libavcodec/ffv1enc.c:818: error: Buffer Overrun L2
  Offset: [1, 130+max(2, `avctx->priv_data->quant_table_count`)] (⇐ [0, 3+max(2, `avctx->priv_data->quant_table_count`)] + [1, 127]) Size: 8 by call to `write_extradata`.

libavcodec/ffv1enc.c:734:14: Assignment
732. 
733.     if (avctx->flags & (CODEC_FLAG_PASS1 | CODEC_FLAG_PASS2)) {
734.         for (i = 0; i < s->quant_table_count; i++) {
                  ^
735.             s->rc_stat2[i] = av_mallocz(s->context_count[i] *
736.                                         sizeof(*s->rc_stat2[i]));

libavcodec/ffv1enc.c:818:9: Call
816.         return AVERROR(ENOSYS);
817. slices_ok:
818.         write_extradata(s);
             ^
819.     }
820. 

libavcodec/ffv1enc.c:427:1: Parameter `f->quant_tables[*]`
  425. }
  426. 
  427. static int write_extradata(FFV1Context *f)
       ^
  428. {
  429.     RangeCoder *const c = &f->c;

libavcodec/ffv1enc.c:467:9: Call
  465.     put_symbol(c, state, f->quant_table_count, 0);
  466.     for (i = 0; i < f->quant_table_count; i++)
  467.         write_quant_tables(c, f->quant_tables[i]);
               ^
  468. 
  469.     for (i = 0; i < f->quant_table_count; i++) {

libavcodec/ffv1enc.c:372:1: Parameter `*quant_table`
    370. }
    371. 
    372. static void write_quant_tables(RangeCoder *c,
         ^
    373.                                int16_t quant_table[MAX_CONTEXT_INPUTS][256])
    374. {

libavcodec/ffv1enc.c:377:9: Call
    375.     int i;
    376.     for (i = 0; i < 5; i++)
    377.         write_quant_table(c, quant_table[i]);
                 ^
    378. }
    379. 

libavcodec/ffv1enc.c:364:10: <Offset trace>
362.     memset(state, 128, sizeof(state));
363. 
364.     for (i = 1; i < 128; i++)
              ^
365.         if (quant_table[i] != quant_table[i - 1]) {
366.             put_symbol(c, state, i - last - 1, 0);

libavcodec/ffv1enc.c:364:10: Assignment
      362.     memset(state, 128, sizeof(state));
      363. 
      364.     for (i = 1; i < 128; i++)
                    ^
      365.         if (quant_table[i] != quant_table[i - 1]) {
      366.             put_symbol(c, state, i - last - 1, 0);

libavcodec/ffv1enc.c:357:1: <Length trace>
355. 
356. 
357. static void write_quant_table(RangeCoder *c, int16_t *quant_table)
     ^
358. {
359.     int last = 0;

libavcodec/ffv1enc.c:357:1: Parameter `*quant_table`
      355. 
      356. 
      357. static void write_quant_table(RangeCoder *c, int16_t *quant_table)
           ^
      358. {
      359.     int last = 0;

libavcodec/ffv1enc.c:365:13: Array access: Offset: [1, 130+max(2, avctx->priv_data->quant_table_count)] (⇐ [0, 3+max(2, avctx->priv_data->quant_table_count)] + [1, 127]) Size: 8 by call to `write_extradata` 
      363. 
      364.     for (i = 1; i < 128; i++)
      365.         if (quant_table[i] != quant_table[i - 1]) {
                       ^
      366.             put_symbol(c, state, i - last - 1, 0);
      367.             last = i;

