libavcodec/ffv1dec.c:493: error: Buffer Overrun L2
  Offset: [1, 138] (⇐ [0, 11] + [1, 127]) Size: 8 by call to `read_quant_tables`.

libavcodec/ffv1dec.c:448:1: Parameter `f->quant_tables[*]`
446. }
447. 
448. static int read_extra_header(FFV1Context *f)
     ^
449. {
450.     RangeCoder *const c = &f->c;

libavcodec/ffv1dec.c:493:31: Call
491.         return AVERROR_INVALIDDATA;
492.     for (i = 0; i < f->quant_table_count; i++) {
493.         f->context_count[i] = read_quant_tables(c, f->quant_tables[i]);
                                   ^
494.         if (f->context_count[i] < 0) {
495.             av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\n");

libavcodec/ffv1dec.c:433:1: Parameter `*quant_table`
  431. }
  432. 
  433. static int read_quant_tables(RangeCoder *c,
       ^
  434.                              int16_t quant_table[MAX_CONTEXT_INPUTS][256])
  435. {

libavcodec/ffv1dec.c:440:26: Call
  438. 
  439.     for (i = 0; i < 5; i++) {
  440.         context_count *= read_quant_table(c, quant_table[i], context_count);
                                ^
  441.         if (context_count > 32768U) {
  442.             return -1;

libavcodec/ffv1dec.c:426:10: <Offset trace>
424.     }
425. 
426.     for (i = 1; i < 128; i++)
              ^
427.         quant_table[256 - i] = -quant_table[i];
428.     quant_table[128] = -quant_table[127];

libavcodec/ffv1dec.c:426:10: Assignment
    424.     }
    425. 
    426.     for (i = 1; i < 128; i++)
                  ^
    427.         quant_table[256 - i] = -quant_table[i];
    428.     quant_table[128] = -quant_table[127];

libavcodec/ffv1dec.c:406:1: <Length trace>
404. }
405. 
406. static int read_quant_table(RangeCoder *c, int16_t *quant_table, int scale)
     ^
407. {
408.     int v;

libavcodec/ffv1dec.c:406:1: Parameter `*quant_table`
    404. }
    405. 
    406. static int read_quant_table(RangeCoder *c, int16_t *quant_table, int scale)
         ^
    407. {
    408.     int v;

libavcodec/ffv1dec.c:427:33: Array access: Offset: [1, 138] (⇐ [0, 11] + [1, 127]) Size: 8 by call to `read_quant_tables` 
    425. 
    426.     for (i = 1; i < 128; i++)
    427.         quant_table[256 - i] = -quant_table[i];
                                         ^
    428.     quant_table[128] = -quant_table[127];
    429. 

static int read_quant_table(RangeCoder *c, int16_t *quant_table, int scale)
{
    int v;
    int i = 0;
    uint8_t state[CONTEXT_SIZE];
    memset(state, 128, sizeof(state));
    for (v = 0; i < 128; v++) {
        unsigned len = get_symbol(c, state, 0) + 1;
        if (len > 128 - i)
            return -1;
        while (len--) {
            quant_table[i] = scale * v;
            i++;
        }
    }
    for (i = 1; i < 128; i++)
        quant_table[256 - i] = -quant_table[i];
    quant_table[128] = -quant_table[127];
    return 2 * v - 1;
}
['static int read_extra_header(FFV1Context *f)\n{\n    RangeCoder *const c = &f->c;\n    uint8_t state[CONTEXT_SIZE];\n    int i, j, k, ret;\n    uint8_t state2[32][CONTEXT_SIZE];\n    memset(state2, 128, sizeof(state2));\n    memset(state, 128, sizeof(state));\n    ff_init_range_decoder(c, f->avctx->extradata, f->avctx->extradata_size);\n    ff_build_rac_states(c, 0.05 * (1LL << 32), 256 - 8);\n    f->version = get_symbol(c, state, 0);\n    if (f->version > 2) {\n        c->bytestream_end -= 4;\n        f->minor_version   = get_symbol(c, state, 0);\n    }\n    f->ac = f->avctx->coder_type = get_symbol(c, state, 0);\n    if (f->ac > 1) {\n        for (i = 1; i < 256; i++)\n            f->state_transition[i] = get_symbol(c, state, 1) + c->one_state[i];\n    }\n    f->colorspace                 = get_symbol(c, state, 0);\n    f->avctx->bits_per_raw_sample = get_symbol(c, state, 0);\n    f->chroma_planes              = get_rac(c, state);\n    f->chroma_h_shift             = get_symbol(c, state, 0);\n    f->chroma_v_shift             = get_symbol(c, state, 0);\n    f->transparency               = get_rac(c, state);\n    f->plane_count                = 2 + f->transparency;\n    f->num_h_slices               = 1 + get_symbol(c, state, 0);\n    f->num_v_slices               = 1 + get_symbol(c, state, 0);\n    if (f->num_h_slices > (unsigned)f->width ||\n        f->num_v_slices > (unsigned)f->height) {\n        av_log(f->avctx, AV_LOG_ERROR, "too many slices\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    f->quant_table_count = get_symbol(c, state, 0);\n    if (f->quant_table_count > (unsigned)MAX_QUANT_TABLES)\n        return AVERROR_INVALIDDATA;\n    for (i = 0; i < f->quant_table_count; i++) {\n        f->context_count[i] = read_quant_tables(c, f->quant_tables[i]);\n        if (f->context_count[i] < 0) {\n            av_log(f->avctx, AV_LOG_ERROR, "read_quant_table error\\n");\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    if ((ret = ffv1_allocate_initial_states(f)) < 0)\n        return ret;\n    for (i = 0; i < f->quant_table_count; i++)\n        if (get_rac(c, state)) {\n            for (j = 0; j < f->context_count[i]; j++)\n                for (k = 0; k < CONTEXT_SIZE; k++) {\n                    int pred = j ? f->initial_states[i][j - 1][k] : 128;\n                    f->initial_states[i][j][k] =\n                        (pred + get_symbol(c, state2[k], 1)) & 0xFF;\n                }\n        }\n    if (f->version > 2) {\n        f->ec = get_symbol(c, state, 0);\n    }\n    if (f->version > 2) {\n        unsigned v;\n        v = av_crc(av_crc_get_table(AV_CRC_32_IEEE), 0,\n                   f->avctx->extradata, f->avctx->extradata_size);\n        if (v) {\n            av_log(f->avctx, AV_LOG_ERROR, "CRC mismatch %X!\\n", v);\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    return 0;\n}', 'static int read_quant_tables(RangeCoder *c,\n                             int16_t quant_table[MAX_CONTEXT_INPUTS][256])\n{\n    int i;\n    int context_count = 1;\n    for (i = 0; i < 5; i++) {\n        context_count *= read_quant_table(c, quant_table[i], context_count);\n        if (context_count > 32768U) {\n            return -1;\n        }\n    }\n    return (context_count + 1) / 2;\n}', 'static int read_quant_table(RangeCoder *c, int16_t *quant_table, int scale)\n{\n    int v;\n    int i = 0;\n    uint8_t state[CONTEXT_SIZE];\n    memset(state, 128, sizeof(state));\n    for (v = 0; i < 128; v++) {\n        unsigned len = get_symbol(c, state, 0) + 1;\n        if (len > 128 - i)\n            return -1;\n        while (len--) {\n            quant_table[i] = scale * v;\n            i++;\n        }\n    }\n    for (i = 1; i < 128; i++)\n        quant_table[256 - i] = -quant_table[i];\n    quant_table[128] = -quant_table[127];\n    return 2 * v - 1;\n}']