libavcodec/snow.c:1093: error: Buffer Overrun L2
  Offset: [0, 15] Size: 11.

libavcodec/snow.c:935:37: <Offset trace>
933.     };
934. 
935.     static const uint8_t brane[256]={
                                         ^
936.     0x00,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x11,0x12,0x12,0x12,0x12,0x12,0x12,0x12,
937.     0x04,0x05,0xcc,0xcc,0xcc,0xcc,0xcc,0x41,0x15,0x16,0xcc,0xcc,0xcc,0xcc,0xcc,0x52,

libavcodec/snow.c:935:37: Assignment
933.     };
934. 
935.     static const uint8_t brane[256]={
                                         ^
936.     0x00,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x11,0x12,0x12,0x12,0x12,0x12,0x12,0x12,
937.     0x04,0x05,0xcc,0xcc,0xcc,0xcc,0xcc,0x41,0x15,0x16,0xcc,0xcc,0xcc,0xcc,0xcc,0x52,

libavcodec/snow.c:968:5: Assignment
966.     const uint8_t *hpel[11];
967.     assert(dx<16 && dy<16);
968.     r= brane[dx + 16*dy]&15;
         ^
969.     l= brane[dx + 16*dy]>>4;
970. 

libavcodec/snow.c:923:1: <Length trace>
921. }
922. 
923. static void mc_block(Plane *p, uint8_t *dst, const uint8_t *src, int stride, int b_w, int b_h, int dx, int dy){
     ^
924.     static const uint8_t weight[64]={
925.     8,7,6,5,4,3,2,1,

libavcodec/snow.c:923:1: Array declaration
921. }
922. 
923. static void mc_block(Plane *p, uint8_t *dst, const uint8_t *src, int stride, int b_w, int b_h, int dx, int dy){
     ^
924.     static const uint8_t weight[64]={
925.     8,7,6,5,4,3,2,1,

libavcodec/snow.c:1093:30: Array access: Offset: [0, 15] Size: 11
1091.     }else{
1092.         const uint8_t *src1= hpel[l];
1093.         const uint8_t *src2= hpel[r];
                                   ^
1094.         int a= weight[((dx&7) + (8*(dy&7)))];
1095.         int b= 8-a;

static void mc_block(Plane *p, uint8_t *dst, const uint8_t *src, int stride, int b_w, int b_h, int dx, int dy){
    static const uint8_t weight[64]={
    8,7,6,5,4,3,2,1,
    7,7,0,0,0,0,0,1,
    6,0,6,0,0,0,2,0,
    5,0,0,5,0,3,0,0,
    4,0,0,0,4,0,0,0,
    3,0,0,5,0,3,0,0,
    2,0,6,0,0,0,2,0,
    1,7,0,0,0,0,0,1,
    };
    static const uint8_t brane[256]={
    0x00,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x11,0x12,0x12,0x12,0x12,0x12,0x12,0x12,
    0x04,0x05,0xcc,0xcc,0xcc,0xcc,0xcc,0x41,0x15,0x16,0xcc,0xcc,0xcc,0xcc,0xcc,0x52,
    0x04,0xcc,0x05,0xcc,0xcc,0xcc,0x41,0xcc,0x15,0xcc,0x16,0xcc,0xcc,0xcc,0x52,0xcc,
    0x04,0xcc,0xcc,0x05,0xcc,0x41,0xcc,0xcc,0x15,0xcc,0xcc,0x16,0xcc,0x52,0xcc,0xcc,
    0x04,0xcc,0xcc,0xcc,0x41,0xcc,0xcc,0xcc,0x15,0xcc,0xcc,0xcc,0x16,0xcc,0xcc,0xcc,
    0x04,0xcc,0xcc,0x41,0xcc,0x05,0xcc,0xcc,0x15,0xcc,0xcc,0x52,0xcc,0x16,0xcc,0xcc,
    0x04,0xcc,0x41,0xcc,0xcc,0xcc,0x05,0xcc,0x15,0xcc,0x52,0xcc,0xcc,0xcc,0x16,0xcc,
    0x04,0x41,0xcc,0xcc,0xcc,0xcc,0xcc,0x05,0x15,0x52,0xcc,0xcc,0xcc,0xcc,0xcc,0x16,
    0x44,0x45,0x45,0x45,0x45,0x45,0x45,0x45,0x55,0x56,0x56,0x56,0x56,0x56,0x56,0x56,
    0x48,0x49,0xcc,0xcc,0xcc,0xcc,0xcc,0x85,0x59,0x5A,0xcc,0xcc,0xcc,0xcc,0xcc,0x96,
    0x48,0xcc,0x49,0xcc,0xcc,0xcc,0x85,0xcc,0x59,0xcc,0x5A,0xcc,0xcc,0xcc,0x96,0xcc,
