libavcodec/mpc8.c:293: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 33 by call to `mpc8_get_mask`.

libavcodec/mpc8.c:288:13: Assignment
286.             int mask;
287. 
288.             cnt = 0;
                 ^
289.             for(i = 0; i < maxband; i++)
290.                 if(bands[i].res[0] || bands[i].res[1])

libavcodec/mpc8.c:293:20: Call
291.                     cnt++;
292.             t = mpc8_get_mod_golomb(bc, cnt);
293.             mask = mpc8_get_mask(bc, cnt, t);
                        ^
294.             for(i = maxband - 1; i >= 0; i--)
295.                 if(bands[i].res[0] || bands[i].res[1]){

libavcodec/mpc8.c:82:1: Parameter `t`
  80. }
  81. 
  82. static int mpc8_get_mask(BitstreamContext *bc, int size, int t)
      ^
  83. {
  84.     int mask = 0;

libavcodec/mpc8.c:87:17: Call
  85. 
  86.     if(t && t != size)
  87.          mask = mpc8_dec_enum(bc, FFMIN(t, size - t), size);
                      ^
  88.     if((t << 1) > size) mask = ~mask;
  89. 

libavcodec/mpc8.c:57:1: Parameter `n`
    55. }
    56. 
    57. static inline int mpc8_dec_enum(BitstreamContext *bc, int k, int n)
        ^
    58. {
    59.     int bits = 0;

libavcodec/mpc8.c:61:16: Call
    59.     int bits = 0;
    60.     const uint32_t * C = mpc8_cnk[k-1];
    61.     int code = mpc8_dec_base(bc, k, n);
                       ^
    62. 
    63.     do {

libavcodec/mpc8.c:46:1: <Offset trace>
44. static const int quant_offsets[6] = { MPC8_Q5_OFFSET, MPC8_Q6_OFFSET, MPC8_Q7_OFFSET, MPC8_Q8_OFFSET };
45. 
46. static inline int mpc8_dec_base(BitstreamContext *bc, int k, int n)
    ^
47. {
48.     int len = mpc8_cnk_len[k-1][n-1] - 1;

libavcodec/mpc8.c:46:1: Parameter `n`
      44. static const int quant_offsets[6] = { MPC8_Q5_OFFSET, MPC8_Q6_OFFSET, MPC8_Q7_OFFSET, MPC8_Q8_OFFSET };
      45. 
      46. static inline int mpc8_dec_base(BitstreamContext *bc, int k, int n)
          ^
      47. {
      48.     int len = mpc8_cnk_len[k-1][n-1] - 1;

libavcodec/mpc8data.h:80:1: <Length trace>
78. };
79. 
80. static const uint8_t mpc8_cnk_len[16][33] =
    ^
81. {
82.     {0, 1, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6},

libavcodec/mpc8data.h:80:1: Array declaration
      78. };
      79. 
      80. static const uint8_t mpc8_cnk_len[16][33] =
          ^
      81. {
      82.     {0, 1, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 6},

libavcodec/mpc8.c:48:15: Array access: Offset: [-1, +oo] Size: 33 by call to `mpc8_get_mask` 
      46. static inline int mpc8_dec_base(BitstreamContext *bc, int k, int n)
      47. {
      48.     int len = mpc8_cnk_len[k-1][n-1] - 1;
                        ^
      49.     int code = len ? bitstream_read(bc, len) : 0;
      50. 

