libavcodec/h264.c:2540: error: Buffer Overrun L1
  Offset: 510 Size: 3 by call to `ff_h264_init_cabac_states`.

libavcodec/h264.c:2536:9: Call
2534.         /* init cabac */
2535.         ff_init_cabac_states( &h->cabac);
2536.         ff_init_cabac_decoder( &h->cabac,
              ^
2537.                                s->gb.buffer + get_bits_count(&s->gb)/8,
2538.                                (get_bits_left(&s->gb) + 7)/8);

libavcodec/cabac.c:146:5: Assignment
  144. #endif
  145.     c->low+= ((*c->bytestream++)<<2) + 2;
  146.     c->range= 0x1FE;
           ^
  147. }
  148. 

libavcodec/h264.c:2540:9: Call
2538.                                (get_bits_left(&s->gb) + 7)/8);
2539. 
2540.         ff_h264_init_cabac_states(h);
              ^
2541. 
2542.         for(;;){

libavcodec/h264_cabac.c:688:1: <Offset trace>
686. };
687. 
688. void ff_h264_init_cabac_states(H264Context *h) {
     ^
689.     MpegEncContext * const s = &h->s;
690.     int i;

libavcodec/h264_cabac.c:688:1: Parameter `h->cabac_init_idc`
  686. };
  687. 
  688. void ff_h264_init_cabac_states(H264Context *h) {
       ^
  689.     MpegEncContext * const s = &h->s;
  690.     int i;

libavcodec/h264_cabac.c:217:1: <Length trace>
215. };
216. 
217. static const int8_t cabac_context_init_PB[3][460][2] =
     ^
218. {
219.     /* i_cabac_init_idc == 0 */

libavcodec/h264_cabac.c:217:1: Array declaration
  215. };
  216. 
  217. static const int8_t cabac_context_init_PB[3][460][2] =
       ^
  218. {
  219.     /* i_cabac_init_idc == 0 */

libavcodec/h264_cabac.c:694:42: Array access: Offset: 510 Size: 3 by call to `ff_h264_init_cabac_states` 
  692. 
  693.     if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;
  694.     else                                 tab = cabac_context_init_PB[h->cabac_init_idc];
                                                ^
  695. 
  696.     /* calculate pre-state */