    0x48,0xcc,0xcc,0x49,0xcc,0x85,0xcc,0xcc,0x59,0xcc,0xcc,0x5A,0xcc,0x96,0xcc,0xcc,
    0x48,0xcc,0xcc,0xcc,0x49,0xcc,0xcc,0xcc,0x59,0xcc,0xcc,0xcc,0x96,0xcc,0xcc,0xcc,
    0x48,0xcc,0xcc,0x85,0xcc,0x49,0xcc,0xcc,0x59,0xcc,0xcc,0x96,0xcc,0x5A,0xcc,0xcc,
    0x48,0xcc,0x85,0xcc,0xcc,0xcc,0x49,0xcc,0x59,0xcc,0x96,0xcc,0xcc,0xcc,0x5A,0xcc,
    0x48,0x85,0xcc,0xcc,0xcc,0xcc,0xcc,0x49,0x59,0x96,0xcc,0xcc,0xcc,0xcc,0xcc,0x5A,
    };
    static const uint8_t needs[16]={
    0,1,0,0,
    2,4,2,0,
    0,1,0,0,
    15
    };
    int x, y, b, r, l;
    int16_t tmpIt   [64*(32+HTAPS_MAX)];
    uint8_t tmp2t[3][stride*(32+HTAPS_MAX)];
    int16_t *tmpI= tmpIt;
    uint8_t *tmp2= tmp2t[0];
    const uint8_t *hpel[11];
    assert(dx<16 && dy<16);
    r= brane[dx + 16*dy]&15;
    l= brane[dx + 16*dy]>>4;
    b= needs[l] | needs[r];
    if(p && !p->diag_mc)
        b= 15;
    if(b&5){
        for(y=0; y < b_h+HTAPS_MAX-1; y++){
            for(x=0; x < b_w; x++){
                int a_1=src[x + HTAPS_MAX/2-4];
                int a0= src[x + HTAPS_MAX/2-3];
                int a1= src[x + HTAPS_MAX/2-2];
                int a2= src[x + HTAPS_MAX/2-1];
                int a3= src[x + HTAPS_MAX/2+0];
                int a4= src[x + HTAPS_MAX/2+1];
                int a5= src[x + HTAPS_MAX/2+2];
                int a6= src[x + HTAPS_MAX/2+3];
                int am=0;
                if(!p || p->fast_mc){
                    am= 20*(a2+a3) - 5*(a1+a4) + (a0+a5);
                    tmpI[x]= am;
                    am= (am+16)>>5;
                }else{
                    am= p->hcoeff[0]*(a2+a3) + p->hcoeff[1]*(a1+a4) + p->hcoeff[2]*(a0+a5) + p->hcoeff[3]*(a_1+a6);
                    tmpI[x]= am;
                    am= (am+32)>>6;
                }
                if(am&(~255)) am= ~(am>>31);
                tmp2[x]= am;
            }
            tmpI+= 64;
            tmp2+= stride;
            src += stride;
        }
        src -= stride*y;
    }
    src += HTAPS_MAX/2 - 1;
    tmp2= tmp2t[1];
    if(b&2){
        for(y=0; y < b_h; y++){
            for(x=0; x < b_w+1; x++){
                int a_1=src[x + (HTAPS_MAX/2-4)*stride];
                int a0= src[x + (HTAPS_MAX/2-3)*stride];
                int a1= src[x + (HTAPS_MAX/2-2)*stride];
                int a2= src[x + (HTAPS_MAX/2-1)*stride];
                int a3= src[x + (HTAPS_MAX/2+0)*stride];
                int a4= src[x + (HTAPS_MAX/2+1)*stride];
                int a5= src[x + (HTAPS_MAX/2+2)*stride];
                int a6= src[x + (HTAPS_MAX/2+3)*stride];
                int am=0;
                if(!p || p->fast_mc)
                    am= (20*(a2+a3) - 5*(a1+a4) + (a0+a5) + 16)>>5;
                else
                    am= (p->hcoeff[0]*(a2+a3) + p->hcoeff[1]*(a1+a4) + p->hcoeff[2]*(a0+a5) + p->hcoeff[3]*(a_1+a6) + 32)>>6;
                if(am&(~255)) am= ~(am>>31);
                tmp2[x]= am;
            }
            src += stride;
            tmp2+= stride;
        }
        src -= stride*y;