static void write_quant_table(RangeCoder *c, int16_t *quant_table)
{
    int last = 0;
    int i;
    uint8_t state[CONTEXT_SIZE];
    memset(state, 128, sizeof(state));
    for (i = 1; i < 128; i++)
        if (quant_table[i] != quant_table[i - 1]) {
            put_symbol(c, state, i - last - 1, 0);
            last = i;
        }
    put_symbol(c, state, i - last - 1, 0);
}
['static av_cold int ffv1_encode_init(AVCodecContext *avctx)\n{\n    FFV1Context *s = avctx->priv_data;\n    const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(avctx->pix_fmt);\n    int i, j, k, m, ret;\n    ffv1_common_init(avctx);\n    s->version = 0;\n    if ((avctx->flags & (CODEC_FLAG_PASS1 | CODEC_FLAG_PASS2)) ||\n        avctx->slices > 1)\n        s->version = FFMAX(s->version, 2);\n    if (avctx->level == 3) {\n        s->version = 3;\n    }\n    if (s->ec < 0) {\n        s->ec = (s->version >= 3);\n    }\n    if (s->version >= 2 &&\n        avctx->strict_std_compliance > FF_COMPLIANCE_EXPERIMENTAL) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Version %d requested, please set -strict experimental in "\n               "order to enable it\\n",\n               s->version);\n        return AVERROR(ENOSYS);\n    }\n    s->ac = avctx->coder_type > 0 ? 2 : 0;\n    s->plane_count = 3;\n    switch (avctx->pix_fmt) {\n    case AV_PIX_FMT_YUV444P9:\n    case AV_PIX_FMT_YUV422P9:\n    case AV_PIX_FMT_YUV420P9:\n        if (!avctx->bits_per_raw_sample)\n            s->bits_per_raw_sample = 9;\n    case AV_PIX_FMT_YUV444P10:\n    case AV_PIX_FMT_YUV420P10:\n    case AV_PIX_FMT_YUV422P10:\n        s->packed_at_lsb = 1;\n        if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample)\n            s->bits_per_raw_sample = 10;\n    case AV_PIX_FMT_GRAY16:\n    case AV_PIX_FMT_YUV444P16:\n    case AV_PIX_FMT_YUV422P16:\n    case AV_PIX_FMT_YUV420P16:\n        if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample) {\n            s->bits_per_raw_sample = 16;\n        } else if (!s->bits_per_raw_sample) {\n            s->bits_per_raw_sample = avctx->bits_per_raw_sample;\n        }\n        if (s->bits_per_raw_sample <= 8) {\n            av_log(avctx, AV_LOG_ERROR, "bits_per_raw_sample invalid\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        if (!s->ac && avctx->coder_type == -1) {\n            av_log(avctx, AV_LOG_INFO,\n                   "bits_per_raw_sample > 8, forcing coder 1\\n");\n            s->ac = 2;\n        }\n        if (!s->ac) {\n            av_log(\n                avctx, AV_LOG_ERROR,\n                "bits_per_raw_sample of more than 8 needs -coder 1 currently\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        s->version = FFMAX(s->version, 1);\n    case AV_PIX_FMT_GRAY8:\n    case AV_PIX_FMT_YUV444P:\n    case AV_PIX_FMT_YUV440P:\n    case AV_PIX_FMT_YUV422P:\n    case AV_PIX_FMT_YUV420P:\n    case AV_PIX_FMT_YUV411P:\n    case AV_PIX_FMT_YUV410P:\n        s->chroma_planes = desc->nb_components < 3 ? 0 : 1;\n        s->colorspace    = 0;\n        break;\n    case AV_PIX_FMT_YUVA444P:\n    case AV_PIX_FMT_YUVA422P:\n    case AV_PIX_FMT_YUVA420P:\n        s->chroma_planes = 1;\n        s->colorspace    = 0;\n        s->transparency  = 1;\n        break;\n    case AV_PIX_FMT_RGB32:\n        s->colorspace   = 1;\n        s->transparency = 1;\n        break;\n    case AV_PIX_FMT_GBRP9:\n        if (!avctx->bits_per_raw_sample)\n            s->bits_per_raw_sample = 9;\n    case AV_PIX_FMT_GBRP10:\n        if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample)\n            