libavcodec/ps.c:297: error: Buffer Overrun L3
  Offset added: 170 Size: [0, +oo].

libavcodec/ps.c:234:1: <Length trace>
232. }
233. 
234. int ff_ps_read_data(AVCodecContext *avctx, GetBitContext *gb_host, PSContext *ps, int bits_left)
     ^
235. {
236.     int e;

libavcodec/ps.c:234:1: Parameter `ps->icc_par[*]`
232. }
233. 
234. int ff_ps_read_data(AVCodecContext *avctx, GetBitContext *gb_host, PSContext *ps, int bits_left)
     ^
235. {
236.     int e;

libavcodec/ps.c:297:9: Array access: Offset added: 170 Size: [0, +oo]
295.         }
296.     else
297.         memset(ps->icc_par, 0, sizeof(ps->icc_par));
             ^
298. 
299.     if (ps->enable_ext) {

int ff_ps_read_data(AVCodecContext *avctx, GetBitContext *gb_host, PSContext *ps, int bits_left)
{
    int e;
    int bit_count_start = get_bits_count(gb_host);
    int header;
    int bits_consumed;
    GetBitContext gbc = *gb_host, *gb = &gbc;
    header = get_bits1(gb);
    if (header) {
        ps->enable_iid = get_bits1(gb);
        if (ps->enable_iid) {
            ps->iid_mode = get_bits(gb, 3);
            if (ps->iid_mode > 5) {
                av_log(avctx, AV_LOG_ERROR, "iid_mode %d is reserved.\n",
                       ps->iid_mode);
                goto err;
            }
            ps->nr_iid_par    = nr_iidicc_par_tab[ps->iid_mode];
            ps->iid_quant     = ps->iid_mode > 2;
            ps->nr_ipdopd_par = nr_iidopd_par_tab[ps->iid_mode];
        }
        ps->enable_icc = get_bits1(gb);
        if (ps->enable_icc) {
            ps->icc_mode = get_bits(gb, 3);
            if (ps->icc_mode > 5) {
                av_log(avctx, AV_LOG_ERROR, "icc_mode %d is reserved.\n",
                       ps->icc_mode);
                goto err;
            }
            ps->nr_icc_par = nr_iidicc_par_tab[ps->icc_mode];
        }
        ps->enable_ext = get_bits1(gb);
    }
    ps->frame_class = get_bits1(gb);
    ps->num_env_old = ps->num_env;
    ps->num_env     = num_env_tab[ps->frame_class][get_bits(gb, 2)];
    ps->border_position[0] = -1;
    if (ps->frame_class) {
        for (e = 1; e <= ps->num_env; e++)
            ps->border_position[e] = get_bits(gb, 5);
    } else
        for (e = 1; e <= ps->num_env; e++)
            ps->border_position[e] = e * numQMFSlots / ps->num_env - 1;
    if (ps->enable_iid) {
        for (e = 0; e < ps->num_env; e++) {
            int dt = get_bits1(gb);
            if (iid_data(avctx, gb, ps, e, dt))
                goto err;
        }
    } else
        memset(ps->iid_par, 0, sizeof(ps->iid_par));
    if (ps->enable_icc)
        for (e = 0; e < ps->num_env; e++) {
            int dt = get_bits1(gb);
            if (icc_data(avctx, gb, ps, e, dt))
                goto err;
        }
    else
        memset(ps->icc_par, 0, sizeof(ps->icc_par));
    if (ps->enable_ext) {
        int cnt = get_bits(gb, 4);
        if (cnt == 15) {
            cnt += get_bits(gb, 8);
        }
        cnt *= 8;
        while (cnt > 7) {
            int ps_extension_id = get_bits(gb, 2);
            cnt -= 2 + ps_extension(gb, ps, ps_extension_id);
        }
        if (cnt < 0) {
            av_log(avctx, AV_LOG_ERROR, "ps extension overflow %d", cnt);
            goto err;
        }
        skip_bits(gb, cnt);
    }
    ps->enable_ipdopd &= !PS_BASELINE;
    if (!ps->num_env || ps->border_position[ps->num_env] < numQMFSlots - 1) {
        int source = ps->num_env ? ps->num_env - 1 : ps->num_env_old - 1;
        if (source >= 0 && source != ps->num_env) {
            if (ps->enable_iid && ps->num_env_old > 1) {
                memcpy(ps->iid_par+ps->num_env, ps->iid_par+source, sizeof(ps->iid_par[0]));
            }
            if (ps->enable_icc && ps->num_env_old > 1) {
                memcpy(ps->icc_par+ps->num_env, ps->icc_par+source, sizeof(ps->icc_par[0]));
            }
            if (ps->enable_ipdopd && ps->num_env_old > 1) {
                memcpy(ps->ipd_par+ps->num_env, ps->ipd_par+source, sizeof(ps->ipd_par[0]));
                memcpy(ps->opd_par+ps->num_env, ps->opd_par+source, sizeof(ps->opd_par[0]));
            }
        }
        ps->num_env++;
        ps->border_position[ps->num_env] = numQMFSlots - 1;
    }
    ps->is34bands_old = ps->is34bands;
    if (!PS_BASELINE && (ps->enable_iid || ps->enable_icc))
        ps->is34bands = (ps->enable_iid && ps->nr_iid_par == 34) ||
                        (ps->enable_icc && ps->nr_icc_par == 34);
    if (!ps->enable_ipdopd) {
        memset(ps->ipd_par, 0, sizeof(ps->ipd_par));
        memset(ps->opd_par, 0, sizeof(ps->opd_par));
    }
    if (header)
        ps->start = 1;
    bits_consumed = get_bits_count(gb) - bit_count_start;
    if (bits_consumed <= bits_left) {
