libavcodec/ffv1enc.c:922: error: Buffer Overrun L1
  Offset: [256, +oo] Size: 8 by call to `encode_rgb_frame`.

libavcodec/ffv1enc.c:890:9: Call
888.         ffv1_clear_slice_state(f, fs);
889.     if (f->version > 2) {
890.         encode_slice_header(f, fs);
             ^
891.     }
892.     if (!fs->ac) {

libavcodec/ffv1enc.c:863:9: Call
  861.                0);
  862.     for (j = 0; j < f->plane_count; j++) {
  863.         put_symbol(c, state, f->plane[j].quant_table_index, 0);
               ^
  864.         av_assert0(f->plane[j].quant_table_index == f->avctx->context_model);
  865.     }

libavcodec/ffv1enc.c:136:5: Call
    134.                                    int v, int is_signed)
    135. {
    136.     put_symbol_inline(c, state, v, is_signed, NULL, NULL);
             ^
    137. }
    138. 

libavcodec/ffv1enc.c:109:13: Call
      107.             for (i = 0; i < e; i++)
      108.                 put_rac(c, state + 1 + i, 1);  // 1..10
      109.             put_rac(c, state + 1 + i, 0);
                       ^
      110. 
      111.             for (i = e - 1; i >= 0; i--)

libavcodec/rangecoder.h:85:1: Parameter `*state`
        83. }
        84. 
        85. static inline void put_rac(RangeCoder *c, uint8_t *const state, int bit)
            ^
        86. {
        87.     int range1 = (c->range * (*state)) >> 8;

libavcodec/rangecoder.h:87:5: Assignment
        85. static inline void put_rac(RangeCoder *c, uint8_t *const state, int bit)
        86. {
        87.     int range1 = (c->range * (*state)) >> 8;
                ^
        88. 
        89.     assert(*state);

libavcodec/rangecoder.h:93:9: Assignment
        91.     assert(range1 > 0);
        92.     if (!bit) {
        93.         c->range -= range1;
                    ^
        94.         *state    = c->zero_state[*state];
        95.     } else {

libavcodec/rangecoder.h:101:5: Call
         99.     }
        100. 
        101.     renorm_encoder(c);
                 ^
        102. }
        103. 

libavcodec/rangecoder.h:52:1: Parameter `c->range`
          50. void ff_build_rac_states(RangeCoder *c, int factor, int max_p);
          51. 
          52. static inline void renorm_encoder(RangeCoder *c)
              ^
          53. {
          54.     // FIXME: optimize

libavcodec/ffv1enc.c:922:9: Call
920.                                      p->data[1] + ps * x + y * p->linesize[1],
921.                                      p->data[2] + ps * x + y * p->linesize[2] };
922.         encode_rgb_frame(fs, planes, width, height, p->linesize);
             ^
923.     }
924.     emms_c();

libavcodec/ffv1enc.c:296:1: Parameter `s->plane[*].quant_table_index`
  294. }
  295. 
  296. static void encode_rgb_frame(FFV1Context *s, const uint8_t *src[3],
       ^
  297.                              int w, int h, const int stride[3])
  298. {

libavcodec/ffv1enc.c:349:17: Call
  347.             sample[p][1][w]  = sample[p][1][w - 1];
  348.             if (lbd)
  349.                 encode_line(s, w, sample[p], (p + 1) / 2, 9);
                       ^
  350.             else
  351.                 encode_line(s, w, sample[p], (p + 1) / 2, bits + 1);

libavcodec/ffv1enc.c:170:1: <Offset trace>
168. }
169. 
170. static av_always_inline int encode_line(FFV1Context *s, int w,
     ^
171.                                         int16_t *sample[3],
172.                                         int plane_index, int bits)

libavcodec/ffv1enc.c:170:1: Parameter `s->plane[*].quant_table_index`
    168. }
    169. 
    170. static av_always_inline int encode_line(FFV1Context *s, int w,
         ^
    171.                                         int16_t *sample[3],
    172.                                         int plane_index, int bits)

