libavformat/oma.c:252: error: Buffer Overrun L2
  Offset: [1, 48] Size: 6.

libavformat/oma.c:249:14: <Offset trace>
247.         nprobe(s, gdata, oc->n_val) < 0) {
248.         int i;
249.         for (i = 0; i < sizeof(leaf_table); i += 2) {
                  ^
250.             uint8_t buf[16];
251.             AV_WL64(buf, leaf_table[i]);

libavformat/oma.c:249:14: Assignment
247.         nprobe(s, gdata, oc->n_val) < 0) {
248.         int i;
249.         for (i = 0; i < sizeof(leaf_table); i += 2) {
                  ^
250.             uint8_t buf[16];
251.             AV_WL64(buf, leaf_table[i]);

libavformat/oma.c:68:1: <Length trace>
66. };
67. 
68. static const uint64_t leaf_table[] = {
    ^
69.     0xd79e8283acea4620, 0x7a9762f445afd0d8,
70.     0x354d60a60b8c79f1, 0x584e1cde00b07aee,

libavformat/oma.c:68:1: Array declaration
66. };
67. 
68. static const uint64_t leaf_table[] = {
    ^
69.     0xd79e8283acea4620, 0x7a9762f445afd0d8,
70.     0x354d60a60b8c79f1, 0x584e1cde00b07aee,

libavformat/oma.c:252:13: Array access: Offset: [1, 48] Size: 6
250.             uint8_t buf[16];
251.             AV_WL64(buf, leaf_table[i]);
252.             AV_WL64(&buf[8], leaf_table[i+1]);
                 ^
253.             kset(s, buf, buf, 16);
254.             if (!rprobe(s, gdata, oc->r_val) || !nprobe(s, gdata, oc->n_val))

