libavcodec/cook.c:1025: error: Buffer Overrun L1
  Offset: [-oo, -1] Size: 256 by call to `decode_subpacket`.

libavcodec/cook.c:1002:5: Assignment
1000.     int i;
1001.     int offset = 0;
1002.     int chidx = 0;
          ^
1003. 
1004.     if (buf_size < avctx->block_align)

libavcodec/cook.c:1023:9: Assignment
1021.     for(i=0;i<q->num_subpackets;i++){
1022.         q->subpacket[i].bits_per_subpacket = (q->subpacket[i].size*8)>>q->subpacket[i].bits_per_subpdiv;
1023.         q->subpacket[i].ch_idx = chidx;
              ^
1024.         av_log(avctx,AV_LOG_DEBUG,"subpacket[%i] size %i js %i %i block_align %i\n",i,q->subpacket[i].size,q->subpacket[i].joint_stereo,offset,avctx->block_align);
1025.         decode_subpacket(q, &q->subpacket[i], buf + offset, (int16_t*)data);

libavcodec/cook.c:1025:9: Call
1023.         q->subpacket[i].ch_idx = chidx;
1024.         av_log(avctx,AV_LOG_DEBUG,"subpacket[%i] size %i js %i %i block_align %i\n",i,q->subpacket[i].size,q->subpacket[i].joint_stereo,offset,avctx->block_align);
1025.         decode_subpacket(q, &q->subpacket[i], buf + offset, (int16_t*)data);
              ^
1026.         offset += q->subpacket[i].size;
1027.         chidx += q->subpacket[i].num_channels;

libavcodec/cook.c:951:1: Parameter `p->numvector_size`
  949.  * @param outbuffer         pointer to the outbuffer
  950.  */
  951. static void decode_subpacket(COOKContext *q, COOKSubpacket* p, const uint8_t *inbuffer, int16_t *outbuffer) {
       ^
  952.     int sub_packet_size = p->size;
  953.     /* packet dump */

libavcodec/cook.c:964:9: Call
  962.         joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2);
  963.     } else {
  964.         mono_decode(q, p, q->decode_buffer_1);
               ^
  965. 
  966.         if (p->num_channels == 2) {

libavcodec/cook.c:661:1: Parameter `p->numvector_size`
    659.  */
    660. 
    661. static void mono_decode(COOKContext *q, COOKSubpacket *p, float* mlt_buffer) {
         ^
    662. 
    663.     int category_index[128];

libavcodec/cook.c:672:5: Call
    670.     decode_envelope(q, p, quant_index_table);
    671.     q->num_vectors = get_bits(&q->gb,p->log2_numvector_size);
    672.     categorize(q, p, quant_index_table, category, category_index);
             ^
    673.     expand_category(q, category, category_index);
    674.     decode_vectors(q, p, category, quant_index_table, mlt_buffer);

libavcodec/cook.c:426:1: <Offset trace>
424.  */
425. 
426. static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
     ^
427.                        int* category, int* category_index){
428.     int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;

libavcodec/cook.c:426:1: Parameter `p->numvector_size`
      424.  */
      425. 
      426. static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
           ^
      427.                        int* category, int* category_index){
      428.     int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;

libavcodec/cook.c:434:5: Assignment
      432.     int tmp_categorize_array[128*2];
      433.     int tmp_categorize_array1_idx=p->numvector_size;
      434.     int tmp_categorize_array2_idx=p->numvector_size;
               ^
      435. 
      436.     bits_left =  p->bits_per_subpacket - get_bits_count(&q->gb);

libavcodec/cook.c:426:1: <Length trace>
424.  */
425. 
426. static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
     ^
427.                        int* category, int* category_index){
428.     int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;

libavcodec/cook.c:426:1: Array declaration
      424.  */
      425. 
      426. static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
           ^
      427.                        int* category, int* category_index){
      428.     int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;

libavcodec/cook.c:505:13: Array access: Offset: [-oo, -1] Size: 256 by call to `decode_subpacket` 
      503.             }
      504.             if(index == -1)break;
      505.             tmp_categorize_array[--tmp_categorize_array2_idx] = index;
                       ^
      506.             tmpbias2 -= expbits_tab[exp_index2[index]] -
      507.                         expbits_tab[exp_index2[index]-1];