libavcodec/ffv1enc.c:170:1: <Length trace>
168. }
169. 
170. static av_always_inline int encode_line(FFV1Context *s, int w,
     ^
171.                                         int16_t *sample[3],
172.                                         int plane_index, int bits)

libavcodec/ffv1enc.c:170:1: Parameter `s->rc_stat2[*]`
    168. }
    169. 
    170. static av_always_inline int encode_line(FFV1Context *s, int w,
         ^
    171.                                         int16_t *sample[3],
    172.                                         int plane_index, int bits)

libavcodec/ffv1enc.c:209:35: Array access: Offset: [256, +oo] Size: 8 by call to `encode_rgb_frame` 
    207.             if (s->flags & AV_CODEC_FLAG_PASS1) {
    208.                 put_symbol_inline(c, p->state[context], diff, 1, s->rc_stat,
    209.                                   s->rc_stat2[p->quant_table_index][context]);
                                           ^
    210.             } else {
    211.                 put_symbol_inline(c, p->state[context], diff, 1, NULL, NULL);

static av_always_inline int encode_line(FFV1Context *s, int w,
                                        int16_t *sample[3],
                                        int plane_index, int bits)
{
    PlaneContext *const p = &s->plane[plane_index];
    RangeCoder *const c   = &s->c;
    int x;
    int run_index = s->run_index;
    int run_count = 0;
    int run_mode  = 0;
    if (s->ac) {
        if (c->bytestream_end - c->bytestream < w * 20) {
            av_log(s->avctx, AV_LOG_ERROR, "encoded frame too large\n");
            return AVERROR_INVALIDDATA;
        }
    } else {
        if (s->pb.buf_end - s->pb.buf - (put_bits_count(&s->pb) >> 3) < w * 4) {
            av_log(s->avctx, AV_LOG_ERROR, "encoded frame too large\n");
            return AVERROR_INVALIDDATA;
        }
    }
    for (x = 0; x < w; x++) {
        int diff, context;
        context = get_context(p, sample[0] + x, sample[1] + x, sample[2] + x);
        diff    = sample[0][x] - predict(sample[0] + x, sample[1] + x);
        if (context < 0) {
            context = -context;
            diff    = -diff;
        }
        diff = fold(diff, bits);
        if (s->ac) {
            if (s->flags & AV_CODEC_FLAG_PASS1) {
                put_symbol_inline(c, p->state[context], diff, 1, s->rc_stat,
                                  s->rc_stat2[p->quant_table_index][context]);
            } else {
                put_symbol_inline(c, p->state[context], diff, 1, NULL, NULL);
            }
        } else {
            if (context == 0)
                run_mode = 1;
            if (run_mode) {
                if (diff) {
                    while (run_count >= 1 << ff_log2_run[run_index]) {
                        run_count -= 1 << ff_log2_run[run_index];
                        run_index++;
                        put_bits(&s->pb, 1, 1);
                    }
                    put_bits(&s->pb, 1 + ff_log2_run[run_index], run_count);
                    if (run_index)
                        run_index--;
                    run_count = 0;
                    run_mode  = 0;
                    if (diff > 0)
                        diff--;
                } else {
                    run_count++;
                }
            }
            ff_dlog(s->avctx, "count:%d index:%d, mode:%d, x:%d pos:%d\n",
                    run_count, run_index, run_mode, x,
                    (int)put_bits_count(&s->pb));
            if (run_mode == 0)
                put_vlc_symbol(&s->pb, &p->vlc_state[context], diff, bits);
        }
    }
    if (run_mode) {
        while (run_count >= 1 << ff_log2_run[run_index]) {
            run_count -= 1 << ff_log2_run[run_index];
            run_index++;
            put_bits(&s->pb, 1, 1);
        }
        if (run_count)
            put_bits(&s->pb, 1, 1);