void ff_h264_init_cabac_states(H264Context *h) {
    MpegEncContext * const s = &h->s;
    int i;
    const int8_t (*tab)[2];
    if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;
    else                                 tab = cabac_context_init_PB[h->cabac_init_idc];
    for( i= 0; i < 460; i++ ) {
        int pre = 2*(((tab[i][0] * s->qscale) >>4 ) + tab[i][1]) - 127;
        pre^= pre>>31;
        if(pre > 124)
            pre= 124 + (pre&1);
        h->cabac_state[i] =  pre;
    }
}
['static int decode_slice(struct AVCodecContext *avctx, void *arg){\n    H264Context *h = *(void**)arg;\n    MpegEncContext * const s = &h->s;\n    const int part_mask= s->partitioned_frame ? (AC_END|AC_ERROR) : 0x7F;\n    s->mb_skip_run= -1;\n    h->is_complex = FRAME_MBAFF || s->picture_structure != PICT_FRAME || s->codec_id != CODEC_ID_H264 ||\n                    (CONFIG_GRAY && (s->flags&CODEC_FLAG_GRAY));\n    if( h->pps.cabac ) {\n        align_get_bits( &s->gb );\n        ff_init_cabac_states( &h->cabac);\n        ff_init_cabac_decoder( &h->cabac,\n                               s->gb.buffer + get_bits_count(&s->gb)/8,\n                               (get_bits_left(&s->gb) + 7)/8);\n        ff_h264_init_cabac_states(h);\n        for(;;){\n            int ret = ff_h264_decode_mb_cabac(h);\n            int eos;\n            if(ret>=0) ff_h264_hl_decode_mb(h);\n            if( ret >= 0 && FRAME_MBAFF ) {\n                s->mb_y++;\n                ret = ff_h264_decode_mb_cabac(h);\n                if(ret>=0) ff_h264_hl_decode_mb(h);\n                s->mb_y--;\n            }\n            eos = get_cabac_terminate( &h->cabac );\n            if((s->workaround_bugs & FF_BUG_TRUNCATED) && h->cabac.bytestream > h->cabac.bytestream_end + 2){\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x-1, s->mb_y, (AC_END|DC_END|MV_END)&part_mask);\n                return 0;\n            }\n            if( ret < 0 || h->cabac.bytestream > h->cabac.bytestream_end + 2) {\n                av_log(h->s.avctx, AV_LOG_ERROR, "error while decoding MB %d %d, bytestream (%td)\\n", s->mb_x, s->mb_y, h->cabac.bytestream_end - h->cabac.bytestream);\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x, s->mb_y, (AC_ERROR|DC_ERROR|MV_ERROR)&part_mask);\n                return -1;\n            }\n            if( ++s->mb_x >= s->mb_width ) {\n                s->mb_x = 0;\n                loop_filter(h);\n                ff_draw_horiz_band(s, 16*s->mb_y, 16);\n                ++s->mb_y;\n                if(FIELD_OR_MBAFF_PICTURE) {\n                    ++s->mb_y;\n                    if(FRAME_MBAFF && s->mb_y < s->mb_height)\n                        predict_field_decoding_flag(h);\n                }\n            }\n            if( eos || s->mb_y >= s->mb_height ) {\n                tprintf(s->avctx, "slice end %d %d\\n", get_bits_count(&s->gb), s->gb.size_in_bits);\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x-1, s->mb_y, (AC_END|DC_END|MV_END)&part_mask);\n                return 0;\n            }\n        }\n    } else {\n        for(;;){\n            int ret = ff_h264_decode_mb_cavlc(h);\n            if(ret>=0) ff_h264_hl_decode_mb(h);\n            if(ret>=0 && FRAME_MBAFF){\n                s->mb_y++;\n                ret = ff_h264_decode_mb_cavlc(h);\n                if(ret>=0) ff_h264_hl_decode_mb(h);\n                s->mb_y--;\n            }\n            if(ret<0){\n                av_log(h->s.avctx, AV_LOG_ERROR, "error while decoding MB %d %d\\n", s->mb_x, s->mb_y);\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x, s->mb_y, (AC_ERROR|DC_ERROR|MV_ERROR)&part_mask);\n                return -1;\n            }\n            if(++s->mb_x >= s->mb_width){\n                s->mb_x=0;\n                loop_filter(h);\n                ff_draw_horiz_band(s, 16*s->mb_y, 16);\n                ++s->mb_y;\n                if(FIELD_OR_MBAFF_PICTURE) {\n                    ++s->mb_y;\n                    if(FRAME_MBAFF && s->mb_y < s->mb_height)\n                        predict_field_decoding_flag(h);\n                }\n                if(s->mb_y >= s->mb_height){\n                    tprintf(s->avctx, "slice end %d %d\\n", get_bits_count(&s->gb), s->gb.size_in_bits);\n                    if(get_bits_count(&s->gb) == s->gb.size_in_bits ) {\n                        ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x-1, s->mb_y, (AC_END|DC_END|MV_END)&part_mask);\n                        return 0;\n                    }else{\n                        ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x, s->mb_y, (AC_END|DC_END|MV_END)&part_mask);\n                        return -1;\n                    }\n                }\n            }\n            if(get_bits_count(&s->gb) >= s->gb.size_in_bits && s->mb_skip_run<=0){\n                tprintf(s->avctx, "slice end %d %d\\n", get_bits_count(&s->gb), s->gb.size_in_bits);\n                if(get_bits_count(&s->gb) == s->gb.size_in_bits ){\n                    ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x-1, s->mb_y, (AC_END|DC_END|MV_END)&part_mask);\n                    return 0;\n                }else{\n                    ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x, s->mb_y, (AC_ERROR|DC_ERROR|MV_ERROR)&part_mask);\n                    return -1;\n                }\n            }\n        }\n    }\n#if 0\n    for(;s->mb_y < s->mb_height; s->mb_y++){\n        for(;s->mb_x < s->mb_width; s->mb_x++){\n            int ret= decode_mb(h);\n            ff_h264_hl_decode_mb(h);\n            if(ret<0){\n                av_log(s->avctx, AV_LOG_ERROR, "error while decoding MB %d %d\\n", s->mb_x, s->mb_y);\n                ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x, s->mb_y, (AC_ERROR|DC_ERROR|MV_ERROR)&part_mask);\n                return -1;\n            }\n            if(++s->mb_x >= s->mb_width){\n                s->mb_x=0;\n                if(++s->mb_y >= s->mb_height){\n                    if(get_bits_count(s->gb) == s->gb.size_in_bits){\n                        ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x-1, s->mb_y, (AC_END|DC_END|MV_END)&part_mask);\n                        return 0;\n                    }else{\n                        ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x, s->mb_y, (AC_END|DC_END|MV_END)&part_mask);\n                        return -1;\n                    }\n                }\n            }\n            if(get_bits_count(s->?gb) >= s->gb?.size_in_bits){\n                if(get_bits_count(s->gb) == s->gb.size_in_bits){\n                    ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x-1, s->mb_y, (AC_END|DC_END|MV_END)&part_mask);\n                    return 0;\n                }else{\n                    ff_er_add_slice(s, s->resync_mb_x, s->resync_mb_y, s->mb_x, s->mb_y, (AC_ERROR|DC_ERROR|MV_ERROR)&part_mask);\n                    return -1;\n                }\n            }\n        }\n        s->mb_x=0;\n        ff_draw_horiz_band(s, 16*s->mb_y, 16);\n    }\n#endif\n    return -1;\n}', 'void ff_init_cabac_decoder(CABACContext *c, const uint8_t *buf, int buf_size){\n    c->bytestream_start=\n    c->bytestream= buf;\n    c->bytestream_end= buf + buf_size;\n#if CABAC_BITS == 16\n    c->low =  (*c->bytestream++)<<18;\n    c->low+=  (*c->bytestream++)<<10;\n#else\n    c->low =  (*c->bytestream++)<<10;\n#endif\n    c->low+= ((*c->bytestream++)<<2) + 2;\n    c->range= 0x1FE;\n}', 'void ff_h264_init_cabac_states(H264Context *h) {\n    MpegEncContext * const s = &h->s;\n    int i;\n    const int8_t (*tab)[2];\n    if( h->slice_type_nos == AV_PICTURE_TYPE_I ) tab = cabac_context_init_I;\n    else                                 tab = cabac_context_init_PB[h->cabac_init_idc];\n    for( i= 0; i < 460; i++ ) {\n        int pre = 2*(((tab[i][0] * s->qscale) >>4 ) + tab[i][1]) - 127;\n        pre^= pre>>31;\n        if(pre > 124)\n            pre= 124 + (pre&1);\n        h->cabac_state[i] =  pre;\n    }\n}']