libavcodec/zmbv.c:525: error: Buffer Overrun L3
  Offset: 0 Size: [0, 2147483631].

libavcodec/zmbv.c:395:1: <Length trace>
393. }
394. 
395. static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt)
     ^
396. {
397.     const uint8_t *buf = avpkt->data;

libavcodec/zmbv.c:395:1: Parameter `avctx->priv_data->cur`
393. }
394. 
395. static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt)
     ^
396. {
397.     const uint8_t *buf = avpkt->data;

libavcodec/zmbv.c:520:9: Assignment
518. 
519.         out = c->pic.data[0];
520.         src = c->cur;
             ^
521.         switch(c->fmt) {
522.         case ZMBV_FMT_8BPP:

libavcodec/zmbv.c:525:45: Array access: Offset: 0 Size: [0, 2147483631]
523.             for(j = 0; j < c->height; j++) {
524.                 for(i = 0; i < c->width; i++) {
525.                     out[i * 3 + 0] = c->pal[(*src) * 3 + 0];
                                                 ^
526.                     out[i * 3 + 1] = c->pal[(*src) * 3 + 1];
527.                     out[i * 3 + 2] = c->pal[(*src) * 3 + 2];

static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt)
{
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    ZmbvContext * const c = avctx->priv_data;
    uint8_t *outptr;
    int zret = Z_OK;
    int len = buf_size;
    int hi_ver, lo_ver;
    if(c->pic.data[0])
            avctx->release_buffer(avctx, &c->pic);
    c->pic.reference = 1;
    c->pic.buffer_hints = FF_BUFFER_HINTS_VALID;
    if(avctx->get_buffer(avctx, &c->pic) < 0){
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        return -1;
    }
    outptr = c->pic.data[0];
    c->flags = buf[0];
    buf++; len--;
    if(c->flags & ZMBV_KEYFRAME) {
        hi_ver = buf[0];
        lo_ver = buf[1];
        c->comp = buf[2];
        c->fmt = buf[3];
        c->bw = buf[4];
        c->bh = buf[5];
        buf += 6;
        len -= 6;
        av_log(avctx, AV_LOG_DEBUG, "Flags=%X ver=%i.%i comp=%i fmt=%i blk=%ix%i\n",c->flags,hi_ver,lo_ver,c->comp,c->fmt,c->bw,c->bh);
        if(hi_ver != 0 || lo_ver != 1) {
            av_log(avctx, AV_LOG_ERROR, "Unsupported version %i.%i\n", hi_ver, lo_ver);
            return -1;
        }
        if(c->bw == 0 || c->bh == 0) {
            av_log(avctx, AV_LOG_ERROR, "Unsupported block size %ix%i\n", c->bw, c->bh);
        }
        if(c->comp != 0 && c->comp != 1) {
            av_log(avctx, AV_LOG_ERROR, "Unsupported compression type %i\n", c->comp);
            return -1;
        }
        switch(c->fmt) {
        case ZMBV_FMT_8BPP:
            c->bpp = 8;
            c->decode_intra = zmbv_decode_intra;
            c->decode_xor = zmbv_decode_xor_8;
            break;
        case ZMBV_FMT_15BPP:
        case ZMBV_FMT_16BPP:
            c->bpp = 16;
            c->decode_intra = zmbv_decode_intra;
            c->decode_xor = zmbv_decode_xor_16;
            break;
#ifdef ZMBV_ENABLE_24BPP
        case ZMBV_FMT_24BPP:
            c->bpp = 24;
            c->decode_intra = zmbv_decode_intra;
            c->decode_xor = zmbv_decode_xor_24;
            break;
#endif
        case ZMBV_FMT_32BPP:
            c->bpp = 32;
            c->decode_intra = zmbv_decode_intra;
            c->decode_xor = zmbv_decode_xor_32;
            break;
        default:
            c->decode_intra = NULL;
