libavcodec/vc1dec.c:4145: error: Buffer Overrun L2
  Offset: [0, 63] Size: 2.

libavcodec/vc1dec.c:4144:22: <Offset trace>
4142.             v->vc1dsp.vc1_inv_trans_8x8(s->block[i]);
4143.             if (v->rangeredfrm)
4144.                 for (j = 0; j < 64; j++)
                           ^
4145.                     s->block[i][j] <<= 1;
4146.             s->dsp.put_signed_pixels_clamped(s->block[i], s->dest[dst_idx] + off, i & 4 ? s->uvlinesize : s->linesize);

libavcodec/vc1dec.c:4144:22: Assignment
4142.             v->vc1dsp.vc1_inv_trans_8x8(s->block[i]);
4143.             if (v->rangeredfrm)
4144.                 for (j = 0; j < 64; j++)
                           ^
4145.                     s->block[i][j] <<= 1;
4146.             s->dsp.put_signed_pixels_clamped(s->block[i], s->dest[dst_idx] + off, i & 4 ? s->uvlinesize : s->linesize);

libavcodec/vc1dec.c:4138:13: <Length trace>
4136.                 v->c_avail = v->mb_type[0][s->block_index[i] - 1];
4137. 
4138.             vc1_decode_intra_block(v, s->block[i], i, val, mquant,
                  ^
4139.                                    (i & 4) ? v->codingset2 : v->codingset);
4140.             if ((i>3) && (s->flags & CODEC_FLAG_GRAY))

libavcodec/vc1dec.c:4138:13: Call
4136.                 v->c_avail = v->mb_type[0][s->block_index[i] - 1];
4137. 
4138.             vc1_decode_intra_block(v, s->block[i], i, val, mquant,
                  ^
4139.                                    (i & 4) ? v->codingset2 : v->codingset);
4140.             if ((i>3) && (s->flags & CODEC_FLAG_GRAY))

libavcodec/vc1dec.c:2916:1: Parameter `*block`
  2914.  * @param codingset set of VLC to decode data
  2915.  */
  2916. static int vc1_decode_intra_block(VC1Context *v, int16_t block[64], int n,
        ^
  2917.                                   int coded, int mquant, int codingset)
  2918. {

libavcodec/vc1dec.c:4145:21: Array access: Offset: [0, 63] Size: 2
4143.             if (v->rangeredfrm)
4144.                 for (j = 0; j < 64; j++)
4145.                     s->block[i][j] <<= 1;
                          ^
4146.             s->dsp.put_signed_pixels_clamped(s->block[i], s->dest[dst_idx] + off, i & 4 ? s->uvlinesize : s->linesize);
4147.         } else if (val) {

static void vc1_decode_b_mb(VC1Context *v)
{
    MpegEncContext *s = &v->s;
    GetBitContext *gb = &s->gb;
    int i, j;
    int mb_pos = s->mb_x + s->mb_y * s->mb_stride;
    int cbp = 0;
    int mqdiff, mquant;
    int ttmb = v->ttfrm;
    int mb_has_coeffs = 0;
    int index, index1;
    int val, sign;
    int first_block = 1;
    int dst_idx, off;
    int skipped, direct;
    int dmv_x[2], dmv_y[2];
    int bmvtype = BMV_TYPE_BACKWARD;
    mquant      = v->pq;
    s->mb_intra = 0;
    if (v->dmb_is_raw)
        direct = get_bits1(gb);
    else
        direct = v->direct_mb_plane[mb_pos];
    if (v->skip_is_raw)
        skipped = get_bits1(gb);
    else
        skipped = v->s.mbskip_table[mb_pos];
    dmv_x[0] = dmv_x[1] = dmv_y[0] = dmv_y[1] = 0;
    for (i = 0; i < 6; i++) {
        v->mb_type[0][s->block_index[i]] = 0;
        s->dc_val[0][s->block_index[i]]  = 0;
    }
    s->current_picture.f.qscale_table[mb_pos] = 0;
    if (!direct) {
        if (!skipped) {
            GET_MVDATA(dmv_x[0], dmv_y[0]);
            dmv_x[1] = dmv_x[0];
            dmv_y[1] = dmv_y[0];