    }
    s->run_index = run_index;
    return 0;
}
['static int encode_slice(AVCodecContext *c, void *arg)\n{\n    FFV1Context *fs  = *(void **)arg;\n    FFV1Context *f   = fs->avctx->priv_data;\n    int width        = fs->slice_width;\n    int height       = fs->slice_height;\n    int x            = fs->slice_x;\n    int y            = fs->slice_y;\n    const AVFrame *const p = f->frame;\n    const int ps     = (av_pix_fmt_desc_get(c->pix_fmt)->flags & AV_PIX_FMT_FLAG_PLANAR)\n                       ? (f->bits_per_raw_sample > 8) + 1\n                       : 4;\n    if (f->key_frame)\n        ffv1_clear_slice_state(f, fs);\n    if (f->version > 2) {\n        encode_slice_header(f, fs);\n    }\n    if (!fs->ac) {\n        if (f->version > 2)\n            put_rac(&fs->c, (uint8_t[]) { 129 }, 0);\n        fs->ac_byte_count = f->version > 2 || (!x && !y) ? ff_rac_terminate( &fs->c) : 0;\n        init_put_bits(&fs->pb, fs->c.bytestream_start + fs->ac_byte_count,\n                      fs->c.bytestream_end - fs->c.bytestream_start - fs->ac_byte_count);\n    }\n    if (f->colorspace == 0) {\n        const int chroma_width  = -((-width) >> f->chroma_h_shift);\n        const int chroma_height = -((-height) >> f->chroma_v_shift);\n        const int cx            = x >> f->chroma_h_shift;\n        const int cy            = y >> f->chroma_v_shift;\n        encode_plane(fs, p->data[0] + ps * x + y * p->linesize[0],\n                     width, height, p->linesize[0], 0);\n        if (f->chroma_planes) {\n            encode_plane(fs, p->data[1] + ps * cx + cy * p->linesize[1],\n                         chroma_width, chroma_height, p->linesize[1], 1);\n            encode_plane(fs, p->data[2] + ps * cx + cy * p->linesize[2],\n                         chroma_width, chroma_height, p->linesize[2], 1);\n        }\n        if (fs->transparency)\n            encode_plane(fs, p->data[3] + ps * x + y * p->linesize[3], width,\n                         height, p->linesize[3], 2);\n    } else {\n        const uint8_t *planes[3] = { p->data[0] + ps * x + y * p->linesize[0],\n                                     p->data[1] + ps * x + y * p->linesize[1],\n                                     p->data[2] + ps * x + y * p->linesize[2] };\n        encode_rgb_frame(fs, planes, width, height, p->linesize);\n    }\n    emms_c();\n    return 0;\n}', 'static void encode_slice_header(FFV1Context *f, FFV1Context *fs)\n{\n    RangeCoder *c = &fs->c;\n    uint8_t state[CONTEXT_SIZE];\n    int j;\n    memset(state, 128, sizeof(state));\n    put_symbol(c, state, (fs->slice_x + 1) * f->num_h_slices / f->width, 0);\n    put_symbol(c, state, (fs->slice_y + 1) * f->num_v_slices / f->height, 0);\n    put_symbol(c, state, (fs->slice_width + 1) * f->num_h_slices / f->width - 1,\n               0);\n    put_symbol(c, state,\n               (fs->slice_height + 1) * f->num_v_slices / f->height - 1,\n               0);\n    for (j = 0; j < f->plane_count; j++) {\n        put_symbol(c, state, f->plane[j].quant_table_index, 0);\n        av_assert0(f->plane[j].quant_table_index == f->avctx->context_model);\n    }\n    if (!f->frame->interlaced_frame)\n        put_symbol(c, state, 3, 0);\n    else\n        put_symbol(c, state, 1 + !f->frame->top_field_first, 0);\n    put_symbol(c, state, f->frame->sample_aspect_ratio.num, 0);\n    put_symbol(c, state, f->frame->sample_aspect_ratio.den, 0);\n}', 'static av_noinline void put_symbol(RangeCoder *c, uint8_t *state,\n                                   int v, int is_signed)\n{\n    put_symbol_inline(c, state, v, is_signed, NULL, NULL);\n}', 'static av_always_inline av_flatten void put_symbol_inline(RangeCoder *c,\n                                                          uint8_t *state, int v,\n                                                          int is_signed,\n                                                          