s->bits_per_raw_sample = 10;\n    case AV_PIX_FMT_GBRP16:\n        if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample)\n            s->bits_per_raw_sample = 16;\n        else if (!s->bits_per_raw_sample)\n            s->bits_per_raw_sample = avctx->bits_per_raw_sample;\n        s->colorspace    = 1;\n        s->chroma_planes = 1;\n        s->version       = FFMAX(s->version, 1);\n        break;\n    default:\n        av_log(avctx, AV_LOG_ERROR, "format not supported\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (s->transparency) {\n        av_log(\n            avctx, AV_LOG_WARNING,\n            "Storing alpha plane, this will require a recent FFV1 decoder to playback!\\n");\n    }\n    if (avctx->context_model > 1U) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Invalid context model %d, valid values are 0 and 1\\n",\n               avctx->context_model);\n        return AVERROR(EINVAL);\n    }\n    if (s->ac > 1)\n        for (i = 1; i < 256; i++)\n            s->state_transition[i] = ffv1_ver2_state[i];\n    for (i = 0; i < 256; i++) {\n        s->quant_table_count = 2;\n        if (s->bits_per_raw_sample <= 8) {\n            s->quant_tables[0][0][i] = ffv1_quant11[i];\n            s->quant_tables[0][1][i] = ffv1_quant11[i] * 11;\n            s->quant_tables[0][2][i] = ffv1_quant11[i] * 11 * 11;\n            s->quant_tables[1][0][i] = ffv1_quant11[i];\n            s->quant_tables[1][1][i] = ffv1_quant11[i] * 11;\n            s->quant_tables[1][2][i] = ffv1_quant5[i]  * 11 * 11;\n            s->quant_tables[1][3][i] = ffv1_quant5[i]  *  5 * 11 * 11;\n            s->quant_tables[1][4][i] = ffv1_quant5[i]  *  5 *  5 * 11 * 11;\n        } else {\n            s->quant_tables[0][0][i] = ffv1_quant9_10bit[i];\n            s->quant_tables[0][1][i] = ffv1_quant9_10bit[i] * 11;\n            s->quant_tables[0][2][i] = ffv1_quant9_10bit[i] * 11 * 11;\n            s->quant_tables[1][0][i] = ffv1_quant9_10bit[i];\n            s->quant_tables[1][1][i] = ffv1_quant9_10bit[i] * 11;\n            s->quant_tables[1][2][i] = ffv1_quant5_10bit[i] * 11 * 11;\n            s->quant_tables[1][3][i] = ffv1_quant5_10bit[i] *  5 * 11 * 11;\n            s->quant_tables[1][4][i] = ffv1_quant5_10bit[i] *  5 *  5 * 11 * 11;\n        }\n    }\n    s->context_count[0] = (11 * 11 * 11        + 1) / 2;\n    s->context_count[1] = (11 * 11 * 5 * 5 * 5 + 1) / 2;\n    memcpy(s->quant_table, s->quant_tables[avctx->context_model],\n           sizeof(s->quant_table));\n    for (i = 0; i < s->plane_count; i++) {\n        PlaneContext *const p = &s->plane[i];\n        memcpy(p->quant_table, s->quant_table, sizeof(p->quant_table));\n        p->quant_table_index = avctx->context_model;\n        p->context_count     = s->context_count[p->quant_table_index];\n    }\n    if ((ret = ffv1_allocate_initial_states(s)) < 0)\n        return ret;\n    avctx->coded_frame = &s->picture;\n    if (!s->transparency)\n        s->plane_count = 2;\n    avcodec_get_chroma_sub_sample(avctx->pix_fmt, &s->chroma_h_shift,\n                                  &s->chroma_v_shift);\n    s->picture_number = 0;\n    if (avctx->flags & (CODEC_FLAG_PASS1 | CODEC_FLAG_PASS2)) {\n        for (i = 0; i < s->quant_table_count; i++) {\n            s->rc_stat2[i] = av_mallocz(s->context_count[i] *\n                                        sizeof(*s->rc_stat2[i]));\n            if (!s->rc_stat2[i])\n                return AVERROR(ENOMEM);\n        }\n    }\n    if (avctx->stats_in) {\n        char *p = avctx->stats_in;\n        uint8_t best_state[256][256];\n        int gob_count = 