static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,
                       int* category, int* category_index){
    int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;
    int exp_index2[102];
    int exp_index1[102];
    int tmp_categorize_array[128*2];
    int tmp_categorize_array1_idx=p->numvector_size;
    int tmp_categorize_array2_idx=p->numvector_size;
    bits_left =  p->bits_per_subpacket - get_bits_count(&q->gb);
    if(bits_left > q->samples_per_channel) {
        bits_left = q->samples_per_channel +
                    ((bits_left - q->samples_per_channel)*5)/8;
    }
    memset(&exp_index1,0,102*sizeof(int));
    memset(&exp_index2,0,102*sizeof(int));
    memset(&tmp_categorize_array,0,128*2*sizeof(int));
    bias=-32;
    for (i=32 ; i>0 ; i=i/2){
        num_bits = 0;
        index = 0;
        for (j=p->total_subbands ; j>0 ; j--){
            exp_idx = av_clip((i - quant_index_table[index] + bias) / 2, 0, 7);
            index++;
            num_bits+=expbits_tab[exp_idx];
        }
        if(num_bits >= bits_left - 32){
            bias+=i;
        }
    }
    num_bits=0;
    for (i=0 ; i<p->total_subbands ; i++) {
        exp_idx = av_clip((bias - quant_index_table[i]) / 2, 0, 7);
        num_bits += expbits_tab[exp_idx];
        exp_index1[i] = exp_idx;
        exp_index2[i] = exp_idx;
    }
    tmpbias1 = tmpbias2 = num_bits;
    for (j = 1 ; j < p->numvector_size ; j++) {
        if (tmpbias1 + tmpbias2 > 2*bits_left) {
            int max = -999999;
            index=-1;
            for (i=0 ; i<p->total_subbands ; i++){
                if (exp_index1[i] < 7) {
                    v = (-2*exp_index1[i]) - quant_index_table[i] + bias;
                    if ( v >= max) {
                        max = v;
                        index = i;
                    }
                }
            }
            if(index==-1)break;
            tmp_categorize_array[tmp_categorize_array1_idx++] = index;
            tmpbias1 -= expbits_tab[exp_index1[index]] -
                        expbits_tab[exp_index1[index]+1];
            ++exp_index1[index];
        } else {
            int min = 999999;
            index=-1;
            for (i=0 ; i<p->total_subbands ; i++){
                if(exp_index2[i] > 0){
                    v = (-2*exp_index2[i])-quant_index_table[i]+bias;
                    if ( v < min) {
                        min = v;
                        index = i;
                    }
                }
            }
            if(index == -1)break;
            tmp_categorize_array[--tmp_categorize_array2_idx] = index;
            tmpbias2 -= expbits_tab[exp_index2[index]] -
                        expbits_tab[exp_index2[index]-1];
            --exp_index2[index];
        }
    }
    for(i=0 ; i<p->total_subbands ; i++)
        category[i] = exp_index2[i];
    for(i=0 ; i<p->numvector_size-1 ; i++)
        category_index[i] = tmp_categorize_array[tmp_categorize_array2_idx++];
}
['static int cook_decode_frame(AVCodecContext *avctx,\n            void *data, int *data_size,\n            AVPacket *avpkt) {\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    COOKContext *q = avctx->priv_data;\n    int i;\n    int offset = 0;\n    int chidx = 0;\n    if (buf_size < avctx->block_align)\n        return buf_size;\n    q->subpacket[0].size = avctx->block_align;\n    for(i=1;i<q->num_subpackets;i++){\n        q->subpacket[i].size = 2 * buf[avctx->block_align - q->num_subpackets + i];\n        q->subpacket[0].size -= q->subpacket[i].size + 1;\n        if (q->subpacket[0].size < 0) {\n            av_log(avctx,AV_LOG_DEBUG,"frame subpacket size total > avctx->block_align!\\n");\n            return -1;\n        }\n    }\n    *data_size = 0;\n    for(i=0;i<q->num_subpackets;i++){\n        q->subpacket[i].bits_per_subpacket = (q->subpacket[i].size*8)>>q->subpacket[i].bits_per_subpdiv;\n        q->subpacket[i].ch_idx = chidx;\n        av_log(avctx,AV_LOG_DEBUG,"subpacket[%i] size %i js %i %i block_align %i\\n",i,q->subpacket[i].size,q->subpacket[i].joint_stereo,offset,avctx->block_align);\n        decode_subpacket(q, &q->subpacket[i], buf + offset, (int16_t*)data);\n        offset += q->subpacket[i].size;\n        chidx += q->subpacket[i].num_channels;\n        av_log(avctx,AV_LOG_DEBUG,"subpacket[%i] %i %i\\n",i,q->subpacket[i].size * 8,get_bits_count(&q->gb));\n    }\n    *data_size = sizeof(int16_t) * q->nb_channels * q->samples_per_channel;\n    if (avctx->frame_number < 2) *data_size = 0;\n    return avctx->block_align;\n}', 'static void decode_subpacket(COOKContext *q, COOKSubpacket* p, const uint8_t *inbuffer, int16_t *outbuffer) {\n    int sub_packet_size = p->size;\n    