        }
        if (skipped || !s->mb_intra) {
            bmvtype = decode012(gb);
            switch (bmvtype) {
            case 0:
                bmvtype = (v->bfraction >= (B_FRACTION_DEN/2)) ? BMV_TYPE_BACKWARD : BMV_TYPE_FORWARD;
                break;
            case 1:
                bmvtype = (v->bfraction >= (B_FRACTION_DEN/2)) ? BMV_TYPE_FORWARD : BMV_TYPE_BACKWARD;
                break;
            case 2:
                bmvtype  = BMV_TYPE_INTERPOLATED;
                dmv_x[0] = dmv_y[0] = 0;
            }
        }
    }
    for (i = 0; i < 6; i++)
        v->mb_type[0][s->block_index[i]] = s->mb_intra;
    if (skipped) {
        if (direct)
            bmvtype = BMV_TYPE_INTERPOLATED;
        vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);
        vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);
        return;
    }
    if (direct) {
        cbp = get_vlc2(&v->s.gb, v->cbpcy_vlc->table, VC1_CBPCY_P_VLC_BITS, 2);
        GET_MQUANT();
        s->mb_intra = 0;
        s->current_picture.f.qscale_table[mb_pos] = mquant;
        if (!v->ttmbf)
            ttmb = get_vlc2(gb, ff_vc1_ttmb_vlc[v->tt_index].table, VC1_TTMB_VLC_BITS, 2);
        dmv_x[0] = dmv_y[0] = dmv_x[1] = dmv_y[1] = 0;
        vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);
        vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);
    } else {
        if (!mb_has_coeffs && !s->mb_intra) {
            vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);
            vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);
            return;
        }
        if (s->mb_intra && !mb_has_coeffs) {
            GET_MQUANT();
            s->current_picture.f.qscale_table[mb_pos] = mquant;
            s->ac_pred = get_bits1(gb);
            cbp = 0;
            vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);
        } else {
            if (bmvtype == BMV_TYPE_INTERPOLATED) {
                GET_MVDATA(dmv_x[0], dmv_y[0]);
                if (!mb_has_coeffs) {
                    vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);
                    vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);
                    return;
                }
            }
            vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);
            if (!s->mb_intra) {
                vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);
            }
            if (s->mb_intra)
                s->ac_pred = get_bits1(gb);
            cbp = get_vlc2(&v->s.gb, v->cbpcy_vlc->table, VC1_CBPCY_P_VLC_BITS, 2);
            GET_MQUANT();
            s->current_picture.f.qscale_table[mb_pos] = mquant;
            if (!v->ttmbf && !s->mb_intra && mb_has_coeffs)
                ttmb = get_vlc2(gb, ff_vc1_ttmb_vlc[v->tt_index].table, VC1_TTMB_VLC_BITS, 2);
        }
    }
    dst_idx = 0;
    for (i = 0; i < 6; i++) {
        s->dc_val[0][s->block_index[i]] = 0;
        dst_idx += i >> 2;
        val = ((cbp >> (5 - i)) & 1);
        off = (i & 4) ? 0 : ((i & 1) * 8 + (i & 2) * 4 * s->linesize);
        v->mb_type[0][s->block_index[i]] = s->mb_intra;
        if (s->mb_intra) {
            v->a_avail = v->c_avail = 0;
            if (i == 2 || i == 3 || !s->first_slice_line)
                v->a_avail = v->mb_type[0][s->block_index[i] - s->block_wrap[i]];