uint64_t rc_stat[256][2],\n                                                          uint64_t rc_stat2[32][2])\n{\n    int i;\n#define put_rac(C, S, B)                        \\\n    do {                                        \\\n        if (rc_stat) {                          \\\n            rc_stat[*(S)][B]++;                 \\\n            rc_stat2[(S) - state][B]++;         \\\n        }                                       \\\n        put_rac(C, S, B);                       \\\n    } while (0)\n    if (v) {\n        const int a = FFABS(v);\n        const int e = av_log2(a);\n        put_rac(c, state + 0, 0);\n        if (e <= 9) {\n            for (i = 0; i < e; i++)\n                put_rac(c, state + 1 + i, 1);\n            put_rac(c, state + 1 + i, 0);\n            for (i = e - 1; i >= 0; i--)\n                put_rac(c, state + 22 + i, (a >> i) & 1);\n            if (is_signed)\n                put_rac(c, state + 11 + e, v < 0);\n        } else {\n            for (i = 0; i < e; i++)\n                put_rac(c, state + 1 + FFMIN(i, 9), 1);\n            put_rac(c, state + 1 + 9, 0);\n            for (i = e - 1; i >= 0; i--)\n                put_rac(c, state + 22 + FFMIN(i, 9), (a >> i) & 1);\n            if (is_signed)\n                put_rac(c, state + 11 + 10, v < 0);\n        }\n    } else {\n        put_rac(c, state + 0, 1);\n    }\n#undef put_rac\n}', 'static inline void put_rac(RangeCoder *c, uint8_t *const state, int bit)\n{\n    int range1 = (c->range * (*state)) >> 8;\n    assert(*state);\n    assert(range1 < c->range);\n    assert(range1 > 0);\n    if (!bit) {\n        c->range -= range1;\n        *state    = c->zero_state[*state];\n    } else {\n        c->low  += c->range - range1;\n        c->range = range1;\n        *state   = c->one_state[*state];\n    }\n    renorm_encoder(c);\n}', 'static inline void renorm_encoder(RangeCoder *c)\n{\n    while (c->range < 0x100) {\n        if (c->outstanding_byte < 0) {\n            c->outstanding_byte = c->low >> 8;\n        } else if (c->low <= 0xFF00) {\n            *c->bytestream++ = c->outstanding_byte;\n            for (; c->outstanding_count; c->outstanding_count--)\n                *c->bytestream++ = 0xFF;\n            c->outstanding_byte = c->low >> 8;\n        } else if (c->low >= 0x10000) {\n            *c->bytestream++ = c->outstanding_byte + 1;\n            for (; c->outstanding_count; c->outstanding_count--)\n                *c->bytestream++ = 0x00;\n            c->outstanding_byte = (c->low >> 8) & 0xFF;\n        } else {\n            c->outstanding_count++;\n        }\n        c->low     = (c->low & 0xFF) << 8;\n        c->range <<= 8;\n    }\n}', 'static void encode_rgb_frame(FFV1Context *s, const uint8_t *src[3],\n                             int w, int h, const int stride[3])\n{\n    int x, y, p, i;\n    const int ring_size = s->avctx->context_model ? 3 : 2;\n    int16_t *sample[MAX_PLANES][3];\n    int lbd  = s->avctx->bits_per_raw_sample <= 8;\n    int bits = s->avctx->bits_per_raw_sample > 0\n               ? s->avctx->bits_per_raw_sample\n               : 8;\n    int offset = 1 << bits;\n    s->run_index = 0;\n    memset(s->sample_buffer, 0, ring_size * MAX_PLANES *\n                                (w + 6) * sizeof(*s->sample_buffer));\n    for (y = 0; y < h; y++) {\n        for (i = 0; i < ring_size; i++)\n            for (p = 0; p < MAX_PLANES; p++)\n                sample[p][i] = s->sample_buffer + p * ring_size *\n                               (w + 6) +\n                               ((h + i - y) % ring_size) * (w + 6) + 3;\n        for (x = 0; x < w; x++) {\n            int b, g, r, av_uninit(a);\n            if (lbd) {\n                unsigned v = *((const uint32_t *)(src[0] + x * 4 + stride[0] * y));\n                b = v & 0xFF;\n                g = (v >> 8) & 0xFF;\n                