libavcodec/tdsc.c:255: error: Buffer Overrun L3
  Offset: 3 Size: [1, 2147483631].

libavcodec/tdsc.c:195:25: <Length trace>
193.     ctx->cursor_hot_x = bytestream2_get_le16(&ctx->gbc);
194.     ctx->cursor_hot_y = bytestream2_get_le16(&ctx->gbc);
195.     ctx->cursor_w     = bytestream2_get_le16(&ctx->gbc);
                             ^
196.     ctx->cursor_h     = bytestream2_get_le16(&ctx->gbc);
197. 

libavcodec/tdsc.c:195:25: Call
193.     ctx->cursor_hot_x = bytestream2_get_le16(&ctx->gbc);
194.     ctx->cursor_hot_y = bytestream2_get_le16(&ctx->gbc);
195.     ctx->cursor_w     = bytestream2_get_le16(&ctx->gbc);
                             ^
196.     ctx->cursor_h     = bytestream2_get_le16(&ctx->gbc);
197. 

libavcodec/bytestream.h:87:1: Assignment
  85. DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)
  86. DEF(unsigned int, le24, 3, AV_RL24, AV_WL24)
  87. DEF(unsigned int, le16, 2, AV_RL16, AV_WL16)
      ^
  88. DEF(uint64_t,     be64, 8, AV_RB64, AV_WB64)
  89. DEF(unsigned int, be32, 4, AV_RB32, AV_WB32)

libavcodec/tdsc.c:195:5: Assignment
193.     ctx->cursor_hot_x = bytestream2_get_le16(&ctx->gbc);
194.     ctx->cursor_hot_y = bytestream2_get_le16(&ctx->gbc);
195.     ctx->cursor_w     = bytestream2_get_le16(&ctx->gbc);
         ^
196.     ctx->cursor_h     = bytestream2_get_le16(&ctx->gbc);
197. 

libavcodec/tdsc.c:198:5: Assignment
196.     ctx->cursor_h     = bytestream2_get_le16(&ctx->gbc);
197. 
198.     ctx->cursor_stride = FFALIGN(ctx->cursor_w, 32) * 4;
         ^
199.     cursor_fmt = bytestream2_get_le32(&ctx->gbc);
200. 

libavcodec/tdsc.c:273:13: Assignment
271.                 }
272.             }
273.             dst += ctx->cursor_stride - ctx->cursor_w * 4;
                 ^
274.         }
275.         break;

libavcodec/tdsc.c:255:25: Array access: Offset: 3 Size: [1, 2147483631]
253.                         dst[1] = 0x00;
254.                         dst[2] = 0x00;
255.                         dst[3] = 0x00;
                             ^
256.                         break;
257.                     case 1:

static int tdsc_load_cursor(AVCodecContext *avctx)
{
    TDSCContext *ctx  = avctx->priv_data;
    int i, j, k, ret, bits, cursor_fmt;
    uint8_t *dst;
    ctx->cursor_hot_x = bytestream2_get_le16(&ctx->gbc);
    ctx->cursor_hot_y = bytestream2_get_le16(&ctx->gbc);
    ctx->cursor_w     = bytestream2_get_le16(&ctx->gbc);
    ctx->cursor_h     = bytestream2_get_le16(&ctx->gbc);
    ctx->cursor_stride = FFALIGN(ctx->cursor_w, 32) * 4;
    cursor_fmt = bytestream2_get_le32(&ctx->gbc);
    if (ctx->cursor_x >= avctx->width || ctx->cursor_y >= avctx->height) {
        av_log(avctx, AV_LOG_ERROR,
               "Invalid cursor position (%d.%d outside %dx%d).\n",
               ctx->cursor_x, ctx->cursor_y, avctx->width, avctx->height);
        return AVERROR_INVALIDDATA;
    }
    if (ctx->cursor_w < 1 || ctx->cursor_w > 256 ||
        ctx->cursor_h < 1 || ctx->cursor_h > 256) {
        av_log(avctx, AV_LOG_ERROR,
               "Invalid cursor dimensions %dx%d.\n",
               ctx->cursor_w, ctx->cursor_h);
        return AVERROR_INVALIDDATA;
    }
    if (ctx->cursor_hot_x > ctx->cursor_w ||
        ctx->cursor_hot_y > ctx->cursor_h) {
        av_log(avctx, AV_LOG_WARNING, "Invalid hotspot position %d.%d.\n",
               ctx->cursor_hot_x, ctx->cursor_hot_y);
        ctx->cursor_hot_x = FFMIN(ctx->cursor_hot_x, ctx->cursor_w - 1);
        ctx->cursor_hot_y = FFMIN(ctx->cursor_hot_y, ctx->cursor_h - 1);
    }
    ret = av_reallocp(&ctx->cursor, ctx->cursor_stride * ctx->cursor_h);
    if (ret < 0) {
        av_log(avctx, AV_LOG_ERROR, "Cannot allocate cursor buffer.\n");
        return ret;
    }
    dst = ctx->cursor;
    switch (cursor_fmt) {
    case CUR_FMT_MONO:
        for (j = 0; j < ctx->cursor_h; j++) {
            for (i = 0; i < ctx->cursor_w; i += 32) {
                bits = bytestream2_get_be32(&ctx->gbc);
                for (k = 0; k < 32; k++) {
                    dst[0] = !!(bits & 0x80000000);
                    dst   += 4;
                    bits <<= 1;
                }
            }
            dst += ctx->cursor_stride - ctx->cursor_w * 4;
        }
        dst = ctx->cursor;
        for (j = 0; j < ctx->cursor_h; j++) {
            for (i = 0; i < ctx->cursor_w; i += 32) {
                bits = bytestream2_get_be32(&ctx->gbc);
                for (k = 0; k < 32; k++) {
                    int mask_bit = !!(bits & 0x80000000);
                    switch (dst[0] * 2 + mask_bit) {
                    case 0:
                        dst[0] = 0xFF;
                        dst[1] = 0x00;
                        dst[2] = 0x00;
                        dst[3] = 0x00;
                        break;
                    case 1:
                        dst[0] = 0xFF;
                        dst[1] = 0xFF;
                        dst[2] = 0xFF;
                        dst[3] = 0xFF;
                        break;
                    default:
                        dst[0] = 0x00;
                        dst[1] = 0x00;
                        dst[2] = 0x00;
                        dst[3] = 0x00;
                    }
                    dst   += 4;
                    bits <<= 1;
                }
            }
            dst += ctx->cursor_stride - ctx->cursor_w * 4;
        }
        break;
    case CUR_FMT_BGRA:
    case CUR_FMT_RGBA:
        bytestream2_skip(&ctx->gbc,
                         ctx->cursor_h * (FFALIGN(ctx->cursor_w, 32) >> 3));
        if (cursor_fmt & 8) {
            for (j = 0; j < ctx->cursor_h; j++) {
                for (i = 0; i < ctx->cursor_w; i++) {
                    int val = bytestream2_get_be32(&ctx->gbc);
                    *dst++ = val >> 24;
                    *dst++ = val >> 16;
                    *dst++ = val >>  8;
                    *dst++ = val >>  0;
                }
                dst += ctx->cursor_stride - ctx->cursor_w * 4;
            }
        } else {
            for (j = 0; j < ctx->cursor_h; j++) {
                for (i = 0; i < ctx->cursor_w; i++) {