0;\n        char *next;\n        av_assert0(s->version >= 2);\n        for (;; ) {\n            for (j = 0; j < 256; j++)\n                for (i = 0; i < 2; i++) {\n                    s->rc_stat[j][i] = strtol(p, &next, 0);\n                    if (next == p) {\n                        av_log(avctx, AV_LOG_ERROR,\n                               "2Pass file invalid at %d %d [%s]\\n", j, i, p);\n                        return AVERROR_INVALIDDATA;\n                    }\n                    p = next;\n                }\n            for (i = 0; i < s->quant_table_count; i++)\n                for (j = 0; j < s->context_count[i]; j++) {\n                    for (k = 0; k < 32; k++)\n                        for (m = 0; m < 2; m++) {\n                            s->rc_stat2[i][j][k][m] = strtol(p, &next, 0);\n                            if (next == p) {\n                                av_log(avctx, AV_LOG_ERROR,\n                                       "2Pass file invalid at %d %d %d %d [%s]\\n",\n                                       i, j, k, m, p);\n                                return AVERROR_INVALIDDATA;\n                            }\n                            p = next;\n                        }\n                }\n            gob_count = strtol(p, &next, 0);\n            if (next == p || gob_count <= 0) {\n                av_log(avctx, AV_LOG_ERROR, "2Pass file invalid\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            p = next;\n            while (*p == \'\\n\' || *p == \' \')\n                p++;\n            if (p[0] == 0)\n                break;\n        }\n        sort_stt(s, s->state_transition);\n        find_best_state(best_state, s->state_transition);\n        for (i = 0; i < s->quant_table_count; i++) {\n            for (j = 0; j < s->context_count[i]; j++)\n                for (k = 0; k < 32; k++) {\n                    double p = 128;\n                    if (s->rc_stat2[i][j][k][0] + s->rc_stat2[i][j][k][1]) {\n                        p = 256.0 * s->rc_stat2[i][j][k][1] /\n                            (s->rc_stat2[i][j][k][0] + s->rc_stat2[i][j][k][1]);\n                    }\n                    s->initial_states[i][j][k] =\n                        best_state[av_clip(round(p), 1, 255)][av_clip((s->rc_stat2[i][j][k][0] +\n                                                                       s->rc_stat2[i][j][k][1]) /\n                                                                      gob_count, 0, 255)];\n                }\n        }\n    }\n    if (s->version > 1) {\n        for (s->num_v_slices = 2; s->num_v_slices < 9; s->num_v_slices++)\n            for (s->num_h_slices = s->num_v_slices;\n                 s->num_h_slices < 2 * s->num_v_slices; s->num_h_slices++)\n                if (avctx->slices == s->num_h_slices * s->num_v_slices &&\n                    avctx->slices <= 64 || !avctx->slices)\n                    goto slices_ok;\n        av_log(avctx, AV_LOG_ERROR,\n               "Unsupported number %d of slices requested, please specify a "\n               "supported number with -slices (ex:4,6,9,12,16, ...)