libavcodec/vp6.c:286: error: Buffer Overrun L2
  Offset: [0, 10] Size: 6 by call to `vp6_build_huff_tree`.

libavcodec/vp6.c:235:1: Parameter `s->modelp->coeff_ract[*][*][*]`
233. }
234. 
235. static void vp6_parse_coeff_models(VP56Context *s)
     ^
236. {
237.     VP56RangeCoder *c = &s->c;

libavcodec/vp6.c:286:21: Call
284.             for (ct=0; ct<3; ct++)
285.                 for (cg = 0; cg < 6; cg++)
286.                     vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
                         ^
287.                                         vp6_huff_coeff_map, 12,
288.                                         &s->ract_vlc[pt][ct][cg]);

libavcodec/vp6.c:215:1: <Offset trace>
213. }
214. 
215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     ^
216.                                 const uint8_t *map, unsigned size, VLC *vlc)
217. {

libavcodec/vp6.c:215:1: Parameter `size`
  213. }
  214. 
  215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
       ^
  216.                                 const uint8_t *map, unsigned size, VLC *vlc)
  217. {

libavcodec/vp6.c:215:1: <Length trace>
213. }
214. 
215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     ^
216.                                 const uint8_t *map, unsigned size, VLC *vlc)
217. {

libavcodec/vp6.c:215:1: Parameter `*coeff_model`
  213. }
  214. 
  215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
       ^
  216.                                 const uint8_t *map, unsigned size, VLC *vlc)
  217. {

libavcodec/vp6.c:224:35: Array access: Offset: [0, 10] Size: 6 by call to `vp6_build_huff_tree` 
  222.     tmp[0].count = 256;
  223.     for (i=0; i<size-1; i++) {
  224.         a = tmp[i].count *        coeff_model[i]  >> 8;
                                         ^
  225.         b = tmp[i].count * (255 - coeff_model[i]) >> 8;
  226.         nodes[map[2*i  ]].count = a + !a;

static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
                                const uint8_t *map, unsigned size, VLC *vlc)
{
    Node nodes[2*size], *tmp = &nodes[size];
    int a, b, i;
    tmp[0].count = 256;
    for (i=0; i<size-1; i++) {
        a = tmp[i].count *        coeff_model[i]  >> 8;
        b = tmp[i].count * (255 - coeff_model[i]) >> 8;
        nodes[map[2*i  ]].count = a + !a;
        nodes[map[2*i+1]].count = b + !b;
    }
    ff_huff_build_tree(s->avctx, vlc, size, nodes, vp6_huff_cmp,
                       FF_HUFFMAN_FLAG_HNODE_FIRST);
}
['static void vp6_parse_coeff_models(VP56Context *s)\n{\n    VP56RangeCoder *c = &s->c;\n    VP56Model *model = s->modelp;\n    int def_prob[11];\n    int node, cg, ctx, pos;\n    int ct;\n    int pt;\n    memset(def_prob, 0x80, sizeof(def_prob));\n    for (pt=0; pt<2; pt++)\n        for (node=0; node<11; node++)\n            if (vp56_rac_get_prob(c, vp6_dccv_pct[pt][node])) {\n                def_prob[node] = vp56_rac_gets_nn(c, 7);\n                model->coeff_dccv[pt][node] = def_prob[node];\n            } else if (s->framep[VP56_FRAME_CURRENT]->key_frame) {\n                model->coeff_dccv[pt][node] = def_prob[node];\n            }\n    if (vp56_rac_get(c)) {\n        for (pos=1; pos<64; pos++)\n            if (vp56_rac_get_prob(c, vp6_coeff_reorder_pct[pos]))\n                model->coeff_reorder[pos] = vp56_rac_gets(c, 4);\n        vp6_coeff_order_table_init(s);\n    }\n    for (cg=0; cg<2; cg++)\n        for (node=0; node<14; node++)\n            if (vp56_rac_get_prob(c, vp6_runv_pct[cg][node]))\n                model->coeff_runv[cg][node] = vp56_rac_gets_nn(c, 7);\n    for (ct=0; ct<3; ct++)\n        for (pt=0; pt<2; pt++)\n            for (cg=0; cg<6; cg++)\n                for (node=0; node<11; node++)\n                    if (vp56_rac_get_prob(c, vp6_ract_pct[ct][pt][cg][node])) {\n                        def_prob[node] = vp56_rac_gets_nn(c, 7);\n                        model->coeff_ract[pt][ct][cg][node] = def_prob[node];\n                    } else if (s->framep[VP56_FRAME_CURRENT]->key_frame) {\n                        model->coeff_ract[pt][ct][cg][node] = def_prob[node];\n                    }\n    if (s->use_huffman) {\n        for (pt=0; pt<2; pt++) {\n            vp6_build_huff_tree(s, model->coeff_dccv[pt],\n                                vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]);\n            vp6_build_huff_tree(s, model->coeff_runv[pt],\n                                vp6_huff_run_map, 9, &s->runv_vlc[pt]);\n            for (ct=0; ct<3; ct++)\n                for (cg = 0; cg < 6; cg++)\n                    vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],\n                                        vp6_huff_coeff_map, 12,\n                                        &s->ract_vlc[pt][ct][cg]);\n        }\n        memset(s->nb_null, 0, sizeof(s->nb_null));\n    } else {\n    for (pt=0; pt<2; pt++)\n        for (ctx=0; ctx<3; ctx++)\n            for (node=0; node<5; node++)\n                model->coeff_dcct[pt][ctx][node] = av_clip(((model->coeff_dccv[pt][node] * vp6_dccv_lc[ctx][node][0] + 128) >> 8) + vp6_dccv_lc[ctx][node][1], 1, 255);\n    }\n}', 'static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],\n                                const uint8_t *map, unsigned size, VLC *vlc)\n{\n    Node nodes[2*size], *tmp = &nodes[size];\n    int a, b, i;\n    tmp[0].count = 256;\n    for (i=0; i<size-1; i++) {\n        a = tmp[i].count *        coeff_model[i]  >> 8;\n        b = tmp[i].count * (255 - coeff_model[i]) >> 8;\n        nodes[map[2*i  ]].count = a + !a;\n        nodes[map[2*i+1]].count = b + !b;\n    }\n    ff_huff_build_tree(s->avctx, vlc, size, nodes, vp6_huff_cmp,\n                       FF_HUFFMAN_FLAG_HNODE_FIRST);\n}']