            if (i == 1 || i == 3 || s->mb_x)
                v->c_avail = v->mb_type[0][s->block_index[i] - 1];
            vc1_decode_intra_block(v, s->block[i], i, val, mquant,
                                   (i & 4) ? v->codingset2 : v->codingset);
            if ((i>3) && (s->flags & CODEC_FLAG_GRAY))
                continue;
            v->vc1dsp.vc1_inv_trans_8x8(s->block[i]);
            if (v->rangeredfrm)
                for (j = 0; j < 64; j++)
                    s->block[i][j] <<= 1;
            s->dsp.put_signed_pixels_clamped(s->block[i], s->dest[dst_idx] + off, i & 4 ? s->uvlinesize : s->linesize);
        } else if (val) {
            vc1_decode_p_block(v, s->block[i], i, mquant, ttmb,
                               first_block, s->dest[dst_idx] + off,
                               (i & 4) ? s->uvlinesize : s->linesize,
                               (i & 4) && (s->flags & CODEC_FLAG_GRAY), NULL);
            if (!v->ttmbf && ttmb < 8)
                ttmb = -1;
            first_block = 0;
        }
    }
}
['static void vc1_decode_b_mb(VC1Context *v)\n{\n    MpegEncContext *s = &v->s;\n    GetBitContext *gb = &s->gb;\n    int i, j;\n    int mb_pos = s->mb_x + s->mb_y * s->mb_stride;\n    int cbp = 0;\n    int mqdiff, mquant;\n    int ttmb = v->ttfrm;\n    int mb_has_coeffs = 0;\n    int index, index1;\n    int val, sign;\n    int first_block = 1;\n    int dst_idx, off;\n    int skipped, direct;\n    int dmv_x[2], dmv_y[2];\n    int bmvtype = BMV_TYPE_BACKWARD;\n    mquant      = v->pq;\n    s->mb_intra = 0;\n    if (v->dmb_is_raw)\n        direct = get_bits1(gb);\n    else\n        direct = v->direct_mb_plane[mb_pos];\n    if (v->skip_is_raw)\n        skipped = get_bits1(gb);\n    else\n        skipped = v->s.mbskip_table[mb_pos];\n    dmv_x[0] = dmv_x[1] = dmv_y[0] = dmv_y[1] = 0;\n    for (i = 0; i < 6; i++) {\n        v->mb_type[0][s->block_index[i]] = 0;\n        s->dc_val[0][s->block_index[i]]  = 0;\n    }\n    s->current_picture.f.qscale_table[mb_pos] = 0;\n    if (!direct) {\n        if (!skipped) {\n            GET_MVDATA(dmv_x[0], dmv_y[0]);\n            dmv_x[1] = dmv_x[0];\n            dmv_y[1] = dmv_y[0];\n        }\n        if (skipped || !s->mb_intra) {\n            bmvtype = decode012(gb);\n            switch (bmvtype) {\n            case 0:\n                bmvtype = (v->bfraction >= (B_FRACTION_DEN/2)) ? BMV_TYPE_BACKWARD : BMV_TYPE_FORWARD;\n                break;\n            case 1:\n                bmvtype = (v->bfraction >= (B_FRACTION_DEN/2)) ? BMV_TYPE_FORWARD : BMV_TYPE_BACKWARD;\n                break;\n            case 2:\n                bmvtype  = BMV_TYPE_INTERPOLATED;\n                dmv_x[0] = dmv_y[0] = 0;\n            }\n        }\n    }\n    for (i = 0; i < 6; i++)\n        v->mb_type[0][s->block_index[i]] = s->mb_intra;\n    if (skipped) {\n        if (direct)\n            bmvtype = BMV_TYPE_INTERPOLATED;\n        vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);\n        vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);\n        return;\n    }\n    if (direct) {\n        cbp = get_vlc2(&v->s.gb, v->cbpcy_vlc->table, VC1_CBPCY_P_VLC_BITS, 2);\n        GET_MQUANT();\n        s->mb_intra = 0;\n        s->current_picture.f.qscale_table[mb_pos] = mquant;\n        if (!v->ttmbf)\n            ttmb = get_vlc2(gb, ff_vc1_ttmb_vlc[v->tt_index].table, VC1_TTMB_VLC_BITS, 2);\n        dmv_x[0] = dmv_y[0] = dmv_x[1] = dmv_y[1] = 0;\n        vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);\n        vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);\n    } else {\n        if (!mb_has_coeffs && !s->mb_intra) {\n            vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);\n            vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);\n            return;\n        }\n        if (s->mb_intra && !mb_has_coeffs) {\n            GET_MQUANT();\n            s->current_picture.f.qscale_table[mb_pos] = mquant;\n            s->ac_pred = get_bits1(gb);\n            cbp = 0;\n            vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);\n        } else {\n            if (bmvtype == BMV_TYPE_INTERPOLATED) {\n                GET_MVDATA(dmv_x[0], dmv_y[0]);\n                if (!mb_has_coeffs) {\n                    vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);\n                    vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);\n                    return;\n                }\n            }\n            vc1_pred_b_mv(v, dmv_x, dmv_y, direct, bmvtype);\n            if (!s->mb_intra) {\n                vc1_b_mc(v, dmv_x, dmv_y, direct, bmvtype);\n            }\n            if (s->mb_intra)\n                s->ac_pred = get_bits1(gb);\n            cbp = get_vlc2(&v->s.gb, v->cbpcy_vlc->table, VC1_CBPCY_P_VLC_BITS, 2);\n            GET_MQUANT();\n            s->current_picture.f.qscale_table[mb_pos] = mquant;\n            if (!v->ttmbf && !s->mb_intra && mb_has_coeffs)\n                ttmb = get_vlc2(gb, ff_vc1_ttmb_vlc[v->tt_index].table, VC1_TTMB_VLC_BITS, 2);\n        }\n    }\n    dst_idx = 0;\n    for (i = 0; i < 6; i++) {\n        s->dc_val[0][s->block_index[i]] = 0;\n        dst_idx += i >> 2;\n        val = ((cbp >> (5 - i)) & 1);\n        off = (i & 4) ? 0 : ((i & 1) * 8 + (i & 2) * 4 * s->linesize);\n        v->mb_type[0][s->block_index[i]] = s->mb_intra;\n        if (s->mb_intra) {\n            v->a_avail = v->c_avail = 0;\n            if (i == 2 || i == 3 || !s->first_slice_line)\n                v->a_avail = v->mb_type[0][s->block_index[i] - s->block_wrap[i]];\n            if (i == 1 || i == 3 || s->mb_x)\n                v->c_avail = v->mb_type[0][s->block_index[i] - 1];\n            vc1_decode_intra_block(v, s->block[i], i, val, mquant,\n                                   (i & 4) ? v->codingset2 : v->codingset);\n            if ((i>3) && (s->flags & CODEC_FLAG_GRAY))\n                continue;\n            v->vc1dsp.vc1_inv_trans_8x8(s->block[i]);\n            if (v->rangeredfrm)\n                for (j = 0; j < 64; j++)\n                    s->block[i][j] <<= 1;\n            s->dsp.put_signed_pixels_clamped(s->block[i], s->dest[dst_idx] + off, i & 4 ? s->uvlinesize : s->linesize);\n        } else if (val) {\n            vc1_decode_p_block(v, s->block[i], i, mquant, ttmb,\n                               first_block, s->dest[dst_idx] + off,\n                               (i & 4) ? s->uvlinesize : s->linesize,\n                               (i & 4) && (s->flags & CODEC_FLAG_GRAY), NULL);\n            if (!v->ttmbf && ttmb < 8)\n                ttmb = -1;\n            first_block = 0;\n        }\n    }\n}', 'static int vc1_decode_intra_block(VC1Context *v, int16_t