    }
    src += stride*(HTAPS_MAX/2 - 1);
    tmp2= tmp2t[2];
    tmpI= tmpIt;
    if(b&4){
        for(y=0; y < b_h; y++){
            for(x=0; x < b_w; x++){
                int a_1=tmpI[x + (HTAPS_MAX/2-4)*64];
                int a0= tmpI[x + (HTAPS_MAX/2-3)*64];
                int a1= tmpI[x + (HTAPS_MAX/2-2)*64];
                int a2= tmpI[x + (HTAPS_MAX/2-1)*64];
                int a3= tmpI[x + (HTAPS_MAX/2+0)*64];
                int a4= tmpI[x + (HTAPS_MAX/2+1)*64];
                int a5= tmpI[x + (HTAPS_MAX/2+2)*64];
                int a6= tmpI[x + (HTAPS_MAX/2+3)*64];
                int am=0;
                if(!p || p->fast_mc)
                    am= (20*(a2+a3) - 5*(a1+a4) + (a0+a5) + 512)>>10;
                else
                    am= (p->hcoeff[0]*(a2+a3) + p->hcoeff[1]*(a1+a4) + p->hcoeff[2]*(a0+a5) + p->hcoeff[3]*(a_1+a6) + 2048)>>12;
                if(am&(~255)) am= ~(am>>31);
                tmp2[x]= am;
            }
            tmpI+= 64;
            tmp2+= stride;
        }
    }
    hpel[ 0]= src;
    hpel[ 1]= tmp2t[0] + stride*(HTAPS_MAX/2-1);
    hpel[ 2]= src + 1;
    hpel[ 4]= tmp2t[1];
    hpel[ 5]= tmp2t[2];
    hpel[ 6]= tmp2t[1] + 1;
    hpel[ 8]= src + stride;
    hpel[ 9]= hpel[1] + stride;
    hpel[10]= hpel[8] + 1;
    if(b==15){
        const uint8_t *src1= hpel[dx/8 + dy/8*4  ];
        const uint8_t *src2= hpel[dx/8 + dy/8*4+1];
        const uint8_t *src3= hpel[dx/8 + dy/8*4+4];
        const uint8_t *src4= hpel[dx/8 + dy/8*4+5];
        dx&=7;
        dy&=7;
        for(y=0; y < b_h; y++){
            for(x=0; x < b_w; x++){
                dst[x]= ((8-dx)*(8-dy)*src1[x] + dx*(8-dy)*src2[x]+
                         (8-dx)*   dy *src3[x] + dx*   dy *src4[x]+32)>>6;
            }
            src1+=stride;
            src2+=stride;
            src3+=stride;
            src4+=stride;
            dst +=stride;
        }
    }else{
        const uint8_t *src1= hpel[l];
        const uint8_t *src2= hpel[r];
        int a= weight[((dx&7) + (8*(dy&7)))];
        int b= 8-a;
        for(y=0; y < b_h; y++){
            for(x=0; x < b_w; x++){
                dst[x]= (a*src1[x] + b*src2[x] + 4)>>3;
            }
            src1+=stride;
            src2+=stride;
            dst +=stride;
        }
    }
}
['static void mc_block(Plane *p, uint8_t *dst, const uint8_t *src, int stride, int b_w, int b_h, int dx, int dy){\n    static const uint8_t weight[64]={\n    8,7,6,5,4,3,2,1,\n    7,7,0,0,0,0,0,1,\n    6,0,6,0,0,0,2,0,\n    5,0,0,5,0,3,0,0,\n    4,0,0,0,4,0,0,0,\n    3,0,0,5,0,3,0,0,\n    2,0,6,0,0,0,2,0,\n    1,7,0,0,0,0,0,1,\n    };\n    static const uint8_t brane[256]={\n    0x00,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x11,0x12,0x12,0x12,0x12,0x12,0x12,0x12,\n    0x04,0x05,0xcc,0xcc,0xcc,0xcc,0xcc,0x41,0x15,0x16,0xcc,0xcc,0xcc,0xcc,0xcc,0x52,\n    0x04,0xcc,0x05,0xcc,0xcc,0xcc,0x41,0xcc,0x15,0xcc,0x16,0xcc,0xcc,0xcc,0x52,0xcc,\n    0x04,0xcc,0xcc,0x05,0xcc,0x41,0xcc,0xcc,0x15,0xcc,0xcc,0x16,0xcc,0x52,0xcc,0xcc,\n    