libavcodec/snow.c:3608: error: Buffer Overrun L2
  Offset: [-oo, 4] Size: 4.

libavcodec/snow.c:3603:24: <Offset trace>
3601.                 Plane *p= &s->plane[plane_index];
3602.                 p->diag_mc= get_rac(&s->c, s->header_state);
3603.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                             ^
3604.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3605.                     return -1;

libavcodec/snow.c:3603:24: Call
3601.                 Plane *p= &s->plane[plane_index];
3602.                 p->diag_mc= get_rac(&s->c, s->header_state);
3603.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                             ^
3604.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3605.                     return -1;

libavcodec/snow.c:659:9: Assignment
  657. static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){
  658.     if(get_rac(c, state+0))
  659.         return 0;
               ^
  660.     else{
  661.         int i, e, a;

libavcodec/snow.c:3603:17: Assignment
3601.                 Plane *p= &s->plane[plane_index];
3602.                 p->diag_mc= get_rac(&s->c, s->header_state);
3603.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                      ^
3604.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3605.                     return -1;

libavcodec/snow.c:3607:21: Assignment
3605.                     return -1;
3606.                 p->htaps= htaps;
3607.                 for(i= htaps/2; i; i--){
                          ^
3608.                     p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
3609.                     sum += p->hcoeff[i];

libavcodec/snow.c:3565:1: <Length trace>
3563.     dst= tmp;
3564. 
3565. static int decode_header(SnowContext *s){
      ^
3566.     int plane_index, tmp;
3567.     uint8_t kstate[32];

libavcodec/snow.c:3565:1: Parameter `s->plane[*].hcoeff[*]`
3563.     dst= tmp;
3564. 
3565. static int decode_header(SnowContext *s){
      ^
3566.     int plane_index, tmp;
3567.     uint8_t kstate[32];

libavcodec/snow.c:3608:21: Array access: Offset: [-oo, 4] Size: 4
3606.                 p->htaps= htaps;
3607.                 for(i= htaps/2; i; i--){
3608.                     p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
                          ^
3609.                     sum += p->hcoeff[i];
3610.                 }