block[64], int n,\n                                  int coded, int mquant, int codingset)\n{\n    GetBitContext *gb = &v->s.gb;\n    MpegEncContext *s = &v->s;\n    int dc_pred_dir = 0;\n    int i;\n    int16_t *dc_val;\n    int16_t *ac_val, *ac_val2;\n    int dcdiff;\n    int mb_pos = s->mb_x + s->mb_y * s->mb_stride;\n    int a_avail = v->a_avail, c_avail = v->c_avail;\n    int use_pred = s->ac_pred;\n    int scale;\n    int q1, q2 = 0;\n    s->dsp.clear_block(block);\n    mquant = (mquant < 1) ? 0 : ((mquant > 31) ? 31 : mquant);\n    s->y_dc_scale = s->y_dc_scale_table[mquant];\n    s->c_dc_scale = s->c_dc_scale_table[mquant];\n    if (n < 4) {\n        dcdiff = get_vlc2(&s->gb, ff_msmp4_dc_luma_vlc[s->dc_table_index].table, DC_VLC_BITS, 3);\n    } else {\n        dcdiff = get_vlc2(&s->gb, ff_msmp4_dc_chroma_vlc[s->dc_table_index].table, DC_VLC_BITS, 3);\n    }\n    if (dcdiff < 0) {\n        av_log(s->avctx, AV_LOG_ERROR, "Illegal DC VLC\\n");\n        return -1;\n    }\n    if (dcdiff) {\n        if (dcdiff == 119  ) {\n            if (mquant == 1)      dcdiff = get_bits(gb, 10);\n            else if (mquant == 2) dcdiff = get_bits(gb, 9);\n            else                  dcdiff = get_bits(gb, 8);\n        } else {\n            if (mquant == 1)\n                dcdiff = (dcdiff << 2) + get_bits(gb, 2) - 3;\n            else if (mquant == 2)\n                dcdiff = (dcdiff << 1) + get_bits1(gb)   - 1;\n        }\n        if (get_bits1(gb))\n            dcdiff = -dcdiff;\n    }\n    dcdiff += vc1_pred_dc(&v->s, v->overlap, mquant, n, a_avail, c_avail, &dc_val, &dc_pred_dir);\n    *dc_val = dcdiff;\n    if (n < 4) {\n        block[0] = dcdiff * s->y_dc_scale;\n    } else {\n        block[0] = dcdiff * s->c_dc_scale;\n    }\n    i = 1;\n    if (!a_avail) dc_pred_dir = 1;\n    if (!c_avail) dc_pred_dir = 0;\n    if (!a_avail && !c_avail) use_pred = 0;\n    ac_val = s->ac_val[0][0] + s->block_index[n] * 16;\n    ac_val2 = ac_val;\n    scale = mquant * 2 + v->halfpq;\n    if (dc_pred_dir)\n        ac_val -= 16;\n    else\n        ac_val -= 16 * s->block_wrap[n];\n    q1 = s->current_picture.f.qscale_table[mb_pos];\n    if (dc_pred_dir && c_avail && mb_pos)\n        q2 = s->current_picture.f.qscale_table[mb_pos - 1];\n    if (!dc_pred_dir && a_avail && mb_pos >= s->mb_stride)\n        q2 = s->current_picture.f.qscale_table[mb_pos - s->mb_stride];\n    if ( dc_pred_dir && n == 1)\n        q2 = q1;\n    if (!dc_pred_dir && n == 2)\n        q2 = q1;\n    if (n == 3) q2 = q1;\n    if (coded) {\n        int last = 0, skip, value;\n        int k;\n        while (!last) {\n            vc1_decode_ac_coeff(v, &last, &skip, &value, codingset);\n            i += skip;\n            if (i > 63)\n                break;\n            if (v->fcm == PROGRESSIVE)\n                block[v->zz_8x8[0][i++]] = value;\n            else {\n                if (use_pred && (v->fcm == ILACE_FRAME)) {\n                    if (!dc_pred_dir)\n                        block[v->zz_8x8[2][i++]] = value;\n                    else\n                        block[v->zz_8x8[3][i++]] = value;\n                } else {\n                    block[v->zzi_8x8[i++]] = value;\n                }\n            }\n        }\n        if (use_pred) {\n            if (q2 && q1 != q2) {\n                