libavcodec/dxa.c:275: error: Buffer Overrun L3
  Offset: [-8, 5] Size: 6 by call to `decode_13`.

libavcodec/dxa.c:238:39: Unknown value from: uncompress
236. 
237.     dsize = c->dsize;
238.     if((compr != 4 && compr != -1) && uncompress(c->decomp_buf, &dsize, buf + 9, buf_size - 9) != Z_OK){
                                           ^
239.         av_log(avctx, AV_LOG_ERROR, "Uncompress failed!\n");
240.         return AVERROR_UNKNOWN;

libavcodec/dxa.c:275:9: Call
273.         frame->key_frame = 0;
274.         frame->pict_type = AV_PICTURE_TYPE_P;
275.         decode_13(avctx, c, frame->data[0], frame->linesize[0], srcptr, c->prev.data[0]);
             ^
276.         break;
277.     default:

libavcodec/dxa.c:51:1: <Offset trace>
49. static const int shift2[6] = { 0, 0, 8, 4, 0, 4 };
50. 
51. static int decode_13(AVCodecContext *avctx, DxaDecContext *c, uint8_t* dst,
    ^
52.                      int stride, uint8_t *src, uint8_t *ref)
53. {

libavcodec/dxa.c:51:1: Parameter `*src`
  49. static const int shift2[6] = { 0, 0, 8, 4, 0, 4 };
  50. 
  51. static int decode_13(AVCodecContext *avctx, DxaDecContext *c, uint8_t* dst,
      ^
  52.                      int stride, uint8_t *src, uint8_t *ref)
  53. {

libavcodec/dxa.c:68:13: Assignment
  66.             tmp  = dst + i;
  67.             tmp2 = ref + i;
  68.             type = *code++;
                  ^
  69.             switch(type){
  70.             case 4: // motion compensation

libavcodec/dxa.c:93:21: Assignment
  91.                     msk += 2;
  92.                 }else{
  93.                     type -= 10;
                          ^
  94.                     mask = ((msk[0] & 0xF0) << shift1[type]) | ((msk[0] & 0xF) << shift2[type]);
  95.                     msk++;

libavcodec/dxa.c:48:1: <Length trace>
46. } DxaDecContext;
47. 
48. static const int shift1[6] = { 0, 8, 8, 8, 4, 4 };
    ^
49. static const int shift2[6] = { 0, 0, 8, 4, 0, 4 };
50. 

libavcodec/dxa.c:48:1: Array declaration
  46. } DxaDecContext;
  47. 
  48. static const int shift1[6] = { 0, 8, 8, 8, 4, 4 };
      ^
  49. static const int shift2[6] = { 0, 0, 8, 4, 0, 4 };
  50. 

libavcodec/dxa.c:94:48: Array access: Offset: [-8, 5] Size: 6 by call to `decode_13` 
  92.                 }else{
  93.                     type -= 10;
  94.                     mask = ((msk[0] & 0xF0) << shift1[type]) | ((msk[0] & 0xF) << shift2[type]);
                                                     ^
  95.                     msk++;
  96.                 }