\\n",\n               avctx->slices);\n        return AVERROR(ENOSYS);\nslices_ok:\n        write_extradata(s);\n    }\n    if ((ret = ffv1_init_slice_contexts(s)) < 0)\n        return ret;\n    if ((ret = init_slices_state(s)) < 0)\n        return ret;\n#define STATS_OUT_SIZE 1024 * 1024 * 6\n    if (avctx->flags & CODEC_FLAG_PASS1) {\n        avctx->stats_out = av_mallocz(STATS_OUT_SIZE);\n        for (i = 0; i < s->quant_table_count; i++)\n            for (j = 0; j < s->slice_count; j++) {\n                FFV1Context *sf = s->slice_context[j];\n                av_assert0(!sf->rc_stat2[i]);\n                sf->rc_stat2[i] = av_mallocz(s->context_count[i] *\n                                             sizeof(*sf->rc_stat2[i]));\n                if (!sf->rc_stat2[i])\n                    return AVERROR(ENOMEM);\n            }\n    }\n    return 0;\n}', 'static int write_extradata(FFV1Context *f)\n{\n    RangeCoder *const c = &f->c;\n    uint8_t state[CONTEXT_SIZE];\n    int i, j, k;\n    uint8_t state2[32][CONTEXT_SIZE];\n    unsigned v;\n    memset(state2, 128, sizeof(state2));\n    memset(state, 128, sizeof(state));\n    f->avctx->extradata_size = 10000 + 4 +\n                                    (11 * 11 * 5 * 5 * 5 + 11 * 11 * 11) * 32;\n    f->avctx->extradata = av_malloc(f->avctx->extradata_size);\n    ff_init_range_encoder(c, f->avctx->extradata, f->avctx->extradata_size);\n    ff_build_rac_states(c, 0.05 * (1LL << 32), 256 - 8);\n    put_symbol(c, state, f->version, 0);\n    if (f->version > 2) {\n        if (f->version == 3)\n            f->minor_version = 2;\n        put_symbol(c, state, f->minor_version, 0);\n    }\n    put_symbol(c, state, f->ac, 0);\n    if (f->ac > 1)\n        for (i = 1; i < 256; i++)\n            put_symbol(c, state, f->state_transition[i] - c->one_state[i], 1);\n    put_symbol(c, state, f->colorspace, 0);\n    put_symbol(c, state, f->bits_per_raw_sample, 0);\n    put_rac(c, state, f->chroma_planes);\n    put_symbol(c, state, f->chroma_h_shift, 0);\n    put_symbol(c, state, f->chroma_v_shift, 0);\n    put_rac(c, state, f->transparency);\n    put_symbol(c, state, f->num_h_slices - 1, 0);\n    put_symbol(c, state, f->num_v_slices - 1, 0);\n    put_symbol(c, state, f->quant_table_count, 0);\n    for (i = 0; i < f->quant_table_count; i++)\n        write_quant_tables(c, f->quant_tables[i]);\n    for (i = 0; i < f->quant_table_count; i++) {\n        for (j = 0; j < f->context_count[i] * CONTEXT_SIZE; j++)\n            if (f->initial_states[i] && f->initial_states[i][0][j] != 128)\n                break;\n        if (j < f->context_count[i] * CONTEXT_SIZE) {\n            put_rac(c, state, 1);\n            for (j = 0; j < f->context_count[i]; j++)\n                for (k = 0; k < CONTEXT_SIZE; k++) {\n                    int pred = j ? f->initial_states[i][j - 1][k] : 128;\n                    put_symbol(c, state2[k],\n                               (int8_t)(f->initial_states[i][j][k] - pred), 1);\n                }\n        } else {\n            put_rac(c, state, 0);\n        }\n    }\n    if (f->version > 2) {\n        put_symbol(c, state, f->ec, 0);\n    }\n    f->avctx->extradata_size = ff_rac_terminate(c);\n    v = av_crc(av_crc_get_table(AV_CRC_32_IEEE), 0,\n               f->avctx->extradata, f->avctx->extradata_size);\n    AV_WL32(f->avctx->extradata + f->avctx->extradata_size, v);\n    f->avctx->extradata_size += 4;\n    return 0;\n}', 'static void write_quant_tables(RangeCoder *c,\n                               int16_t quant_table[MAX_CONTEXT_INPUTS][256])\n{\n    int i;\n    for (i = 0; i < 5; i++)\n        write_quant_table(c, quant_table[i]);\n}', 'static void write_quant_table(RangeCoder *c, int16_t *quant_table)\n{\n    int last = 0;\n    int i;\n    uint8_t state[CONTEXT_SIZE];\n    memset(state, 128, sizeof(state));\n    for (i = 1; i < 128; i++)\n        if (quant_table[i] != quant_table[i - 1]) {\n            put_symbol(c, state, i - last - 1, 0);\n            last = i;\n        }\n    put_symbol(c, state, i - last - 1, 0);\n}']