static inline int mpc8_dec_base(BitstreamContext *bc, int k, int n)
{
    int len = mpc8_cnk_len[k-1][n-1] - 1;
    int code = len ? bitstream_read(bc, len) : 0;
    if (code >= mpc8_cnk_lost[k-1][n-1])
        code = ((code << 1) | bitstream_read_bit(bc)) - mpc8_cnk_lost[k - 1][n - 1];
    return code;
}
['static int mpc8_decode_frame(AVCodecContext * avctx, void *data,\n                             int *got_frame_ptr, AVPacket *avpkt)\n{\n    AVFrame *frame     = data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    MPCContext *c = avctx->priv_data;\n    BitstreamContext bc2, *bc = &bc2;\n    int i, j, k, ch, cnt, res, t;\n    Band *bands = c->bands;\n    int off;\n    int maxband, keyframe;\n    int last[2];\n    frame->nb_samples = MPC_FRAME_SIZE;\n    if ((res = ff_get_buffer(avctx, frame, 0)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return res;\n    }\n    keyframe = c->cur_frame == 0;\n    if(keyframe){\n        memset(c->Q, 0, sizeof(c->Q));\n        c->last_bits_used = 0;\n    }\n    bitstream_init(bc, buf, buf_size * 8);\n    bitstream_skip(bc, c->last_bits_used & 7);\n    if(keyframe)\n        maxband = mpc8_get_mod_golomb(bc, c->maxbands + 1);\n    else{\n        maxband = c->last_max_band + bitstream_read_vlc(bc, band_vlc.table, MPC8_BANDS_BITS, 2);\n        if(maxband > 32) maxband -= 33;\n    }\n    if(maxband > c->maxbands + 1)\n        return AVERROR_INVALIDDATA;\n    c->last_max_band = maxband;\n    if(maxband){\n        last[0] = last[1] = 0;\n        for(i = maxband - 1; i >= 0; i--){\n            for(ch = 0; ch < 2; ch++){\n                last[ch] = bitstream_read_vlc(bc, res_vlc[last[ch] > 2].table, MPC8_RES_BITS, 2) + last[ch];\n                if(last[ch] > 15) last[ch] -= 17;\n                bands[i].res[ch] = last[ch];\n            }\n        }\n        if(c->MSS){\n            int mask;\n            cnt = 0;\n            for(i = 0; i < maxband; i++)\n                if(bands[i].res[0] || bands[i].res[1])\n                    cnt++;\n            t = mpc8_get_mod_golomb(bc, cnt);\n            mask = mpc8_get_mask(bc, cnt, t);\n            for(i = maxband - 1; i >= 0; i--)\n                if(bands[i].res[0] || bands[i].res[1]){\n                    bands[i].msf = mask & 1;\n                    mask >>= 1;\n                }\n        }\n    }\n    for(i = maxband; i < c->maxbands; i++)\n        bands[i].res[0] = bands[i].res[1] = 0;\n    if(keyframe){\n        for(i = 0; i < 32; i++)\n            c->oldDSCF[0][i] = c->oldDSCF[1][i] = 1;\n    }\n    for(i = 0; i < maxband; i++){\n        if(bands[i].res[0] || bands[i].res[1]){\n            cnt = !!bands[i].res[0] + !!bands[i].res[1] - 1;\n            if(cnt >= 0){\n                t = bitstream_read_vlc(bc, scfi_vlc[cnt].table, scfi_vlc[cnt].bits, 1);\n                if(bands[i].res[0]) bands[i].scfi[0] = t >> (2 * cnt);\n                if(bands[i].res[1]) bands[i].scfi[1] = t & 3;\n            }\n        }\n    }\n    for(i = 0; i < maxband; i++){\n        for(ch = 0; ch < 2; ch++){\n            if(!bands[i].res[ch]) continue;\n            if(c->oldDSCF[ch][i]){\n                bands[i].scf_idx[ch][0] = bitstream_read(bc, 7) - 6;\n                c->oldDSCF[ch][i] = 0;\n            }else{\n                t = bitstream_read_vlc(bc, dscf_vlc[1].table, MPC8_DSCF1_BITS, 2);\n                if(t == 64)\n                    t += bitstream_read(bc, 6);\n                bands[i].scf_idx[ch][0] = ((bands[i].scf_idx[ch][2] + t - 25) & 0x7F) - 6;\n            }\n            for(j = 0; j < 2; j++){\n                if((bands[i].scfi[ch] << j) & 2)\n                    bands[i].scf_idx[ch][j + 1] = bands[i].scf_idx[ch][j];\n                else{\n                    t = bitstream_read_vlc(bc, dscf_vlc[0].table, MPC8_DSCF0_BITS, 2);\n                    if(t == 31)\n                        t = 64 + bitstream_read(bc, 6);\n                    bands[i].scf_idx[ch][j + 1] = ((bands[i].scf_idx[ch][j] + t - 25) & 0x7F) - 6;\n                }\n            }\n        }\n    }\n    for(i = 0, off = 0; i < maxband; i++, off += SAMPLES_PER_BAND){\n        for(ch = 0; ch < 2; ch++){\n            res = bands[i].res[ch];\n            switch(res){\n            case -1:\n                for(j = 0; j < SAMPLES_PER_BAND; j++)\n                    c->Q[ch][off + j] = (av_lfg_get(&c->rnd) & 0x3FC) - 510;\n                break;\n            case 0:\n                break;\n            case 1:\n                for(j = 0; j < SAMPLES_PER_BAND; j += SAMPLES_PER_BAND / 2){\n                    cnt = bitstream_read_vlc(bc, q1_vlc.table, MPC8_Q1_BITS, 2);\n                    t = mpc8_get_mask(bc, 18, cnt);\n                    for(k = 0; k < SAMPLES_PER_BAND / 2; k++, t <<= 1)\n                        c->Q[ch][off + j + k] = (t & 0x20000) ? (bitstream_read_bit(bc) << 1) - 1 : 0;\n                }\n                break;\n            case 2:\n                cnt = 6;\n                for(j = 0; j < SAMPLES_PER_BAND; j += 3){\n                    t = bitstream_read_vlc(bc, q2_vlc[cnt > 3].table, MPC8_Q2_BITS, 2);\n                    c->Q[ch][off + j + 0] = mpc8_idx50[t];\n                    c->Q[ch][off + j + 1] = mpc8_idx51[t];\n                    c->Q[ch][off + j + 2] = mpc8_idx52[t];\n                    cnt = (cnt >> 1) + mpc8_huffq2[t];\n                }\n                break;\n            case 3:\n            case 4:\n                for(j = 0; j < SAMPLES_PER_BAND; j += 2){\n                    t = bitstream_read_vlc(bc, q3_vlc[res - 3].table, MPC8_Q3_BITS, 2) + q3_offsets[res - 3];\n                    c->Q[ch][off + j + 1] = t >> 4;\n                    c->Q[ch][off + j + 0] = (t & 8) ? (t & 0xF) - 16 : (t & 0xF);\n                }\n                break;\n            case 5:\n            case 6:\n            case 7:\n            case 8:\n                cnt = 2 * mpc8_thres[res];\n                for(j = 0; j < SAMPLES_PER_BAND; j++){\n                    t = bitstream_read_vlc(bc, quant_vlc[res - 5][cnt > mpc8_thres[res]].table, quant_vlc[res - 5][cnt > mpc8_thres[res]].bits, 2) + quant_offsets[res - 5];\n                    c->Q[ch][off + j] = t;\n                    cnt = (cnt >> 1) + FFABS(c->Q[ch][off + j]);\n                }\n                break;\n            default:\n                for(j = 0; j < SAMPLES_PER_BAND; j++){\n                    c->Q[ch][off + j] = bitstream_read_vlc(bc, q9up_vlc.table, MPC8_Q9UP_BITS, 2);\n                    if(res != 9){\n                        c->Q[ch][off + j] <<= res - 9;\n                        c->Q[ch][off + j] |= bitstream_read(bc, res - 9);\n                    }\n                    c->Q[ch][off + j] -= (1 << (res - 2)) - 1;\n                }\n            }\n        }\n    }\n    ff_mpc_dequantize_and_synth(c, maxband - 1,\n                                (int16_t **)frame->extended_data,\n                                avctx->channels);\n    c->cur_frame++;\n    c->last_bits_used = bitstream_tell(bc);\n    if (bitstream_bits_left(bc) < 8)\n        c->last_bits_used = buf_size << 3;\n    if(c->cur_frame >= c->frames)\n        c->cur_frame = 0;\n    *got_frame_ptr = 1;\n    return c->cur_frame ? c->last_bits_used >> 3 : buf_size;\n}', 'static int mpc8_get_mask(BitstreamContext *bc, int size, int t)\n{\n    int mask = 0;\n    if(t && t != size)\n         mask = mpc8_dec_enum(bc, FFMIN(t, size - t), size);\n    if((t << 1) > size) mask = ~mask;\n    return mask;\n}', 'static inline int mpc8_dec_enum(BitstreamContext *bc, int k, int n)\n{\n    int bits = 0;\n    const uint32_t * C = mpc8_cnk[k-1];\n    int code = mpc8_dec_base(bc, k, n);\n    do {\n        n--;\n        if (code >= C[n]) {\n            bits |= 1 << n;\n            code -= C[n];\n            C -= 32;\n            k--;\n        }\n    } while(k > 0);\n    return bits;\n}', 'static inline int mpc8_dec_base(BitstreamContext *bc, int k, int n)\n{\n    int len = mpc8_cnk_len[k-1][n-1] - 1;\n    int code = len ? bitstream_read(bc, len) : 0;\n    if (code >= mpc8_cnk_lost[k-1][n-1])\n        code = ((code << 1) | bitstream_read_bit(bc)) - mpc8_cnk_lost[k - 1][n - 1];\n    return code;\n}']