static int decode_13(AVCodecContext *avctx, DxaDecContext *c, uint8_t* dst,
                     int stride, uint8_t *src, uint8_t *ref)
{
    uint8_t *code, *data, *mv, *msk, *tmp, *tmp2;
    int i, j, k;
    int type, x, y, d, d2;
    uint32_t mask;
    code = src  + 12;
    data = code + ((avctx->width * avctx->height) >> 4);
    mv   = data + AV_RB32(src + 0);
    msk  = mv   + AV_RB32(src + 4);
    for(j = 0; j < avctx->height; j += 4){
        for(i = 0; i < avctx->width; i += 4){
            tmp  = dst + i;
            tmp2 = ref + i;
            type = *code++;
            switch(type){
            case 4:
                x = (*mv) >> 4;    if(x & 8) x = 8 - x;
                y = (*mv++) & 0xF; if(y & 8) y = 8 - y;
                tmp2 += x + y*stride;
            case 0:
            case 5:
                for(y = 0; y < 4; y++){
                    memcpy(tmp, tmp2, 4);
                    tmp  += stride;
                    tmp2 += stride;
                }
                break;
            case 1:
            case 10:
            case 11:
            case 12:
            case 13:
            case 14:
            case 15:
                if(type == 1){
                    mask = AV_RB16(msk);
                    msk += 2;
                }else{
                    type -= 10;
                    mask = ((msk[0] & 0xF0) << shift1[type]) | ((msk[0] & 0xF) << shift2[type]);
                    msk++;
                }
                for(y = 0; y < 4; y++){
                    for(x = 0; x < 4; x++){
                        tmp[x] = (mask & 0x8000) ? *data++ : tmp2[x];
                        mask <<= 1;
                    }
                    tmp  += stride;
                    tmp2 += stride;
                }
                break;
            case 2:
                for(y = 0; y < 4; y++){
                    memset(tmp, data[0], 4);
                    tmp += stride;
                }
                data++;
                break;
            case 3:
                for(y = 0; y < 4; y++){
                    memcpy(tmp, data, 4);
                    data += 4;
                    tmp  += stride;
                }
                break;
            case 8:
                mask = *msk++;
                for(k = 0; k < 4; k++){
                    d  = ((k & 1) << 1) + ((k & 2) * stride);
                    d2 = ((k & 1) << 1) + ((k & 2) * stride);
                    tmp2 = ref + i + d2;
                    switch(mask & 0xC0){
                    case 0x80:
                        x = (*mv) >> 4;    if(x & 8) x = 8 - x;
                        y = (*mv++) & 0xF; if(y & 8) y = 8 - y;
                        tmp2 += x + y*stride;
                    case 0x00:
                        tmp[d + 0         ] = tmp2[0];
                        tmp[d + 1         ] = tmp2[1];
                        tmp[d + 0 + stride] = tmp2[0 + stride];
                        tmp[d + 1 + stride] = tmp2[1 + stride];
                        break;
                    case 0x40:
                        tmp[d + 0         ] = data[0];
                        tmp[d + 1         ] = data[0];
                        tmp[d + 0 + stride] = data[0];
                        tmp[d + 1 + stride] = data[0];
                        data++;
                        break;
                    case 0xC0:
                        tmp[d + 0         ] = *data++;
                        tmp[d + 1         ] = *data++;
                        tmp[d + 0 + stride] = *data++;
                        tmp[d + 1 + stride] = *data++;
                        break;
                    }
                    mask <<= 2;
                }
                break;
            case 32:
                mask = AV_RB16(msk);
                msk += 2;
                for(y = 0; y < 4; y++){
                    for(x = 0; x < 4; x++){
                        tmp[x] = data[mask & 1];
                        mask >>= 1;
                    }
                    tmp  += stride;
                    tmp2 += stride;
                }
                data += 2;
                break;
            case 33:
            case 34:
                mask = AV_RB32(msk);