            c->decode_xor = NULL;
            av_log(avctx, AV_LOG_ERROR, "Unsupported (for now) format %i\n", c->fmt);
            return -1;
        }
        zret = inflateReset(&c->zstream);
        if (zret != Z_OK) {
            av_log(avctx, AV_LOG_ERROR, "Inflate reset error: %d\n", zret);
            return -1;
        }
        c->cur = av_realloc(c->cur, avctx->width * avctx->height * (c->bpp / 8));
        c->prev = av_realloc(c->prev, avctx->width * avctx->height * (c->bpp / 8));
        c->bx = (c->width + c->bw - 1) / c->bw;
        c->by = (c->height+ c->bh - 1) / c->bh;
    }
    if(c->decode_intra == NULL) {
        av_log(avctx, AV_LOG_ERROR, "Error! Got no format or no keyframe!\n");
        return -1;
    }
    if(c->comp == 0) {
        memcpy(c->decomp_buf, buf, len);
        c->decomp_size = 1;
    } else {
        c->zstream.total_in = c->zstream.total_out = 0;
        c->zstream.next_in = buf;
        c->zstream.avail_in = len;
        c->zstream.next_out = c->decomp_buf;
        c->zstream.avail_out = c->decomp_size;
        inflate(&c->zstream, Z_FINISH);
        c->decomp_len = c->zstream.total_out;
    }
    if(c->flags & ZMBV_KEYFRAME) {
        c->pic.key_frame = 1;
        c->pic.pict_type = FF_I_TYPE;
        c->decode_intra(c);
    } else {
        c->pic.key_frame = 0;
        c->pic.pict_type = FF_P_TYPE;
        if(c->decomp_len)
            c->decode_xor(c);
    }
    {
        uint8_t *out, *src;
        int i, j;
        out = c->pic.data[0];
        src = c->cur;
        switch(c->fmt) {
        case ZMBV_FMT_8BPP:
            for(j = 0; j < c->height; j++) {
                for(i = 0; i < c->width; i++) {
                    out[i * 3 + 0] = c->pal[(*src) * 3 + 0];
                    out[i * 3 + 1] = c->pal[(*src) * 3 + 1];
                    out[i * 3 + 2] = c->pal[(*src) * 3 + 2];
                    src++;
                }
                out += c->pic.linesize[0];
            }
            break;
        case ZMBV_FMT_15BPP:
            for(j = 0; j < c->height; j++) {
                for(i = 0; i < c->width; i++) {
                    uint16_t tmp = AV_RL16(src);
                    src += 2;
                    out[i * 3 + 0] = (tmp & 0x7C00) >> 7;
                    out[i * 3 + 1] = (tmp & 0x03E0) >> 2;
                    out[i * 3 + 2] = (tmp & 0x001F) << 3;
                }
                out += c->pic.linesize[0];
            }
            break;
        case ZMBV_FMT_16BPP:
            for(j = 0; j < c->height; j++) {
                for(i = 0; i < c->width; i++) {
                    uint16_t tmp = AV_RL16(src);
                    src += 2;
                    out[i * 3 + 0] = (tmp & 0xF800) >> 8;
                    out[i * 3 + 1] = (tmp & 0x07E0) >> 3;
                    out[i * 3 + 2] = (tmp & 0x001F) << 3;
                }
                out += c->pic.linesize[0];
            }
            break;
#ifdef ZMBV_ENABLE_24BPP
        case ZMBV_FMT_24BPP:
            for(j = 0; j < c->height; j++) {
                memcpy(out, src, c->width * 3);
                src += c->width * 3;
                out += c->pic.linesize[0];
            }
            break;
#endif
        case ZMBV_FMT_32BPP:
            for(j = 0; j < c->height; j++) {
                for(i = 0; i < c->width; i++) {