        skip_bits_long(gb_host, bits_consumed);
        return bits_consumed;
    }
    av_log(avctx, AV_LOG_ERROR, "Expected to read %d PS bits actually read %d.\n", bits_left, bits_consumed);
err:
    ps->start = 0;
    skip_bits_long(gb_host, bits_left);
    return bits_left;
}
['int ff_ps_read_data(AVCodecContext *avctx, GetBitContext *gb_host, PSContext *ps, int bits_left)\n{\n    int e;\n    int bit_count_start = get_bits_count(gb_host);\n    int header;\n    int bits_consumed;\n    GetBitContext gbc = *gb_host, *gb = &gbc;\n    header = get_bits1(gb);\n    if (header) {\n        ps->enable_iid = get_bits1(gb);\n        if (ps->enable_iid) {\n            ps->iid_mode = get_bits(gb, 3);\n            if (ps->iid_mode > 5) {\n                av_log(avctx, AV_LOG_ERROR, "iid_mode %d is reserved.\\n",\n                       ps->iid_mode);\n                goto err;\n            }\n            ps->nr_iid_par    = nr_iidicc_par_tab[ps->iid_mode];\n            ps->iid_quant     = ps->iid_mode > 2;\n            ps->nr_ipdopd_par = nr_iidopd_par_tab[ps->iid_mode];\n        }\n        ps->enable_icc = get_bits1(gb);\n        if (ps->enable_icc) {\n            ps->icc_mode = get_bits(gb, 3);\n            if (ps->icc_mode > 5) {\n                av_log(avctx, AV_LOG_ERROR, "icc_mode %d is reserved.\\n",\n                       ps->icc_mode);\n                goto err;\n            }\n            ps->nr_icc_par = nr_iidicc_par_tab[ps->icc_mode];\n        }\n        ps->enable_ext = get_bits1(gb);\n    }\n    ps->frame_class = get_bits1(gb);\n    ps->num_env_old = ps->num_env;\n    ps->num_env     = num_env_tab[ps->frame_class][get_bits(gb, 2)];\n    ps->border_position[0] = -1;\n    if (ps->frame_class) {\n        for (e = 1; e <= ps->num_env; e++)\n            ps->border_position[e] = get_bits(gb, 5);\n    } else\n        for (e = 1; e <= ps->num_env; e++)\n            ps->border_position[e] = e * numQMFSlots / ps->num_env - 1;\n    if (ps->enable_iid) {\n        for (e = 0; e < ps->num_env; e++) {\n            int dt = get_bits1(gb);\n            if (iid_data(avctx, gb, ps, e, dt))\n                goto err;\n        }\n    } else\n        memset(ps->iid_par, 0, sizeof(ps->iid_par));\n    if (ps->enable_icc)\n        for (e = 0; e < ps->num_env; e++) {\n            int dt = get_bits1(gb);\n            if (icc_data(avctx, gb, ps, e, dt))\n                goto err;\n        }\n    else\n        memset(ps->icc_par, 0, sizeof(ps->icc_par));\n    if (ps->enable_ext) {\n        int cnt = get_bits(gb, 4);\n        if (cnt == 15) {\n            cnt += get_bits(gb, 8);\n        }\n        cnt *= 8;\n        while (cnt > 7) {\n            int ps_extension_id = get_bits(gb, 2);\n            cnt -= 2 + ps_extension(gb, ps, ps_extension_id);\n        }\n        if (cnt < 0) {\n            av_log(avctx, AV_LOG_ERROR, "ps extension overflow %d", cnt);\n            goto err;\n        }\n        skip_bits(gb, cnt);\n    }\n    ps->enable_ipdopd &= !PS_BASELINE;\n    if (!ps->num_env || ps->border_position[ps->num_env] < numQMFSlots - 1) {\n        int source = ps->num_env ? ps->num_env - 1 : ps->num_env_old - 1;\n        if (source >= 0 && source != ps->num_env) {\n            if (ps->enable_iid && ps->num_env_old > 1) {\n                memcpy(ps->iid_par+ps->num_env, ps->iid_par+source, sizeof(ps->iid_par[0]));\n            }\n            if (ps->enable_icc && ps->num_env_old > 1) {\n                memcpy(ps->icc_par+ps->num_env, ps->icc_par+source, sizeof(ps->icc_par[0]));\n            }\n            if (ps->enable_ipdopd && ps->num_env_old > 1) {\n                memcpy(ps->ipd_par+ps->num_env, ps->ipd_par+source, sizeof(ps->ipd_par[0]));\n                memcpy(ps->opd_par+ps->num_env, ps->opd_par+source, sizeof(ps->opd_par[0]));\n            }\n        }\n        ps->num_env++;\n        ps->border_position[ps->num_env] = numQMFSlots - 1;\n    }\n    ps->is34bands_old = ps->is34bands;\n    if (!PS_BASELINE && (ps->enable_iid || ps->enable_icc))\n        ps->is34bands = (ps->enable_iid && ps->nr_iid_par == 34) ||\n                        (ps->enable_icc && ps->nr_icc_par == 34);\n    if (!ps->enable_ipdopd) {\n        memset(ps->ipd_par, 0, sizeof(ps->ipd_par));\n        memset(ps->opd_par, 0, sizeof(ps->opd_par));\n    }\n    if (header)\n        ps->start = 1;\n    bits_consumed = get_bits_count(gb) - bit_count_start;\n    if (bits_consumed <= bits_left) {\n        skip_bits_long(gb_host, bits_consumed);\n        return bits_consumed;\n    }\n    av_log(avctx, AV_LOG_ERROR, "Expected to read %d PS bits actually read %d.\\n", bits_left, bits_consumed);\nerr:\n    ps->start = 0;\n    skip_bits_long(gb_host, bits_left);\n    return bits_left;\n}']