q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;\n                q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;\n                if (q1 < 1)\n                    return AVERROR_INVALIDDATA;\n                if (dc_pred_dir) {\n                    for (k = 1; k < 8; k++)\n                        block[k << v->left_blk_sh] += (ac_val[k] * q2 * ff_vc1_dqscale[q1 - 1] + 0x20000) >> 18;\n                } else {\n                    for (k = 1; k < 8; k++)\n                        block[k << v->top_blk_sh] += (ac_val[k + 8] * q2 * ff_vc1_dqscale[q1 - 1] + 0x20000) >> 18;\n                }\n            } else {\n                if (dc_pred_dir) {\n                    for (k = 1; k < 8; k++)\n                        block[k << v->left_blk_sh] += ac_val[k];\n                } else {\n                    for (k = 1; k < 8; k++)\n                        block[k << v->top_blk_sh] += ac_val[k + 8];\n                }\n            }\n        }\n        for (k = 1; k < 8; k++) {\n            ac_val2[k    ] = block[k << v->left_blk_sh];\n            ac_val2[k + 8] = block[k << v->top_blk_sh];\n        }\n        for (k = 1; k < 64; k++)\n            if (block[k]) {\n                block[k] *= scale;\n                if (!v->pquantizer)\n                    block[k] += (block[k] < 0) ? -mquant : mquant;\n            }\n        if (use_pred) i = 63;\n    } else {\n        int k;\n        memset(ac_val2, 0, 16 * 2);\n        if (dc_pred_dir) {\n            if (use_pred) {\n                memcpy(ac_val2, ac_val, 8 * 2);\n                if (q2 && q1 != q2) {\n                    q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;\n                    q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;\n                    if (q1 < 1)\n                        return AVERROR_INVALIDDATA;\n                    for (k = 1; k < 8; k++)\n                        ac_val2[k] = (ac_val2[k] * q2 * ff_vc1_dqscale[q1 - 1] + 0x20000) >> 18;\n                }\n            }\n        } else {\n            if (use_pred) {\n                memcpy(ac_val2 + 8, ac_val + 8, 8 * 2);\n                if (q2 && q1 != q2) {\n                    q1 = q1 * 2 + ((q1 == v->pq) ? v->halfpq : 0) - 1;\n                    q2 = q2 * 2 + ((q2 == v->pq) ? v->halfpq : 0) - 1;\n                    if (q1 < 1)\n                        return AVERROR_INVALIDDATA;\n                    for (k = 1; k < 8; k++)\n                        ac_val2[k + 8] = (ac_val2[k + 8] * q2 * ff_vc1_dqscale[q1 - 1] + 0x20000) >> 18;\n                }\n            }\n        }\n        if (use_pred) {\n            if (dc_pred_dir) {\n                for (k = 1; k < 8; k++) {\n                    block[k << v->left_blk_sh] = ac_val2[k] * scale;\n                    if (!v->pquantizer && block[k << v->left_blk_sh])\n                        block[k << v->left_blk_sh] += (block[k << v->left_blk_sh] < 0) ? -mquant : mquant;\n                }\n            } else {\n                for (k = 1; k < 8; k++) {\n                    block[k << v->top_blk_sh] = ac_val2[k + 8] * scale;\n                    if (!v->pquantizer && block[k << v->top_blk_sh])\n                        block[k << v->top_blk_sh] += (block[k << v->top_blk_sh] < 0) ? -mquant : mquant;\n                }\n            }\n            i = 63;\n        }\n    }\n    s->block_last_index[n] = i;\n    return 0;\n}']