                msk += 4;
                for(y = 0; y < 4; y++){
                    for(x = 0; x < 4; x++){
                        tmp[x] = data[mask & 3];
                        mask >>= 2;
                    }
                    tmp  += stride;
                    tmp2 += stride;
                }
                data += type - 30;
                break;
            default:
                av_log(avctx, AV_LOG_ERROR, "Unknown opcode %d\n", type);
                return AVERROR_INVALIDDATA;
            }
        }
        dst += stride * 4;
        ref += stride * 4;
    }
    return 0;
}
['static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPacket *avpkt)\n{\n    AVFrame *frame = data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    DxaDecContext * const c = avctx->priv_data;\n    uint8_t *outptr, *srcptr, *tmpptr;\n    unsigned long dsize;\n    int i, j, compr, ret;\n    int stride;\n    int orig_buf_size = buf_size;\n    int pc = 0;\n    if(buf[0]==\'C\' && buf[1]==\'M\' && buf[2]==\'A\' && buf[3]==\'P\'){\n        int r, g, b;\n        buf += 4;\n        for(i = 0; i < 256; i++){\n            r = *buf++;\n            g = *buf++;\n            b = *buf++;\n            c->pal[i] = (r << 16) | (g << 8) | b;\n        }\n        pc = 1;\n        buf_size -= 768+4;\n    }\n    if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    memcpy(frame->data[1], c->pal, AVPALETTE_SIZE);\n    frame->palette_has_changed = pc;\n    outptr = frame->data[0];\n    srcptr = c->decomp_buf;\n    tmpptr = c->prev.data[0];\n    stride = frame->linesize[0];\n    if(buf[0]==\'N\' && buf[1]==\'U\' && buf[2]==\'L\' && buf[3]==\'L\')\n        compr = -1;\n    else\n        compr = buf[4];\n    dsize = c->dsize;\n    if((compr != 4 && compr != -1) && uncompress(c->decomp_buf, &dsize, buf + 9, buf_size - 9) != Z_OK){\n        av_log(avctx, AV_LOG_ERROR, "Uncompress failed!\\n");\n        return AVERROR_UNKNOWN;\n    }\n    switch(compr){\n    case -1:\n        frame->key_frame = 0;\n        frame->pict_type = AV_PICTURE_TYPE_P;\n        if(c->prev.data[0])\n            memcpy(frame->data[0], c->prev.data[0], frame->linesize[0] * avctx->height);\n        else{\n            memset(frame->data[0], 0, frame->linesize[0] * avctx->height);\n            frame->key_frame = 1;\n            frame->pict_type = AV_PICTURE_TYPE_I;\n        }\n        break;\n    case 2:\n    case 3:\n    case 4:\n    case 5:\n        frame->key_frame = !(compr & 1);\n        frame->pict_type = (compr & 1) ? AV_PICTURE_TYPE_P : AV_PICTURE_TYPE_I;\n        for(j = 0; j < avctx->height; j++){\n            if(compr & 1){\n                for(i = 0; i < avctx->width; i++)\n                    outptr[i] = srcptr[i] ^ tmpptr[i];\n                tmpptr += stride;\n            }else\n                memcpy(outptr, srcptr, avctx->width);\n            outptr += stride;\n            srcptr += avctx->width;\n        }\n        break;\n    case 12:\n    case 13:\n        frame->key_frame = 0;\n        frame->pict_type = AV_PICTURE_TYPE_P;\n        decode_13(avctx, c, frame->data[0], frame->linesize[0], srcptr, c->prev.data[0]);\n        break;\n    default:\n        av_log(avctx, AV_LOG_ERROR, "Unknown/unsupported compression type %d\\n", buf[4]);\n        return AVERROR_INVALIDDATA;\n    }\n    av_frame_unref(&c->prev);\n    if ((ret = av_frame_ref(&c->prev, frame)) < 0)\n        return ret;\n    *got_frame = 1;\n    return orig_buf_size;\n}', 'static int decode_13(AVCodecContext *avctx, DxaDecContext *c, uint8_t* dst,\n                     int stride, uint8_t *src, uint8_t *ref)\n{\n    uint8_t *code, *data, *mv, *msk, *tmp, *tmp2;\n    int i, j, k;\n    int type, x, y, d, d2;\n    uint32_t mask;\n    code = src  + 12;\n    data = code + ((avctx->width * avctx->height) >> 4);\n    mv   = data + AV_RB32(src + 0);\n    msk  = mv   + AV_RB32(src + 4);\n    for(j = 0; j < avctx->height; j += 4){\n        for(i = 0; i < avctx->width; i += 4){\n            tmp  = dst + i;\n            tmp2 = ref + i;\n            type = *code++;\n            switch(type){\n            case 4:\n                x = (*mv) >> 4;    if(x & 8) x = 8 - x;\n                y = (*mv++) & 0xF; if(y & 8) y = 8 - y;\n                tmp2 += x + y*stride;\n            case 0:\n            case 5:\n                for(y = 0; y < 4; y++){\n                    memcpy(tmp, tmp2, 4);\n                    tmp  += stride;\n                    tmp2 += stride;\n                }\n                break;\n            case 1:\n            case 10:\n            case 11:\n            case 12:\n            case 13:\n            case 14:\n            case 15:\n                if(type == 1){\n                    mask = AV_RB16(msk);\n                    msk += 2;\n                }else{\n                    type -= 10;\n                    mask = ((msk[0] & 0xF0) << shift1[type]) | ((msk[0] & 0xF) << shift2[type]);\n                    msk++;\n                }\n                for(y = 0; y < 4; y++){\n                    for(x = 0; x < 4; x++){\n                        tmp[x] = (mask & 0x8000) ? *data++ : tmp2[x];\n                        mask <<= 1;\n                    }\n                    tmp  += stride;\n                    tmp2 += stride;\n                }\n                break;\n            case 2:\n                for(y = 0; y < 4; y++){\n                    memset(tmp, data[0], 4);\n                    tmp += stride;\n                }\n                data++;\n                break;\n            case 3:\n                for(y = 0; y < 4; y++){\n                    memcpy(tmp, data, 4);\n                    data += 4;\n                    tmp  += stride;\n                }\n                break;\n            case 8:\n                mask = *msk++;\n                for(k = 0; k < 4; k++){\n                    d  = ((k & 1) << 1) + ((k & 2) * stride);\n                    d2 = ((k & 1) << 1) + ((k & 2) * stride);\n                    tmp2 = ref + i + d2;\n                    switch(mask & 0xC0){\n                    case 0x80:\n                        x = (*mv) >> 4;    if(x & 8) x = 8 - x;\n                        y = (*mv++) & 0xF; if(y & 8) y = 8 - y;\n                        tmp2 += x + y*stride;\n                    case 0x00:\n                        tmp[d + 0         ] = tmp2[0];\n                        tmp[d + 1         ] = tmp2[1];\n                        tmp[d + 0 + stride] = tmp2[0 + stride];\n                        tmp[d + 1 + stride] = tmp2[1 + stride];\n                        break;\n                    case 0x40:\n                        tmp[d + 0         ] = data[0];\n                        tmp[d + 1         ] = data[0];\n                        tmp[d + 0 + stride] = data[0];\n                        tmp[d + 1 + stride] = data[0];\n                        data++;\n                        break;\n                    case 0xC0:\n                        tmp[d + 0         ] = *data++;\n                        tmp[d + 1         ] = *data++;\n                        tmp[d + 0 + stride] = *data++;\n                        tmp[d + 1 + stride] = *data++;\n                        break;\n                    }\n                    mask <<= 2;\n                }\n                break;\n            case 32:\n                mask = AV_RB16(msk);\n                msk += 2;\n                for(y = 0; y < 4; y++){\n                    for(x = 0; x < 4; x++){\n                        tmp[x] = data[mask & 1];\n                        mask >>= 1;\n                    }\n                    tmp  += stride;\n                    tmp2 += stride;\n                }\n                data += 2;\n                break;\n            case 33:\n            case 34:\n                mask = AV_RB32(msk);\n                msk += 4;\n                for(y = 0; y < 4; y++){\n                    for(x = 0; x < 4; x++){\n                        tmp[x] = data[mask & 3];\n                        mask >>= 2;\n                    }\n                    tmp  += stride;\n                    tmp2 += stride;\n                }\n                data += type - 30;\n                break;\n            default:\n                av_log(avctx, AV_LOG_ERROR, "Unknown opcode %d\\n", type);\n                return AVERROR_INVALIDDATA;\n            }\n        }\n        dst += stride * 4;\n        ref += stride * 4;\n    }\n    return 0;\n}']