libavcodec/mlpdec.c:388: error: Buffer Overrun L3
  Offset added: 16 Size: [0, +oo].

libavcodec/mlpdec.c:329:1: <Length trace>
327.  *  (always) present only in blocks following a major sync. */
328. 
329. static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
     ^
330.                                const uint8_t *buf, unsigned int substr)
331. {

libavcodec/mlpdec.c:329:1: Parameter `m->substream[*].ch_assign[*]`
327.  *  (always) present only in blocks following a major sync. */
328. 
329. static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
     ^
330.                                const uint8_t *buf, unsigned int substr)
331. {

libavcodec/mlpdec.c:388:5: Array access: Offset added: 16 Size: [0, +oo]
386.     skip_bits(gbp, 16);
387. 
388.     memset(s->ch_assign, 0, sizeof(s->ch_assign));
         ^
389. 
390.     for (ch = 0; ch <= s->max_matrix_channel; ch++) {

static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,
                               const uint8_t *buf, unsigned int substr)
{
    SubStream *s = &m->substream[substr];
    unsigned int ch;
    int sync_word, tmp;
    uint8_t checksum;
    uint8_t lossless_check;
    int start_count = get_bits_count(gbp);
    sync_word = get_bits(gbp, 13);
    if (sync_word != 0x31ea >> 1) {
        av_log(m->avctx, AV_LOG_ERROR,
               "restart header sync incorrect (got 0x%04x)\n", sync_word);
        return -1;
    }
    s->noise_type = get_bits1(gbp);
    skip_bits(gbp, 16);
    s->min_channel        = get_bits(gbp, 4);
    s->max_channel        = get_bits(gbp, 4);
    s->max_matrix_channel = get_bits(gbp, 4);
    if (s->min_channel > s->max_channel) {
        av_log(m->avctx, AV_LOG_ERROR,
               "Substream min channel cannot be greater than max channel.\n");
        return -1;
    }
    if (m->avctx->request_channels > 0
        && s->max_channel + 1 >= m->avctx->request_channels
        && substr < m->max_decoded_substream) {
        av_log(m->avctx, AV_LOG_INFO,
               "Extracting %d channel downmix from substream %d. "
               "Further substreams will be skipped.\n",
               s->max_channel + 1, substr);
        m->max_decoded_substream = substr;
    }
    s->noise_shift   = get_bits(gbp,  4);
    s->noisegen_seed = get_bits(gbp, 23);
    skip_bits(gbp, 19);
    s->data_check_present = get_bits1(gbp);
    lossless_check = get_bits(gbp, 8);
    if (substr == m->max_decoded_substream
        && s->lossless_check_data != 0xffffffff) {
        tmp = xor_32_to_8(s->lossless_check_data);
        if (tmp != lossless_check)
            av_log(m->avctx, AV_LOG_WARNING,
                   "Lossless check failed - expected %02x, calculated %02x.\n",
                   lossless_check, tmp);
    }
    skip_bits(gbp, 16);
    memset(s->ch_assign, 0, sizeof(s->ch_assign));
    for (ch = 0; ch <= s->max_matrix_channel; ch++) {
        int ch_assign = get_bits(gbp, 6);
        if (ch_assign > s->max_matrix_channel) {
            av_log(m->avctx, AV_LOG_ERROR,
                   "Assignment of matrix channel %d to invalid output channel %d. %s\n",
                   ch, ch_assign, sample_message);
            return -1;
        }
        s->ch_assign[ch_assign] = ch;
    }
    checksum = ff_mlp_restart_checksum(buf, get_bits_count(gbp) - start_count);
    if (checksum != get_bits(gbp, 8))
        av_log(m->avctx, AV_LOG_ERROR, "restart header checksum error\n");
    s->param_presence_flags   = 0xff;
    s->num_primitive_matrices = 0;
    s->blocksize              = 8;
    s->lossless_check_data    = 0;
    memset(s->output_shift   , 0, sizeof(s->output_shift   ));
    memset(s->quant_step_size, 0, sizeof(s->quant_step_size));
    for (ch = s->min_channel; ch <= s->max_channel; ch++) {
        ChannelParams *cp = &m->channel_params[ch];
        cp->filter_params[FIR].order = 0;