                    uint32_t tmp = AV_RL32(src);
                    src += 4;
                    AV_WB24(out+(i*3), tmp);
                }
                out += c->pic.linesize[0];
            }
            break;
        default:
            av_log(avctx, AV_LOG_ERROR, "Cannot handle format %i\n", c->fmt);
        }
        memcpy(c->prev, c->cur, c->width * c->height * (c->bpp / 8));
    }
    *data_size = sizeof(AVFrame);
    *(AVFrame*)data = c->pic;
    return buf_size;
}
['static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    ZmbvContext * const c = avctx->priv_data;\n    uint8_t *outptr;\n    int zret = Z_OK;\n    int len = buf_size;\n    int hi_ver, lo_ver;\n    if(c->pic.data[0])\n            avctx->release_buffer(avctx, &c->pic);\n    c->pic.reference = 1;\n    c->pic.buffer_hints = FF_BUFFER_HINTS_VALID;\n    if(avctx->get_buffer(avctx, &c->pic) < 0){\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return -1;\n    }\n    outptr = c->pic.data[0];\n    c->flags = buf[0];\n    buf++; len--;\n    if(c->flags & ZMBV_KEYFRAME) {\n        hi_ver = buf[0];\n        lo_ver = buf[1];\n        c->comp = buf[2];\n        c->fmt = buf[3];\n        c->bw = buf[4];\n        c->bh = buf[5];\n        buf += 6;\n        len -= 6;\n        av_log(avctx, AV_LOG_DEBUG, "Flags=%X ver=%i.%i comp=%i fmt=%i blk=%ix%i\\n",c->flags,hi_ver,lo_ver,c->comp,c->fmt,c->bw,c->bh);\n        if(hi_ver != 0 || lo_ver != 1) {\n            av_log(avctx, AV_LOG_ERROR, "Unsupported version %i.%i\\n", hi_ver, lo_ver);\n            return -1;\n        }\n        if(c->bw == 0 || c->bh == 0) {\n            av_log(avctx, AV_LOG_ERROR, "Unsupported block size %ix%i\\n", c->bw, c->bh);\n        }\n        if(c->comp != 0 && c->comp != 1) {\n            av_log(avctx, AV_LOG_ERROR, "Unsupported compression type %i\\n", c->comp);\n            return -1;\n        }\n        switch(c->fmt) {\n        case ZMBV_FMT_8BPP:\n            c->bpp = 8;\n            c->decode_intra = zmbv_decode_intra;\n            c->decode_xor = zmbv_decode_xor_8;\n            break;\n        case ZMBV_FMT_15BPP:\n        case ZMBV_FMT_16BPP:\n            c->bpp = 16;\n            c->decode_intra = zmbv_decode_intra;\n            c->decode_xor = zmbv_decode_xor_16;\n            break;\n#ifdef ZMBV_ENABLE_24BPP\n        case ZMBV_FMT_24BPP:\n            c->bpp = 24;\n            c->decode_intra = zmbv_decode_intra;\n            c->decode_xor = zmbv_decode_xor_24;\n            break;\n#endif\n        case ZMBV_FMT_32BPP:\n            c->bpp = 32;\n            c->decode_intra = zmbv_decode_intra;\n            c->decode_xor = zmbv_decode_xor_32;\n            break;\n        default:\n            c->decode_intra = NULL;\n            c->decode_xor = NULL;\n            av_log(avctx, AV_LOG_ERROR, "Unsupported (for now) format %i\\n", c->fmt);\n            return -1;\n        }\n        zret = inflateReset(&c->zstream);\n        if (zret != Z_OK) {\n            av_log(avctx, AV_LOG_ERROR, "Inflate reset error: %d\\n", zret);\n            return -1;\n        }\n        c->cur = av_realloc(c->cur, avctx->width * avctx->height * (c->bpp / 8));\n        c->prev = av_realloc(c->prev, avctx->width * avctx->height * (c->bpp / 8));\n        c->bx = (c->width + c->bw - 1) / c->bw;\n        c->by = (c->height+ c->bh - 1) / c->bh;\n    }\n    if(c->decode_intra == NULL) {\n        av_log(avctx, AV_LOG_ERROR, "Error! Got no format or no keyframe!