memset(q->decode_buffer_1,0,sizeof(q->decode_buffer_1));\n    decode_bytes_and_gain(q, p, inbuffer, &p->gains1);\n    if (p->joint_stereo) {\n        joint_decode(q, p, q->decode_buffer_1, q->decode_buffer_2);\n    } else {\n        mono_decode(q, p, q->decode_buffer_1);\n        if (p->num_channels == 2) {\n            decode_bytes_and_gain(q, p, inbuffer + sub_packet_size/2, &p->gains2);\n            mono_decode(q, p, q->decode_buffer_2);\n        }\n    }\n    mlt_compensate_output(q, q->decode_buffer_1, &p->gains1,\n                          p->mono_previous_buffer1, outbuffer, p->ch_idx);\n    if (p->num_channels == 2) {\n        if (p->joint_stereo) {\n            mlt_compensate_output(q, q->decode_buffer_2, &p->gains1,\n                                  p->mono_previous_buffer2, outbuffer, p->ch_idx + 1);\n         } else {\n            mlt_compensate_output(q, q->decode_buffer_2, &p->gains2,\n                                  p->mono_previous_buffer2, outbuffer, p->ch_idx + 1);\n         }\n     }\n}', 'static void mono_decode(COOKContext *q, COOKSubpacket *p, float* mlt_buffer) {\n    int category_index[128];\n    int quant_index_table[102];\n    int category[128];\n    memset(&category, 0, 128*sizeof(int));\n    memset(&category_index, 0, 128*sizeof(int));\n    decode_envelope(q, p, quant_index_table);\n    q->num_vectors = get_bits(&q->gb,p->log2_numvector_size);\n    categorize(q, p, quant_index_table, category, category_index);\n    expand_category(q, category, category_index);\n    decode_vectors(q, p, category, quant_index_table, mlt_buffer);\n}', 'static void categorize(COOKContext *q, COOKSubpacket *p, int* quant_index_table,\n                       int* category, int* category_index){\n    int exp_idx, bias, tmpbias1, tmpbias2, bits_left, num_bits, index, v, i, j;\n    int exp_index2[102];\n    int exp_index1[102];\n    int tmp_categorize_array[128*2];\n    int tmp_categorize_array1_idx=p->numvector_size;\n    int tmp_categorize_array2_idx=p->numvector_size;\n    bits_left =  p->bits_per_subpacket - get_bits_count(&q->gb);\n    if(bits_left > q->samples_per_channel) {\n        bits_left = q->samples_per_channel +\n                    ((bits_left - q->samples_per_channel)*5)/8;\n    }\n    memset(&exp_index1,0,102*sizeof(int));\n    memset(&exp_index2,0,102*sizeof(int));\n    memset(&tmp_categorize_array,0,128*2*sizeof(int));\n    bias=-32;\n    for (i=32 ; i>0 ; i=i/2){\n        num_bits = 0;\n        index = 0;\n        for (j=p->total_subbands ; j>0 ; j--){\n            exp_idx = av_clip((i - quant_index_table[index] + bias) / 2, 0, 7);\n            index++;\n            num_bits+=expbits_tab[exp_idx];\n        }\n        if(num_bits >= bits_left - 32){\n            bias+=i;\n        }\n    }\n    num_bits=0;\n    for (i=0 ; i<p->total_subbands ; i++) {\n        exp_idx = av_clip((bias - quant_index_table[i]) / 2, 0, 7);\n        num_bits += expbits_tab[exp_idx];\n        exp_index1[i] = exp_idx;\n        exp_index2[i] = exp_idx;\n    }\n    tmpbias1 = tmpbias2 = num_bits;\n    for (j = 1 ; j < p->numvector_size ; j++) {\n        if (tmpbias1 + tmpbias2 > 2*bits_left) {\n            int max = -999999;\n            index=-1;\n            for (i=0 ; i<p->total_subbands ; i++){\n                if (exp_index1[i] < 7) {\n                    v = (-2*exp_index1[i]) - quant_index_table[i] + bias;\n                    if ( v >= max) {\n                        max = v;\n                        index = i;\n                    }\n                }\n            }\n            if(index==-1)break;\n            tmp_categorize_array[tmp_categorize_array1_idx++] = index;\n            tmpbias1 -= expbits_tab[exp_index1[index]] -\n                        expbits_tab[exp_index1[index]+1];\n            ++exp_index1[index];\n        } else {\n            int min = 999999;\n            index=-1;\n            for (i=0 ; i<p->total_subbands ; i++){\n                if(exp_index2[i] > 0){\n                    v = (-2*exp_index2[i])-quant_index_table[i]+bias;\n                    if ( v < min) {\n                        min = v;\n                        index = i;\n                    }\n                }\n            }\n            if(index == -1)break;\n            tmp_categorize_array[--tmp_categorize_array2_idx] = index;\n            tmpbias2 -= expbits_tab[exp_index2[index]] -\n                        expbits_tab[exp_index2[index]-1];\n            --exp_index2[index];\n        }\n    }\n    for(i=0 ; i<p->total_subbands ; i++)\n        category[i] = exp_index2[i];\n    for(i=0 ; i<p->numvector_size-1 ; i++)\n        category_index[i] = tmp_categorize_array[tmp_categorize_array2_idx++];\n}']