        cp->filter_params[IIR].order = 0;
        cp->filter_params[FIR].shift = 0;
        cp->filter_params[IIR].shift = 0;
        cp->huff_offset      = 0;
        cp->sign_huff_offset = (-1) << 23;
        cp->codebook         = 0;
        cp->huff_lsbs        = 24;
    }
    if (substr == m->max_decoded_substream) {
        m->avctx->channels = s->max_matrix_channel + 1;
    }
    return 0;
}
['static int read_restart_header(MLPDecodeContext *m, GetBitContext *gbp,\n                               const uint8_t *buf, unsigned int substr)\n{\n    SubStream *s = &m->substream[substr];\n    unsigned int ch;\n    int sync_word, tmp;\n    uint8_t checksum;\n    uint8_t lossless_check;\n    int start_count = get_bits_count(gbp);\n    sync_word = get_bits(gbp, 13);\n    if (sync_word != 0x31ea >> 1) {\n        av_log(m->avctx, AV_LOG_ERROR,\n               "restart header sync incorrect (got 0x%04x)\\n", sync_word);\n        return -1;\n    }\n    s->noise_type = get_bits1(gbp);\n    skip_bits(gbp, 16);\n    s->min_channel        = get_bits(gbp, 4);\n    s->max_channel        = get_bits(gbp, 4);\n    s->max_matrix_channel = get_bits(gbp, 4);\n    if (s->min_channel > s->max_channel) {\n        av_log(m->avctx, AV_LOG_ERROR,\n               "Substream min channel cannot be greater than max channel.\\n");\n        return -1;\n    }\n    if (m->avctx->request_channels > 0\n        && s->max_channel + 1 >= m->avctx->request_channels\n        && substr < m->max_decoded_substream) {\n        av_log(m->avctx, AV_LOG_INFO,\n               "Extracting %d channel downmix from substream %d. "\n               "Further substreams will be skipped.\\n",\n               s->max_channel + 1, substr);\n        m->max_decoded_substream = substr;\n    }\n    s->noise_shift   = get_bits(gbp,  4);\n    s->noisegen_seed = get_bits(gbp, 23);\n    skip_bits(gbp, 19);\n    s->data_check_present = get_bits1(gbp);\n    lossless_check = get_bits(gbp, 8);\n    if (substr == m->max_decoded_substream\n        && s->lossless_check_data != 0xffffffff) {\n        tmp = xor_32_to_8(s->lossless_check_data);\n        if (tmp != lossless_check)\n            av_log(m->avctx, AV_LOG_WARNING,\n                   "Lossless check failed - expected %02x, calculated %02x.\\n",\n                   lossless_check, tmp);\n    }\n    skip_bits(gbp, 16);\n    memset(s->ch_assign, 0, sizeof(s->ch_assign));\n    for (ch = 0; ch <= s->max_matrix_channel; ch++) {\n        int ch_assign = get_bits(gbp, 6);\n        if (ch_assign > s->max_matrix_channel) {\n            av_log(m->avctx, AV_LOG_ERROR,\n                   "Assignment of matrix channel %d to invalid output channel %d. %s\\n",\n                   ch, ch_assign, sample_message);\n            return -1;\n        }\n        s->ch_assign[ch_assign] = ch;\n    }\n    checksum = ff_mlp_restart_checksum(buf, get_bits_count(gbp) - start_count);\n    if (checksum != get_bits(gbp, 8))\n        av_log(m->avctx, AV_LOG_ERROR, "restart header checksum error\\n");\n    s->param_presence_flags   = 0xff;\n    s->num_primitive_matrices = 0;\n    s->blocksize              = 8;\n    s->lossless_check_data    = 0;\n    memset(s->output_shift   , 0, sizeof(s->output_shift   ));\n    memset(s->quant_step_size, 0, sizeof(s->quant_step_size));\n    for (ch = s->min_channel; ch <= s->max_channel; ch++) {\n        ChannelParams *cp = &m->channel_params[ch];\n        cp->filter_params[FIR].order = 0;\n        cp->filter_params[IIR].order = 0;\n        cp->filter_params[FIR].shift = 0;\n        cp->filter_params[IIR].shift = 0;\n        cp->huff_offset      = 0;\n        cp->sign_huff_offset = (-1) << 23;\n        cp->codebook         = 0;\n        cp->huff_lsbs        = 24;\n    }\n    if (substr == m->max_decoded_substream) {\n        m->avctx->channels = s->max_matrix_channel + 1;\n    }\n    return 0;\n}']