];
    if(h->cbp && !h->qp_fixed)
        h->qp = (h->qp + get_se_golomb(gb)) & 63;
    for(block=0;block<4;block++) {
        d = h->cy + h->luma_scan[block];
        ff_cavs_load_intra_pred_luma(h, top, &left, block);
        h->intra_pred_l[h->pred_mode_Y[ff_cavs_scan3x3[block]]]
            (d, top, left, h->l_stride);
        if(h->cbp & (1<<block))
            decode_residual_block(h,gb,ff_cavs_intra_dec,1,h->qp,d,h->l_stride);
    }
    ff_cavs_load_intra_pred_chroma(h);
    h->intra_pred_c[pred_mode_uv](h->cu, &h->top_border_u[h->mbx*10],
                                  h->left_border_u, h->c_stride);
    h->intra_pred_c[pred_mode_uv](h->cv, &h->top_border_v[h->mbx*10],
                                  h->left_border_v, h->c_stride);
    decode_residual_chroma(h);
    ff_cavs_filter(h,I_8X8);
    set_mv_intra(h);
    return 0;
}
['static int decode_pic(AVSContext *h) {\n    MpegEncContext *s = &h->s;\n    int skip_count;\n    enum cavs_mb mb_type;\n    if (!s->context_initialized) {\n        s->avctx->idct_algo = FF_IDCT_CAVS;\n        if (MPV_common_init(s) < 0)\n            return -1;\n        ff_init_scantable(s->dsp.idct_permutation,&h->scantable,ff_zigzag_direct);\n    }\n    skip_bits(&s->gb,16);\n    if(h->stc == PIC_PB_START_CODE) {\n        h->pic_type = get_bits(&s->gb,2) + FF_I_TYPE;\n        if(h->pic_type > FF_B_TYPE) {\n            av_log(s->avctx, AV_LOG_ERROR, "illegal picture type\\n");\n            return -1;\n        }\n        if(!h->DPB[0].data[0] ||\n          (!h->DPB[1].data[0] && h->pic_type == FF_B_TYPE))\n            return -1;\n    } else {\n        h->pic_type = FF_I_TYPE;\n        if(get_bits1(&s->gb))\n            skip_bits(&s->gb,24);\n    }\n    if(h->picture.data[0])\n        s->avctx->release_buffer(s->avctx, (AVFrame *)&h->picture);\n    s->avctx->get_buffer(s->avctx, (AVFrame *)&h->picture);\n    ff_cavs_init_pic(h);\n    h->picture.poc = get_bits(&s->gb,8)*2;\n    if(h->pic_type != FF_B_TYPE) {\n        h->dist[0] = (h->picture.poc - h->DPB[0].poc  + 512) % 512;\n    } else {\n        h->dist[0] = (h->DPB[0].poc  - h->picture.poc + 512) % 512;\n    }\n    h->dist[1] = (h->picture.poc - h->DPB[1].poc  + 512) % 512;\n    h->scale_den[0] = h->dist[0] ? 512/h->dist[0] : 0;\n    h->scale_den[1] = h->dist[1] ? 512/h->dist[1] : 0;\n    if(h->pic_type == FF_B_TYPE) {\n        h->sym_factor = h->dist[0]*h->scale_den[1];\n    } else {\n        h->direct_den[0] = h->dist[0] ? 16384/h->dist[0] : 0;\n        h->direct_den[1] = h->dist[1] ? 16384/h->dist[1] : 0;\n    }\n    if(s->low_delay)\n        get_ue_golomb(&s->gb);\n    h->progressive             = get_bits1(&s->gb);\n    h->pic_structure = 1;\n    if(!h->progressive)\n        h->pic_structure = get_bits1(&s->gb);\n    if(!h->pic_structure && h->stc == PIC_PB_START_CODE)\n        skip_bits1(&s->gb);\n    skip_bits1(&s->gb);\n    skip_bits1(&s->gb);\n    h->qp_fixed                = get_bits1(&s->gb);\n    h->qp                      = get_bits(&s->gb,6);\n    if(h->pic_type == FF_I_TYPE) {\n        if(!h->progressive && !h->pic_structure)\n            skip_bits1(&s->gb);\n        skip_bits(&s->gb,4);\n    } else {\n        if(!(h->pic_type == FF_B_TYPE && h->pic_structure == 1))\n            h->ref_flag        = get_bits1(&s->gb);\n        skip_bits(&s->gb,4);\n        h->skip_mode_flag      = get_bits1(&s->gb);\n    }\n    h->loop_filter_disable     = get_bits1(&s->gb);\n    if(!h->loop_filter_disable && get_bits1(&s->gb)) {\n        h->alpha_offset        = get_se_golomb(&s->gb);\n        h->beta_offset         = get_se_golomb(&s->gb);\n    } else {\n        h->alpha_offset = h->beta_offset  = 0;\n    }\n    if(h->pic_type == FF_I_TYPE) {\n        do {\n            check_for_slice(h);\n            decode_mb_i(h, 