libavcodec/nellymoserenc.c:312: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 128 by call to `ff_nelly_get_sample_bits`.

libavcodec/nellymoserenc.c:265:1: Array declaration
263.  *  @param output_size     size of output buffer
264.  */
265. static void encode_block(NellyMoserEncodeContext *s, unsigned char *output, int output_size)
     ^
266. {
267.     PutBitContext pb;

libavcodec/nellymoserenc.c:312:5: Call
310.     }
311. 
312.     ff_nelly_get_sample_bits(pows, bits);
         ^
313. 
314.     for (block = 0; block < 2; block++) {

libavcodec/nellymoser.c:216:15: <Offset trace>
214. 
215.     if (bitsum > NELLY_DETAIL_BITS) {
216.         tmp = i = 0;
                   ^
217.         while (tmp < NELLY_DETAIL_BITS) {
218.             tmp += bits[i];

libavcodec/nellymoser.c:216:15: Assignment
  214. 
  215.     if (bitsum > NELLY_DETAIL_BITS) {
  216.         tmp = i = 0;
                     ^
  217.         while (tmp < NELLY_DETAIL_BITS) {
  218.             tmp += bits[i];

libavcodec/nellymoser.c:119:1: <Length trace>
117. 
118. 
119. void ff_nelly_get_sample_bits(const float *buf, int *bits)
     ^
120. {
121.     int i, j;

libavcodec/nellymoser.c:119:1: Parameter `*bits`
  117. 
  118. 
  119. void ff_nelly_get_sample_bits(const float *buf, int *bits)
       ^
  120. {
  121.     int i, j;

libavcodec/nellymoser.c:222:9: Array access: Offset: [-1, +oo] Size: 128 by call to `ff_nelly_get_sample_bits` 
  220.         }
  221. 
  222.         bits[i-1] -= tmp - NELLY_DETAIL_BITS;
               ^
  223.         for(; i < NELLY_FILL_LEN; i++)
  224.             bits[i] = 0;