r = (v >> 16) & 0xFF;\n                a = v >> 24;\n            } else {\n                b = *((const uint16_t *)(src[0] + x * 2 + stride[0] * y));\n                g = *((const uint16_t *)(src[1] + x * 2 + stride[1] * y));\n                r = *((const uint16_t *)(src[2] + x * 2 + stride[2] * y));\n            }\n            b -= g;\n            r -= g;\n            g += (b + r) >> 2;\n            b += offset;\n            r += offset;\n            sample[0][0][x] = g;\n            sample[1][0][x] = b;\n            sample[2][0][x] = r;\n            sample[3][0][x] = a;\n        }\n        for (p = 0; p < 3 + s->transparency; p++) {\n            sample[p][0][-1] = sample[p][1][0];\n            sample[p][1][w]  = sample[p][1][w - 1];\n            if (lbd)\n                encode_line(s, w, sample[p], (p + 1) / 2, 9);\n            else\n                encode_line(s, w, sample[p], (p + 1) / 2, bits + 1);\n        }\n    }\n}', 'static av_always_inline int encode_line(FFV1Context *s, int w,\n                                        int16_t *sample[3],\n                                        int plane_index, int bits)\n{\n    PlaneContext *const p = &s->plane[plane_index];\n    RangeCoder *const c   = &s->c;\n    int x;\n    int run_index = s->run_index;\n    int run_count = 0;\n    int run_mode  = 0;\n    if (s->ac) {\n        if (c->bytestream_end - c->bytestream < w * 20) {\n            av_log(s->avctx, AV_LOG_ERROR, "encoded frame too large\\n");\n            return AVERROR_INVALIDDATA;\n        }\n    } else {\n        if (s->pb.buf_end - s->pb.buf - (put_bits_count(&s->pb) >> 3) < w * 4) {\n            av_log(s->avctx, AV_LOG_ERROR, "encoded frame too large\\n");\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    for (x = 0; x < w; x++) {\n        int diff, context;\n        context = get_context(p, sample[0] + x, sample[1] + x, sample[2] + x);\n        diff    = sample[0][x] - predict(sample[0] + x, sample[1] + x);\n        if (context < 0) {\n            context = -context;\n            diff    = -diff;\n        }\n        diff = fold(diff, bits);\n        if (s->ac) {\n            if (s->flags & AV_CODEC_FLAG_PASS1) {\n                put_symbol_inline(c, p->state[context], diff, 1, s->rc_stat,\n                                  s->rc_stat2[p->quant_table_index][context]);\n            } else {\n                put_symbol_inline(c, p->state[context], diff, 1, NULL, NULL);\n            }\n        } else {\n            if (context == 0)\n                run_mode = 1;\n            if (run_mode) {\n                if (diff) {\n                    while (run_count >= 1 << ff_log2_run[run_index]) {\n                        run_count -= 1 << ff_log2_run[run_index];\n                        run_index++;\n                        put_bits(&s->pb, 1, 1);\n                    }\n                    put_bits(&s->pb, 1 + ff_log2_run[run_index], run_count);\n                    if (run_index)\n                        run_index--;\n                    run_count = 0;\n                    run_mode  = 0;\n                    if (diff > 0)\n                        diff--;\n                } else {\n                    run_count++;\n                }\n            }\n            ff_dlog(s->avctx, "count:%d index:%d, mode:%d, x:%d pos:%d\\n",\n                    run_count, run_index, run_mode, x,\n                    (int)put_bits_count(&s->pb));\n            if (run_mode == 0)\n                put_vlc_symbol(&s->pb, &p->vlc_state[context], diff, bits);\n        }\n    }\n    if (run_mode) {\n        while (run_count >= 1 << ff_log2_run[run_index]) {\n            run_count -= 1 << ff_log2_run[run_index];\n            run_index++;\n            put_bits(&s->pb, 1, 1);\n        }\n        if (run_count)\n            put_bits(&s->pb, 1, 1);\n    }\n    s->run_index = run_index;\n    return 0;\n}']