static int decode_header(SnowContext *s){
    int plane_index, tmp;
    uint8_t kstate[32];
    memset(kstate, MID_STATE, sizeof(kstate));
    s->keyframe= get_rac(&s->c, kstate);
    if(s->keyframe || s->always_reset){
        reset_contexts(s);
        s->spatial_decomposition_type=
        s->qlog=
        s->qbias=
        s->mv_scale=
        s->block_max_depth= 0;
    }
    if(s->keyframe){
        GET_S(s->version, tmp <= 0U)
        s->always_reset= get_rac(&s->c, s->header_state);
        s->temporal_decomposition_type= get_symbol(&s->c, s->header_state, 0);
        s->temporal_decomposition_count= get_symbol(&s->c, s->header_state, 0);
        GET_S(s->spatial_decomposition_count, 0 < tmp && tmp <= MAX_DECOMPOSITIONS)
        s->colorspace_type= get_symbol(&s->c, s->header_state, 0);
        s->chroma_h_shift= get_symbol(&s->c, s->header_state, 0);
        s->chroma_v_shift= get_symbol(&s->c, s->header_state, 0);
        s->spatial_scalability= get_rac(&s->c, s->header_state);
        GET_S(s->max_ref_frames, tmp < (unsigned)MAX_REF_FRAMES)
        s->max_ref_frames++;
        decode_qlogs(s);
    }
    if(!s->keyframe){
        if(get_rac(&s->c, s->header_state)){
            for(plane_index=0; plane_index<2; plane_index++){
                int htaps, i, sum=0;
                Plane *p= &s->plane[plane_index];
                p->diag_mc= get_rac(&s->c, s->header_state);
                htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                if((unsigned)htaps > HTAPS_MAX || htaps==0)
                    return -1;
                p->htaps= htaps;
                for(i= htaps/2; i; i--){
                    p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
                    sum += p->hcoeff[i];
                }
                p->hcoeff[0]= 32-sum;
            }
            s->plane[2].diag_mc= s->plane[1].diag_mc;
            s->plane[2].htaps  = s->plane[1].htaps;
            memcpy(s->plane[2].hcoeff, s->plane[1].hcoeff, sizeof(s->plane[1].hcoeff));
        }
        if(get_rac(&s->c, s->header_state)){
            GET_S(s->spatial_decomposition_count, 0 < tmp && tmp <= MAX_DECOMPOSITIONS)
            decode_qlogs(s);
        }
    }
    s->spatial_decomposition_type+= get_symbol(&s->c, s->header_state, 1);
    if(s->spatial_decomposition_type > 1U){
        av_log(s->avctx, AV_LOG_ERROR, "spatial_decomposition_type %d not supported", s->spatial_decomposition_type);
        return -1;
    }
    if(FFMIN(s->avctx-> width>>s->chroma_h_shift,
             s->avctx->height>>s->chroma_v_shift) >> (s->spatial_decomposition_count-1) <= 0){
        av_log(s->avctx, AV_LOG_ERROR, "spatial_decomposition_count %d too large for size", s->spatial_decomposition_count);
        return -1;
    }
    s->qlog           += get_symbol(&s->c, s->header_state, 1);
    s->mv_scale       += get_symbol(&s->c, s->header_state, 1);
    s->qbias          += get_symbol(&s->c, s->header_state, 1);
    s->block_max_depth+= get_symbol(&s->c, s->header_state, 1);
    if(s->block_max_depth > 1 || s->block_max_depth < 0){
        av_log(s->avctx, AV_LOG_ERROR, "block_max_depth= %d is too large", s->block_max_depth);
        s->block_max_depth= 0;
        return -1;
    }
    return 0;
}
['static int decode_header(SnowContext *s){\n    int plane_index, tmp;\n    uint8_t kstate[32];\n    memset(kstate, MID_STATE, sizeof(kstate));\n    s->keyframe= get_rac(&s->c, kstate);\n    if(s->keyframe || s->always_reset){\n        reset_contexts(s);\n        s->spatial_decomposition_type=\n        s->qlog=\n        s->qbias=\n        s->mv_scale=\n        s->block_max_depth= 0;\n    }\n    if(s->keyframe){\n        GET_S(s->version, tmp <= 0U)\n        s->always_reset= get_rac(&s->c, s->header_state);\n        s->temporal_decomposition_type= get_symbol(&s->c, s->header_state, 0);\n        s->temporal_decomposition_count= get_symbol(&s->c, s->header_state, 0);\n        GET_S(s->spatial_decomposition_count, 0 < tmp && tmp <= MAX_DECOMPOSITIONS)\n        s->colorspace_type= get_symbol(&s->c, s->header_state, 0);\n        s->chroma_h_shift= get_symbol(&s->c, s->header_state, 0);\n        s->chroma_v_shift= get_symbol(&s->c, s->header_state, 0);\n        s->spatial_scalability= get_rac(&s->c, s->header_state);\n        GET_S(s->max_ref_frames, tmp < (unsigned)MAX_REF_FRAMES)\n        s->max_ref_frames++;\n        decode_qlogs(s);\n    }\n    if(!s->keyframe){\n        if(get_rac(&s->c, s->header_state)){\n            for(plane_index=0; plane_index<2; plane_index++){\n                int htaps, i, sum=0;\n                Plane *p= &s->plane[plane_index];\n                p->diag_mc= get_rac(&s->c, s->header_state);\n                htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;\n                if((unsigned)htaps > HTAPS_MAX || htaps==0)\n                    return -1;\n                p->htaps= htaps;\n                for(i= htaps/2; i; i--){\n                    p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));\n                    sum += p->hcoeff[i];\n                }\n                p->hcoeff[0]= 32-sum;\n            }\n            s->plane[2].diag_mc= s->plane[1].diag_mc;\n            s->plane[2].htaps  = s->plane[1].htaps;\n            memcpy(s->plane[2].hcoeff, s->plane[1].hcoeff, sizeof(s->plane[1].hcoeff));\n        }\n        if(get_rac(&s->c, s->header_state)){\n            GET_S(s->spatial_decomposition_count, 0 < tmp && tmp <= MAX_DECOMPOSITIONS)\n            decode_qlogs(s);\n        }\n    }\n    s->spatial_decomposition_type+= get_symbol(&s->c, s->header_state, 1);\n    if(s->spatial_decomposition_type > 1U){\n        av_log(s->avctx, AV_LOG_ERROR, "spatial_decomposition_type %d not supported", s->spatial_decomposition_type);\n        return -1;\n    }\n    if(FFMIN(s->avctx-> width>>s->chroma_h_shift,\n             s->avctx->height>>s->chroma_v_shift) >> (s->spatial_decomposition_count-1) <= 0){\n        av_log(s->avctx, AV_LOG_ERROR, "spatial_decomposition_count %d too large for size", s->spatial_decomposition_count);\n        return -1;\n    }\n    s->qlog           += get_symbol(&s->c, s->header_state, 1);\n    s->mv_scale       += get_symbol(&s->c, s->header_state, 1);\n    s->qbias          += get_symbol(&s->c, s->header_state, 1);\n    s->block_max_depth+= get_symbol(&s->c, s->header_state, 1);\n    if(s->block_max_depth > 1 || s->block_max_depth < 0){\n        av_log(s->avctx, AV_LOG_ERROR, "block_max_depth= %d is too large", s->block_max_depth);\n        s->block_max_depth= 0;\n        return -1;\n    }\n    return 0;\n}', 'static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){\n    if(get_rac(c, state+0))\n        return 0;\n    else{\n        int i, e, a;\n        e= 0;\n        while(get_rac(c, state+1 + FFMIN(e,9))){\n            e++;\n        }\n        a= 1;\n        for(i=e-1; i>=0; i--){\n            a += a + get_rac(c, state+22 + FFMIN(i,9));\n        }\n        if(is_signed && get_rac(c, state+11 + FFMIN(e,10)))\n            return -a;\n        else\n            return a;\n    }\n}']