libavcodec/bink.c:227: error: Buffer Overrun L3
  Offset added: 16 Size: [0, +oo].

libavcodec/bink.c:196:1: <Length trace>
194.  * @param tree pointer for storing tree data
195.  */
196. static void read_tree(GetBitContext *gb, Tree *tree)
     ^
197. {
198.     uint8_t tmp1[16], tmp2[16], *in = tmp1, *out = tmp2;

libavcodec/bink.c:196:1: Parameter `tree->syms[*]`
194.  * @param tree pointer for storing tree data
195.  */
196. static void read_tree(GetBitContext *gb, Tree *tree)
     ^
197. {
198.     uint8_t tmp1[16], tmp2[16], *in = tmp1, *out = tmp2;

libavcodec/bink.c:227:9: Array access: Offset added: 16 Size: [0, +oo]
225.             FFSWAP(uint8_t*, in, out);
226.         }
227.         memcpy(tree->syms, in, 16);
             ^
228.     }
229. }

static void read_tree(GetBitContext *gb, Tree *tree)
{
    uint8_t tmp1[16], tmp2[16], *in = tmp1, *out = tmp2;
    int i, t, len;
    tree->vlc_num = get_bits(gb, 4);
    if (!tree->vlc_num) {
        for (i = 0; i < 16; i++)
            tree->syms[i] = i;
        return;
    }
    if (get_bits1(gb)) {
        len = get_bits(gb, 3);
        memset(tmp1, 0, sizeof(tmp1));
        for (i = 0; i <= len; i++) {
            tree->syms[i] = get_bits(gb, 4);
            tmp1[tree->syms[i]] = 1;
        }
        for (i = 0; i < 16; i++)
            if (!tmp1[i])
                tree->syms[++len] = i;
    } else {
        len = get_bits(gb, 2);
        for (i = 0; i < 16; i++)
            in[i] = i;
        for (i = 0; i <= len; i++) {
            int size = 1 << i;
            for (t = 0; t < 16; t += size << 1)
                merge(gb, out + t, in + t, size);
            FFSWAP(uint8_t*, in, out);
        }
        memcpy(tree->syms, in, 16);
    }
}
['static void read_tree(GetBitContext *gb, Tree *tree)\n{\n    uint8_t tmp1[16], tmp2[16], *in = tmp1, *out = tmp2;\n    int i, t, len;\n    tree->vlc_num = get_bits(gb, 4);\n    if (!tree->vlc_num) {\n        for (i = 0; i < 16; i++)\n            tree->syms[i] = i;\n        return;\n    }\n    if (get_bits1(gb)) {\n        len = get_bits(gb, 3);\n        memset(tmp1, 0, sizeof(tmp1));\n        for (i = 0; i <= len; i++) {\n            tree->syms[i] = get_bits(gb, 4);\n            tmp1[tree->syms[i]] = 1;\n        }\n        for (i = 0; i < 16; i++)\n            if (!tmp1[i])\n                tree->syms[++len] = i;\n    } else {\n        len = get_bits(gb, 2);\n        for (i = 0; i < 16; i++)\n            in[i] = i;\n        for (i = 0; i <= len; i++) {\n            int size = 1 << i;\n            for (t = 0; t < 16; t += size << 1)\n                merge(gb, out + t, in + t, size);\n            FFSWAP(uint8_t*, in, out);\n        }\n        memcpy(tree->syms, in, 16);\n    }\n}']