static int decrypt_init(AVFormatContext *s, ID3v2ExtraMeta *em, uint8_t *header)
{
    OMAContext *oc = s->priv_data;
    ID3v2ExtraMetaGEOB *geob = NULL;
    uint8_t *gdata;
    oc->encrypted = 1;
    av_log(s, AV_LOG_INFO, "File is encrypted\n");
    while (em) {
        if (!strcmp(em->tag, "GEOB") &&
            (geob = em->data) &&
            !strcmp(geob->description, "OMG_LSI") ||
            !strcmp(geob->description, "OMG_BKLSI")) {
            break;
        }
        em = em->next;
    }
    if (!em) {
        av_log(s, AV_LOG_ERROR, "No encryption header found\n");
        return -1;
    }
    if (geob->datasize < 64) {
        av_log(s, AV_LOG_ERROR, "Invalid GEOB data size: %u\n", geob->datasize);
        return -1;
    }
    gdata = geob->data;
    if (AV_RB16(gdata) != 1)
        av_log(s, AV_LOG_WARNING, "Unknown version in encryption header\n");
    oc->k_size = AV_RB16(&gdata[2]);
    oc->e_size = AV_RB16(&gdata[4]);
    oc->i_size = AV_RB16(&gdata[6]);
    oc->s_size = AV_RB16(&gdata[8]);
    if (memcmp(&gdata[OMA_ENC_HEADER_SIZE], "KEYRING     ", 12)) {
        av_log(s, AV_LOG_ERROR, "Invalid encryption header\n");
        return -1;
    }
    oc->rid = AV_RB32(&gdata[OMA_ENC_HEADER_SIZE + 28]);
    av_log(s, AV_LOG_DEBUG, "RID: %.8x\n", oc->rid);
    memcpy(oc->iv, &header[0x58], 8);
    hex_log(s, AV_LOG_DEBUG, "IV", oc->iv, 8);
    hex_log(s, AV_LOG_DEBUG, "CBC-MAC", &gdata[OMA_ENC_HEADER_SIZE+oc->k_size+oc->e_size+oc->i_size], 8);
    if (s->keylen > 0) {
        kset(s, s->key, s->key, s->keylen);
    }
    if (!memcmp(oc->r_val, (const uint8_t[8]){0}, 8) ||
        rprobe(s, gdata, oc->r_val) < 0 &&
        nprobe(s, gdata, oc->n_val) < 0) {
        int i;
        for (i = 0; i < sizeof(leaf_table); i += 2) {
            uint8_t buf[16];
            AV_WL64(buf, leaf_table[i]);
            AV_WL64(&buf[8], leaf_table[i+1]);
            kset(s, buf, buf, 16);
            if (!rprobe(s, gdata, oc->r_val) || !nprobe(s, gdata, oc->n_val))
                break;
        }
        if (i >= sizeof(leaf_table)) {
            av_log(s, AV_LOG_ERROR, "Invalid key\n");
            return -1;
        }
    }
    av_des_init(&oc->av_des, oc->m_val, 64, 0);
    av_des_crypt(&oc->av_des, oc->e_val, &gdata[OMA_ENC_HEADER_SIZE + 40], 1, NULL, 0);
    hex_log(s, AV_LOG_DEBUG, "EK", oc->e_val, 8);
    av_des_init(&oc->av_des, oc->e_val, 64, 1);
    return 0;
}
['static int decrypt_init(AVFormatContext *s, ID3v2ExtraMeta *em, uint8_t *header)\n{\n    OMAContext *oc = s->priv_data;\n    ID3v2ExtraMetaGEOB *geob = NULL;\n    uint8_t *gdata;\n    oc->encrypted = 1;\n    av_log(s, AV_LOG_INFO, "File is encrypted\\n");\n    while (em) {\n        if (!strcmp(em->tag, "GEOB") &&\n            (geob = em->data) &&\n            !strcmp(geob->description, "OMG_LSI") ||\n            !strcmp(geob->description, "OMG_BKLSI")) {\n            break;\n        }\n        em = em->next;\n    }\n    if (!em) {\n        av_log(s, AV_LOG_ERROR, "No encryption header found\\n");\n        return -1;\n    }\n    if (geob->datasize < 64) {\n        av_log(s, AV_LOG_ERROR, "Invalid GEOB data size: %u\\n", geob->datasize);\n        return -1;\n    }\n    gdata = geob->data;\n    if (AV_RB16(gdata) != 1)\n        av_log(s, AV_LOG_WARNING, "Unknown version in encryption header\\n");\n    oc->k_size = AV_RB16(&gdata[2]);\n    oc->e_size = AV_RB16(&gdata[4]);\n    oc->i_size = AV_RB16(&gdata[6]);\n    oc->s_size = AV_RB16(&gdata[8]);\n    if (memcmp(&gdata[OMA_ENC_HEADER_SIZE], "KEYRING     ", 12)) {\n        av_log(s, AV_LOG_ERROR, "Invalid encryption header\\n");\n        return -1;\n    }\n    oc->rid = AV_RB32(&gdata[OMA_ENC_HEADER_SIZE + 28]);\n    av_log(s, AV_LOG_DEBUG, "RID: %.8x\\n", oc->rid);\n    memcpy(oc->iv, &header[0x58], 8);\n    hex_log(s, AV_LOG_DEBUG, "IV", oc->iv, 8);\n    hex_log(s, AV_LOG_DEBUG, "CBC-MAC", &gdata[OMA_ENC_HEADER_SIZE+oc->k_size+oc->e_size+oc->i_size], 8);\n    if (s->keylen > 0) {\n        kset(s, s->key, s->key, s->keylen);\n    }\n    if (!memcmp(oc->r_val, (const uint8_t[8]){0}, 8) ||\n        rprobe(s, gdata, oc->r_val) < 0 &&\n        nprobe(s, gdata, oc->n_val) < 0) {\n        int i;\n        for (i = 0; i < sizeof(leaf_table); i += 2) {\n            uint8_t buf[16];\n            AV_WL64(buf, leaf_table[i]);\n            AV_WL64(&buf[8], leaf_table[i+1]);\n            kset(s, buf, buf, 16);\n            if (!rprobe(s, gdata, oc->r_val) || !nprobe(s, gdata, oc->n_val))\n                break;\n        }\n        if (i >= sizeof(leaf_table)) {\n            av_log(s, AV_LOG_ERROR, "Invalid key\\n");\n            return -1;\n        }\n    }\n    av_des_init(&oc->av_des, oc->m_val, 64, 0);\n    av_des_crypt(&oc->av_des, oc->e_val, &gdata[OMA_ENC_HEADER_SIZE + 40], 1, NULL, 0);\n    hex_log(s, AV_LOG_DEBUG, "EK", oc->e_val, 8);\n    av_des_init(&oc->av_des, oc->e_val, 64, 1);\n    return 0;\n}']