0);\n        } while(ff_cavs_next_mb(h));\n    } else if(h->pic_type == FF_P_TYPE) {\n        do {\n            check_for_slice(h);\n            if(h->skip_mode_flag) {\n                skip_count = get_ue_golomb(&s->gb);\n                while(skip_count--) {\n                    decode_mb_p(h,P_SKIP);\n                    if(!ff_cavs_next_mb(h))\n                        goto done;\n                }\n                check_for_slice(h);\n                mb_type = get_ue_golomb(&s->gb) + P_16X16;\n            } else\n                mb_type = get_ue_golomb(&s->gb) + P_SKIP;\n            if(mb_type > P_8X8) {\n                decode_mb_i(h, mb_type - P_8X8 - 1);\n            } else\n                decode_mb_p(h,mb_type);\n        } while(ff_cavs_next_mb(h));\n    } else {\n        do {\n            check_for_slice(h);\n            if(h->skip_mode_flag) {\n                skip_count = get_ue_golomb(&s->gb);\n                while(skip_count--) {\n                    decode_mb_b(h,B_SKIP);\n                    if(!ff_cavs_next_mb(h))\n                        goto done;\n                }\n                check_for_slice(h);\n                mb_type = get_ue_golomb(&s->gb) + B_DIRECT;\n            } else\n                mb_type = get_ue_golomb(&s->gb) + B_SKIP;\n            if(mb_type > B_8X8) {\n                decode_mb_i(h, mb_type - B_8X8 - 1);\n            } else\n                decode_mb_b(h,mb_type);\n        } while(ff_cavs_next_mb(h));\n    }\n done:\n    if(h->pic_type != FF_B_TYPE) {\n        if(h->DPB[1].data[0])\n            s->avctx->release_buffer(s->avctx, (AVFrame *)&h->DPB[1]);\n        h->DPB[1] = h->DPB[0];\n        h->DPB[0] = h->picture;\n        memset(&h->picture,0,sizeof(Picture));\n    }\n    return 0;\n}', 'static int decode_mb_i(AVSContext *h, int cbp_code) {\n    GetBitContext *gb = &h->s.gb;\n    int block, pred_mode_uv;\n    uint8_t top[18];\n    uint8_t *left = NULL;\n    uint8_t *d;\n    ff_cavs_init_mb(h);\n    for(block=0;block<4;block++) {\n        int nA,nB,predpred;\n        int pos = ff_cavs_scan3x3[block];\n        nA = h->pred_mode_Y[pos-1];\n        nB = h->pred_mode_Y[pos-3];\n        predpred = FFMIN(nA,nB);\n        if(predpred == NOT_AVAIL)\n            predpred = INTRA_L_LP;\n        if(!get_bits1(gb)){\n            int rem_mode= get_bits(gb, 2);\n            predpred = rem_mode + (rem_mode >= predpred);\n        }\n        h->pred_mode_Y[pos] = predpred;\n    }\n    pred_mode_uv = get_ue_golomb(gb);\n    if(pred_mode_uv > 6) {\n        av_log(h->s.avctx, AV_LOG_ERROR, "illegal intra chroma pred mode\\n");\n        return -1;\n    }\n    ff_cavs_modify_mb_i(h, &pred_mode_uv);\n    if(h->pic_type == FF_I_TYPE)\n        cbp_code = get_ue_golomb(gb);\n    if(cbp_code > 63){\n        av_log(h->s.avctx, AV_LOG_ERROR, "illegal intra cbp\\n");\n        return -1;\n    }\n    h->cbp = cbp_tab[cbp_code][0];\n    if(h->cbp && !h->qp_fixed)\n        h->qp = (h->qp + get_se_golomb(gb)) & 63;\n    for(block=0;block<4;block++) {\n        d = h->cy + h->luma_scan[block];\n        ff_cavs_load_intra_pred_luma(h, top, &left, block);\n        h->intra_pred_l[h->pred_mode_Y[ff_cavs_scan3x3[block]]]\n            (d, top, left, h->l_stride);\n        if(h->cbp & (1<<block))\n            decode_residual_block(h,gb,ff_cavs_intra_dec,1,h->qp,d,h->l_stride);\n    }\n    ff_cavs_load_intra_pred_chroma(h);\n    h->intra_pred_c[pred_mode_uv](h->cu, &h->top_border_u[h->mbx*10],\n                                  h->left_border_u, h->c_stride);\n    h->intra_pred_c[pred_mode_uv](h->cv, &h->top_border_v[h->mbx*10],\n                                  h->left_border_v, h->c_stride);\n    decode_residual_chroma(h);\n    ff_cavs_filter(h,I_8X8);\n    set_mv_intra(h);\n    return 0;\n}']