0x04,0xcc,0xcc,0xcc,0x41,0xcc,0xcc,0xcc,0x15,0xcc,0xcc,0xcc,0x16,0xcc,0xcc,0xcc,\n    0x04,0xcc,0xcc,0x41,0xcc,0x05,0xcc,0xcc,0x15,0xcc,0xcc,0x52,0xcc,0x16,0xcc,0xcc,\n    0x04,0xcc,0x41,0xcc,0xcc,0xcc,0x05,0xcc,0x15,0xcc,0x52,0xcc,0xcc,0xcc,0x16,0xcc,\n    0x04,0x41,0xcc,0xcc,0xcc,0xcc,0xcc,0x05,0x15,0x52,0xcc,0xcc,0xcc,0xcc,0xcc,0x16,\n    0x44,0x45,0x45,0x45,0x45,0x45,0x45,0x45,0x55,0x56,0x56,0x56,0x56,0x56,0x56,0x56,\n    0x48,0x49,0xcc,0xcc,0xcc,0xcc,0xcc,0x85,0x59,0x5A,0xcc,0xcc,0xcc,0xcc,0xcc,0x96,\n    0x48,0xcc,0x49,0xcc,0xcc,0xcc,0x85,0xcc,0x59,0xcc,0x5A,0xcc,0xcc,0xcc,0x96,0xcc,\n    0x48,0xcc,0xcc,0x49,0xcc,0x85,0xcc,0xcc,0x59,0xcc,0xcc,0x5A,0xcc,0x96,0xcc,0xcc,\n    0x48,0xcc,0xcc,0xcc,0x49,0xcc,0xcc,0xcc,0x59,0xcc,0xcc,0xcc,0x96,0xcc,0xcc,0xcc,\n    0x48,0xcc,0xcc,0x85,0xcc,0x49,0xcc,0xcc,0x59,0xcc,0xcc,0x96,0xcc,0x5A,0xcc,0xcc,\n    0x48,0xcc,0x85,0xcc,0xcc,0xcc,0x49,0xcc,0x59,0xcc,0x96,0xcc,0xcc,0xcc,0x5A,0xcc,\n    0x48,0x85,0xcc,0xcc,0xcc,0xcc,0xcc,0x49,0x59,0x96,0xcc,0xcc,0xcc,0xcc,0xcc,0x5A,\n    };\n    static const uint8_t needs[16]={\n    0,1,0,0,\n    2,4,2,0,\n    0,1,0,0,\n    15\n    };\n    int x, y, b, r, l;\n    int16_t tmpIt   [64*(32+HTAPS_MAX)];\n    uint8_t tmp2t[3][stride*(32+HTAPS_MAX)];\n    int16_t *tmpI= tmpIt;\n    uint8_t *tmp2= tmp2t[0];\n    const uint8_t *hpel[11];\n    assert(dx<16 && dy<16);\n    r= brane[dx + 16*dy]&15;\n    l= brane[dx + 16*dy]>>4;\n    b= needs[l] | needs[r];\n    if(p && !p->diag_mc)\n        b= 15;\n    if(b&5){\n        for(y=0; y < b_h+HTAPS_MAX-1; y++){\n            for(x=0; x < b_w; x++){\n                int a_1=src[x + HTAPS_MAX/2-4];\n                int a0= src[x + HTAPS_MAX/2-3];\n                int a1= src[x + HTAPS_MAX/2-2];\n                int a2= src[x + HTAPS_MAX/2-1];\n                int a3= src[x + HTAPS_MAX/2+0];\n                int a4= src[x + HTAPS_MAX/2+1];\n                int a5= src[x + HTAPS_MAX/2+2];\n                int a6= src[x + HTAPS_MAX/2+3];\n                int am=0;\n                if(!p || p->fast_mc){\n                    am= 20*(a2+a3) - 5*(a1+a4) + (a0+a5);\n                    tmpI[x]= am;\n                    am= (am+16)>>5;\n                }else{\n                    am= p->hcoeff[0]*(a2+a3) + p->hcoeff[1]*(a1+a4) + p->hcoeff[2]*(a0+a5) + p->hcoeff[3]*(a_1+a6);\n                    tmpI[x]= am;\n                    am= (am+32)>>6;\n                }\n                if(am&(~255)) am= ~(am>>31);\n                tmp2[x]= am;\n            }\n            tmpI+= 64;\n            tmp2+= stride;\n            src += stride;\n        }\n        src -= stride*y;\n    }\n    src += HTAPS_MAX/2 - 1;\n    tmp2= tmp2t[1];\n    if(b&2){\n        for(y=0; y < b_h; y++){\n            for(x=0; x < b_w+1; x++){\n                int a_1=src[x + (HTAPS_MAX/2-4)*stride];\n                int a0= src[x + (HTAPS_MAX/2-3)*stride];\n                int a1= src[x + (HTAPS_MAX/2-2)*stride];\n                int a2= src[x + (HTAPS_MAX/2-1)*stride];\n                int a3= src[x + (HTAPS_MAX/2+0)*stride];\n                int a4= src[x + (HTAPS_MAX/2+1)*stride];\n                int a5= src[x + (HTAPS_MAX/2+2)*stride];\n                int a6= src[x + (HTAPS_MAX/2+3)*stride];\n                int am=0;\n                if(!p || p->fast_mc)\n                    am= (20*(a2+a3) - 5*(a1+a4) + (a0+a5) + 16)>>5;\n                else\n                    am= (p->hcoeff[0]*(a2+a3) + p->hcoeff[1]*(a1+a4) + p->hcoeff[2]*(a0+a5) + p->hcoeff[3]*(a_1+a6) + 32)>>6;\n                if(am&(~255)) am= ~(am>>31);\n                tmp2[x]= am;\n            }\n            src += stride;\n            tmp2+= stride;\n        }\n        src -= stride*y;\n    }\n    src += stride*(HTAPS_MAX/2 - 1);\n    tmp2= tmp2t[2];\n    tmpI= tmpIt;\n    if(b&4){\n        for(y=0; y < b_h; y++){\n            for(x=0; x < b_w; x++){\n                int a_1=tmpI[x + (HTAPS_MAX/2-4)*64];\n                int a0= tmpI[x + (HTAPS_MAX/2-3)*64];\n                int a1= tmpI[x + (HTAPS_MAX/2-2)*64];\n                int a2= tmpI[x + (HTAPS_MAX/2-1)*64];\n                int a3= tmpI[x + (HTAPS_MAX/2+0)*64];\n                int a4= tmpI[x + (HTAPS_MAX/2+1)*64];\n                int a5= tmpI[x + (HTAPS_MAX/2+2)*64];\n                int a6= tmpI[x + (HTAPS_MAX/2+3)*64];\n                int am=0;\n                if(!p || p->fast_mc)\n                    am= (20*(a2+a3) - 5*(a1+a4) + (a0+a5) + 512)>>10;\n                else\n                    am= (p->hcoeff[0]*(a2+a3) + p->hcoeff[1]*(a1+a4) + p->hcoeff[2]*(a0+a5) + p->hcoeff[3]*(a_1+a6) + 2048)>>12;\n                if(am&(~255)) am= ~(am>>31);\n                tmp2[x]= am;\n            }\n            tmpI+= 64;\n            tmp2+= stride;\n        }\n    }\n    hpel[ 0]= src;\n    hpel[ 1]= tmp2t[0] + stride*(HTAPS_MAX/2-1);\n    hpel[ 2]= src + 1;\n    hpel[ 4]= tmp2t[1];\n    hpel[ 5]= tmp2t[2];\n    hpel[ 6]= tmp2t[1] + 1;\n    hpel[ 8]= src + stride;\n    hpel[ 9]= hpel[1] + stride;\n    hpel[10]= hpel[8] + 1;\n    if(b==15){\n        const uint8_t *src1= hpel[dx/8 + dy/8*4  ];\n        const uint8_t *src2= hpel[dx/8 + dy/8*4+1];\n        const uint8_t *src3= hpel[dx/8 + dy/8*4+4];\n        const uint8_t *src4= hpel[dx/8 + dy/8*4+5];\n        dx&=7;\n        dy&=7;\n        for(y=0; y < b_h; y++){\n            for(x=0; x < b_w; x++){\n                dst[x]= ((8-dx)*(8-dy)*src1[x] + dx*(8-dy)*src2[x]+\n                         (8-dx)*   dy *src3[x] + dx*   dy *src4[x]+32)>>6;\n            }\n            src1+=stride;\n            src2+=stride;\n            src3+=stride;\n            src4+=stride;\n            dst +=stride;\n        }\n    }else{\n        const uint8_t *src1= hpel[l];\n        const uint8_t *src2= hpel[r];\n        int a= weight[((dx&7) + (8*(dy&7)))];\n        int b= 8-a;\n        for(y=0; y < b_h; y++){\n            for(x=0; x < b_w; x++){\n                dst[x]= (a*src1[x] + b*src2[x] + 4)>>3;\n            }\n            src1+=stride;\n            src2+=stride;\n            dst +=stride;\n        }\n    }\n}']