\\n");\n        return -1;\n    }\n    if(c->comp == 0) {\n        memcpy(c->decomp_buf, buf, len);\n        c->decomp_size = 1;\n    } else {\n        c->zstream.total_in = c->zstream.total_out = 0;\n        c->zstream.next_in = buf;\n        c->zstream.avail_in = len;\n        c->zstream.next_out = c->decomp_buf;\n        c->zstream.avail_out = c->decomp_size;\n        inflate(&c->zstream, Z_FINISH);\n        c->decomp_len = c->zstream.total_out;\n    }\n    if(c->flags & ZMBV_KEYFRAME) {\n        c->pic.key_frame = 1;\n        c->pic.pict_type = FF_I_TYPE;\n        c->decode_intra(c);\n    } else {\n        c->pic.key_frame = 0;\n        c->pic.pict_type = FF_P_TYPE;\n        if(c->decomp_len)\n            c->decode_xor(c);\n    }\n    {\n        uint8_t *out, *src;\n        int i, j;\n        out = c->pic.data[0];\n        src = c->cur;\n        switch(c->fmt) {\n        case ZMBV_FMT_8BPP:\n            for(j = 0; j < c->height; j++) {\n                for(i = 0; i < c->width; i++) {\n                    out[i * 3 + 0] = c->pal[(*src) * 3 + 0];\n                    out[i * 3 + 1] = c->pal[(*src) * 3 + 1];\n                    out[i * 3 + 2] = c->pal[(*src) * 3 + 2];\n                    src++;\n                }\n                out += c->pic.linesize[0];\n            }\n            break;\n        case ZMBV_FMT_15BPP:\n            for(j = 0; j < c->height; j++) {\n                for(i = 0; i < c->width; i++) {\n                    uint16_t tmp = AV_RL16(src);\n                    src += 2;\n                    out[i * 3 + 0] = (tmp & 0x7C00) >> 7;\n                    out[i * 3 + 1] = (tmp & 0x03E0) >> 2;\n                    out[i * 3 + 2] = (tmp & 0x001F) << 3;\n                }\n                out += c->pic.linesize[0];\n            }\n            break;\n        case ZMBV_FMT_16BPP:\n            for(j = 0; j < c->height; j++) {\n                for(i = 0; i < c->width; i++) {\n                    uint16_t tmp = AV_RL16(src);\n                    src += 2;\n                    out[i * 3 + 0] = (tmp & 0xF800) >> 8;\n                    out[i * 3 + 1] = (tmp & 0x07E0) >> 3;\n                    out[i * 3 + 2] = (tmp & 0x001F) << 3;\n                }\n                out += c->pic.linesize[0];\n            }\n            break;\n#ifdef ZMBV_ENABLE_24BPP\n        case ZMBV_FMT_24BPP:\n            for(j = 0; j < c->height; j++) {\n                memcpy(out, src, c->width * 3);\n                src += c->width * 3;\n                out += c->pic.linesize[0];\n            }\n            break;\n#endif\n        case ZMBV_FMT_32BPP:\n            for(j = 0; j < c->height; j++) {\n                for(i = 0; i < c->width; i++) {\n                    uint32_t tmp = AV_RL32(src);\n                    src += 4;\n                    AV_WB24(out+(i*3), tmp);\n                }\n                out += c->pic.linesize[0];\n            }\n            break;\n        default:\n            av_log(avctx, AV_LOG_ERROR, "Cannot handle format %i\\n", c->fmt);\n        }\n        memcpy(c->prev, c->cur, c->width * c->height * (c->bpp / 8));\n    }\n    *data_size = sizeof(AVFrame);\n    *(AVFrame*)data = c->pic;\n    return buf_size;\n}']