void ff_nelly_get_sample_bits(const float *buf, int *bits)
{
    int i, j;
    short sbuf[128];
    int bitsum = 0, last_bitsum, small_bitsum, big_bitsum;
    short shift, shift_saved;
    int max, sum, last_off, tmp;
    int big_off, small_off;
    int off;
    max = 0;
    for (i = 0; i < NELLY_FILL_LEN; i++) {
        max = FFMAX(max, buf[i]);
    }
    shift = -16;
    shift += headroom(&max);
    sum = 0;
    for (i = 0; i < NELLY_FILL_LEN; i++) {
        sbuf[i] = signed_shift(buf[i], shift);
        sbuf[i] = (3*sbuf[i])>>2;
        sum += sbuf[i];
    }
    shift += 11;
    shift_saved = shift;
    sum -= NELLY_DETAIL_BITS << shift;
    shift += headroom(&sum);
    small_off = (NELLY_BASE_OFF * (sum>>16)) >> 15;
    shift = shift_saved - (NELLY_BASE_SHIFT+shift-31);
    small_off = signed_shift(small_off, shift);
    bitsum = sum_bits(sbuf, shift_saved, small_off);
    if (bitsum != NELLY_DETAIL_BITS) {
        off = bitsum - NELLY_DETAIL_BITS;
        for(shift=0; FFABS(off) <= 16383; shift++)
            off *= 2;
        off = (off * NELLY_BASE_OFF) >> 15;
        shift = shift_saved-(NELLY_BASE_SHIFT+shift-15);
        off = signed_shift(off, shift);
        for (j = 1; j < 20; j++) {
            last_off = small_off;
            small_off += off;
            last_bitsum = bitsum;
            bitsum = sum_bits(sbuf, shift_saved, small_off);
            if ((bitsum-NELLY_DETAIL_BITS) * (last_bitsum-NELLY_DETAIL_BITS) <= 0)
                break;
        }
        if (bitsum > NELLY_DETAIL_BITS) {
            big_off = small_off;
            small_off = last_off;
            big_bitsum=bitsum;
            small_bitsum=last_bitsum;
        } else {
            big_off = last_off;
            big_bitsum=last_bitsum;
            small_bitsum=bitsum;
        }
        while (bitsum != NELLY_DETAIL_BITS && j <= 19) {
            off = (big_off+small_off)>>1;
            bitsum = sum_bits(sbuf, shift_saved, off);
            if (bitsum > NELLY_DETAIL_BITS) {
                big_off=off;
                big_bitsum=bitsum;
            } else {
                small_off = off;
                small_bitsum=bitsum;
            }
            j++;
        }
        if (abs(big_bitsum-NELLY_DETAIL_BITS) >=
            abs(small_bitsum-NELLY_DETAIL_BITS)) {
            bitsum = small_bitsum;
        } else {
            small_off = big_off;
            bitsum = big_bitsum;
        }
    }
    for (i = 0; i < NELLY_FILL_LEN; i++) {
        tmp = sbuf[i]-small_off;
        tmp = ((tmp>>(shift_saved-1))+1)>>1;
        bits[i] = av_clip(tmp, 0, NELLY_BIT_CAP);
    }
    if (bitsum > NELLY_DETAIL_BITS) {
        tmp = i = 0;
        while (tmp < NELLY_DETAIL_BITS) {
            tmp += bits[i];
            i++;
        }
        bits[i-1] -= tmp - NELLY_DETAIL_BITS;
        for(; i < NELLY_FILL_LEN; i++)
            bits[i] = 0;
    }
}
['static void encode_block(NellyMoserEncodeContext *s, unsigned char *output, int output_size)\n{\n    PutBitContext pb;\n    int i, j, band, block, best_idx, power_idx = 0;\n    float power_val, coeff, coeff_sum;\n    float pows[NELLY_FILL_LEN];\n    int bits[NELLY_BUF_LEN], idx_table[NELLY_BANDS];\n    float cand[NELLY_BANDS];\n    apply_mdct(s);\n    init_put_bits(&pb, output, output_size * 8);\n    i = 0;\n    for (band = 0; band < NELLY_BANDS; band++) {\n        coeff_sum = 0;\n        for (j = 0; j < ff_nelly_band_sizes_table[band]; i++, j++) {\n            coeff_sum += s->mdct_out[i                ] * s->mdct_out[i                ]\n                       + s->mdct_out[i + NELLY_BUF_LEN] * s->mdct_out[i + NELLY_BUF_LEN];\n        }\n        cand[band] =\n            log(FFMAX(1.0, coeff_sum / (ff_nelly_band_sizes_table[band] << 7))) * 1024.0 / M_LN2;\n    }\n    if (s->avctx->trellis) {\n        get_exponent_dynamic(s, cand, idx_table);\n    } else {\n        get_exponent_greedy(s, cand, idx_table);\n    }\n    i = 0;\n    for (band = 0; band < NELLY_BANDS; band++) {\n        if (band) {\n            power_idx += ff_nelly_delta_table[idx_table[band]];\n            put_bits(&pb, 5, idx_table[band]);\n        } else {\n            power_idx = ff_nelly_init_table[idx_table[0]];\n            put_bits(&pb, 6, idx_table[0]);\n        }\n        power_val = pow_table[power_idx & 0x7FF] / (1 << ((power_idx >> 11) + POW_TABLE_OFFSET));\n        for (j = 0; j < ff_nelly_band_sizes_table[band]; i++, j++) {\n            s->mdct_out[i] *= power_val;\n            s->mdct_out[i + NELLY_BUF_LEN] *= power_val;\n            pows[i] = power_idx;\n        }\n    }\n    ff_nelly_get_sample_bits(pows, bits);\n    for (block = 0; block < 2; block++) {\n        for (i = 0; i < NELLY_FILL_LEN; i++) {\n            if (bits[i] > 0) {\n                const float *table = ff_nelly_dequantization_table + (1 << bits[i]) - 1;\n                coeff = s->mdct_out[block * NELLY_BUF_LEN + i];\n                best_idx =\n                    quant_lut[av_clip (\n                            coeff * quant_lut_mul[bits[i]] + quant_lut_add[bits[i]],\n                            quant_lut_offset[bits[i]],\n                            quant_lut_offset[bits[i]+1] - 1\n                            )];\n                if (fabs(coeff - table[best_idx]) > fabs(coeff - table[best_idx + 1]))\n                    best_idx++;\n                put_bits(&pb, bits[i], best_idx);\n            }\n        }\n        if (!block)\n            put_bits(&pb, NELLY_HEADER_BITS + NELLY_DETAIL_BITS - put_bits_count(&pb), 0);\n    }\n}', 'void ff_nelly_get_sample_bits(const float *buf, int *bits)\n{\n    int i, j;\n    short sbuf[128];\n    int bitsum = 0, last_bitsum, small_bitsum, big_bitsum;\n    short shift, shift_saved;\n    int max, sum, last_off, tmp;\n    int big_off, small_off;\n    int off;\n    max = 0;\n    for (i = 0; i < NELLY_FILL_LEN; i++) {\n        max = FFMAX(max, buf[i]);\n    }\n    shift = -16;\n    shift += headroom(&max);\n    sum = 0;\n    for (i = 0; i < NELLY_FILL_LEN; i++) {\n        sbuf[i] = signed_shift(buf[i], shift);\n        sbuf[i] = (3*sbuf[i])>>2;\n        sum += sbuf[i];\n    }\n    shift += 11;\n    shift_saved = shift;\n    sum -= NELLY_DETAIL_BITS << shift;\n    shift += headroom(&sum);\n    small_off = (NELLY_BASE_OFF * (sum>>16)) >> 15;\n    shift = shift_saved - (NELLY_BASE_SHIFT+shift-31);\n    small_off = signed_shift(small_off, shift);\n    bitsum = sum_bits(sbuf, shift_saved, small_off);\n    if (bitsum != NELLY_DETAIL_BITS) {\n        off = bitsum - NELLY_DETAIL_BITS;\n        for(shift=0; FFABS(off) <= 16383; shift++)\n            off *= 2;\n        off = (off * NELLY_BASE_OFF) >> 15;\n        shift = shift_saved-(NELLY_BASE_SHIFT+shift-15);\n        off = signed_shift(off, shift);\n        for (j = 1; j < 20; j++) {\n            last_off = small_off;\n            small_off += off;\n            last_bitsum = bitsum;\n            bitsum = sum_bits(sbuf, shift_saved, small_off);\n            if ((bitsum-NELLY_DETAIL_BITS) * (last_bitsum-NELLY_DETAIL_BITS) <= 0)\n                break;\n        }\n        if (bitsum > NELLY_DETAIL_BITS) {\n            big_off = small_off;\n            small_off = last_off;\n            big_bitsum=bitsum;\n            small_bitsum=last_bitsum;\n        } else {\n            big_off = last_off;\n            big_bitsum=last_bitsum;\n            small_bitsum=bitsum;\n        }\n        while (bitsum != NELLY_DETAIL_BITS && j <= 19) {\n            off = (big_off+small_off)>>1;\n            bitsum = sum_bits(sbuf, shift_saved, off);\n            if (bitsum > NELLY_DETAIL_BITS) {\n                big_off=off;\n                big_bitsum=bitsum;\n            } else {\n                small_off = off;\n                small_bitsum=bitsum;\n            }\n            j++;\n        }\n        if (abs(big_bitsum-NELLY_DETAIL_BITS) >=\n            abs(small_bitsum-NELLY_DETAIL_BITS)) {\n            bitsum = small_bitsum;\n        } else {\n            small_off = big_off;\n            bitsum = big_bitsum;\n        }\n    }\n    for (i = 0; i < NELLY_FILL_LEN; i++) {\n        tmp = sbuf[i]-small_off;\n        tmp = ((tmp>>(shift_saved-1))+1)>>1;\n        bits[i] = av_clip(tmp, 0, NELLY_BIT_CAP);\n    }\n    if (bitsum > NELLY_DETAIL_BITS) {\n        tmp = i = 0;\n        while (tmp < NELLY_DETAIL_BITS) {\n            tmp += bits[i];\n            i++;\n        }\n        bits[i-1] -= tmp - NELLY_DETAIL_BITS;\n        for(; i < NELLY_FILL_LEN; i++)\n            bits[i] = 0;\n    }\n}']