libavformat/hdsenc.c:98: error: Buffer Overrun L2
  Offset: [`os->nb_extra_packets`, 2] Size: 2.

libavformat/hdsenc.c:78:1: <Offset trace>
76. } HDSContext;
77. 
78. static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size)
    ^
79. {
80.     if (buf_size < 13)

libavformat/hdsenc.c:78:1: Parameter `os->nb_extra_packets`
76. } HDSContext;
77. 
78. static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size)
    ^
79. {
80.     if (buf_size < 13)

libavformat/hdsenc.c:78:1: <Length trace>
76. } HDSContext;
77. 
78. static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size)
    ^
79. {
80.     if (buf_size < 13)

libavformat/hdsenc.c:78:1: Parameter `os->extra_packets[*]`
76. } HDSContext;
77. 
78. static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size)
    ^
79. {
80.     if (buf_size < 13)

libavformat/hdsenc.c:98:20: Array access: Offset: [os->nb_extra_packets, 2] Size: 2
 96.             if (!os->extra_packets[os->nb_extra_packets])
 97.                 return AVERROR(ENOMEM);
 98.             memcpy(os->extra_packets[os->nb_extra_packets], buf, size);
                        ^
 99.             os->nb_extra_packets++;
100.         } else if (type == 0x12) {

static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size)
{
    if (buf_size < 13)
        return AVERROR_INVALIDDATA;
    if (memcmp(buf, "FLV", 3))
        return AVERROR_INVALIDDATA;
    buf      += 13;
    buf_size -= 13;
    while (buf_size >= 11 + 4) {
        int type = buf[0];
        int size = AV_RB24(&buf[1]) + 11 + 4;
        if (size > buf_size)
            return AVERROR_INVALIDDATA;
        if (type == 8 || type == 9) {
            if (os->nb_extra_packets > FF_ARRAY_ELEMS(os->extra_packets))
                return AVERROR_INVALIDDATA;
            os->extra_packet_sizes[os->nb_extra_packets] = size;
            os->extra_packets[os->nb_extra_packets] = av_malloc(size);
            if (!os->extra_packets[os->nb_extra_packets])
                return AVERROR(ENOMEM);
            memcpy(os->extra_packets[os->nb_extra_packets], buf, size);
            os->nb_extra_packets++;
        } else if (type == 0x12) {
            if (os->metadata)
                return AVERROR_INVALIDDATA;
            os->metadata_size = size - 11 - 4;
            os->metadata      = av_malloc(os->metadata_size);
            if (!os->metadata)
                return AVERROR(ENOMEM);
            memcpy(os->metadata, buf + 11, os->metadata_size);
        }
        buf      += size;
        buf_size -= size;
    }
    if (!os->metadata)
        return AVERROR_INVALIDDATA;
    return 0;
}
['static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size)\n{\n    if (buf_size < 13)\n        return AVERROR_INVALIDDATA;\n    if (memcmp(buf, "FLV", 3))\n        return AVERROR_INVALIDDATA;\n    buf      += 13;\n    buf_size -= 13;\n    while (buf_size >= 11 + 4) {\n        int type = buf[0];\n        int size = AV_RB24(&buf[1]) + 11 + 4;\n        if (size > buf_size)\n            return AVERROR_INVALIDDATA;\n        if (type == 8 || type == 9) {\n            if (os->nb_extra_packets > FF_ARRAY_ELEMS(os->extra_packets))\n                return AVERROR_INVALIDDATA;\n            os->extra_packet_sizes[os->nb_extra_packets] = size;\n            os->extra_packets[os->nb_extra_packets] = av_malloc(size);\n            if (!os->extra_packets[os->nb_extra_packets])\n                return AVERROR(ENOMEM);\n            memcpy(os->extra_packets[os->nb_extra_packets], buf, size);\n            os->nb_extra_packets++;\n        } else if (type == 0x12) {\n            if (os->metadata)\n                return AVERROR_INVALIDDATA;\n            os->metadata_size = size - 11 - 4;\n            os->metadata      = av_malloc(os->metadata_size);\n            if (!os->metadata)\n                return AVERROR(ENOMEM);\n            memcpy(os->metadata, buf + 11, os->metadata_size);\n        }\n        buf      += size;\n        buf_size -= size;\n    }\n    if (!os->metadata)\n        return AVERROR_INVALIDDATA;\n    return 0;\n}']