                    int val = bytestream2_get_be32(&ctx->gbc);
                    *dst++ = val >>  0;
                    *dst++ = val >> 24;
                    *dst++ = val >> 16;
                    *dst++ = val >>  8;
                }
                dst += ctx->cursor_stride - ctx->cursor_w * 4;
            }
        }
        break;
    default:
        avpriv_request_sample(avctx, "Cursor format %08x", cursor_fmt);
        return AVERROR_PATCHWELCOME;
    }
    return 0;
}
['static int tdsc_load_cursor(AVCodecContext *avctx)\n{\n    TDSCContext *ctx  = avctx->priv_data;\n    int i, j, k, ret, bits, cursor_fmt;\n    uint8_t *dst;\n    ctx->cursor_hot_x = bytestream2_get_le16(&ctx->gbc);\n    ctx->cursor_hot_y = bytestream2_get_le16(&ctx->gbc);\n    ctx->cursor_w     = bytestream2_get_le16(&ctx->gbc);\n    ctx->cursor_h     = bytestream2_get_le16(&ctx->gbc);\n    ctx->cursor_stride = FFALIGN(ctx->cursor_w, 32) * 4;\n    cursor_fmt = bytestream2_get_le32(&ctx->gbc);\n    if (ctx->cursor_x >= avctx->width || ctx->cursor_y >= avctx->height) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Invalid cursor position (%d.%d outside %dx%d).\\n",\n               ctx->cursor_x, ctx->cursor_y, avctx->width, avctx->height);\n        return AVERROR_INVALIDDATA;\n    }\n    if (ctx->cursor_w < 1 || ctx->cursor_w > 256 ||\n        ctx->cursor_h < 1 || ctx->cursor_h > 256) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Invalid cursor dimensions %dx%d.\\n",\n               ctx->cursor_w, ctx->cursor_h);\n        return AVERROR_INVALIDDATA;\n    }\n    if (ctx->cursor_hot_x > ctx->cursor_w ||\n        ctx->cursor_hot_y > ctx->cursor_h) {\n        av_log(avctx, AV_LOG_WARNING, "Invalid hotspot position %d.%d.\\n",\n               ctx->cursor_hot_x, ctx->cursor_hot_y);\n        ctx->cursor_hot_x = FFMIN(ctx->cursor_hot_x, ctx->cursor_w - 1);\n        ctx->cursor_hot_y = FFMIN(ctx->cursor_hot_y, ctx->cursor_h - 1);\n    }\n    ret = av_reallocp(&ctx->cursor, ctx->cursor_stride * ctx->cursor_h);\n    if (ret < 0) {\n        av_log(avctx, AV_LOG_ERROR, "Cannot allocate cursor buffer.\\n");\n        return ret;\n    }\n    dst = ctx->cursor;\n    switch (cursor_fmt) {\n    case CUR_FMT_MONO:\n        for (j = 0; j < ctx->cursor_h; j++) {\n            for (i = 0; i < ctx->cursor_w; i += 32) {\n                bits = bytestream2_get_be32(&ctx->gbc);\n                for (k = 0; k < 32; k++) {\n                    dst[0] = !!(bits & 0x80000000);\n                    dst   += 4;\n                    bits <<= 1;\n                }\n            }\n            dst += ctx->cursor_stride - ctx->cursor_w * 4;\n        }\n        dst = ctx->cursor;\n        for (j = 0; j < ctx->cursor_h; j++) {\n            for (i = 0; i < ctx->cursor_w; i += 32) {\n                bits = bytestream2_get_be32(&ctx->gbc);\n                for (k = 0; k < 32; k++) {\n                    int mask_bit = !!(bits & 0x80000000);\n                    switch (dst[0] * 2 + mask_bit) {\n                    case 0:\n                        dst[0] = 0xFF;\n                        dst[1] = 0x00;\n                        dst[2] = 0x00;\n                        dst[3] = 0x00;\n                        break;\n                    case 1:\n                        dst[0] = 0xFF;\n                        dst[1] = 0xFF;\n                        dst[2] = 0xFF;\n                        dst[3] = 0xFF;\n                        break;\n                    default:\n                        dst[0] = 0x00;\n                        dst[1] = 0x00;\n                        dst[2] = 0x00;\n                        dst[3] = 0x00;\n                    }\n                    dst   += 4;\n                    bits <<= 1;\n                }\n            }\n            dst += ctx->cursor_stride - ctx->cursor_w * 4;\n        }\n        break;\n    case CUR_FMT_BGRA:\n    case CUR_FMT_RGBA:\n        bytestream2_skip(&ctx->gbc,\n                         ctx->cursor_h * (FFALIGN(ctx->cursor_w, 32) >> 3));\n        if (cursor_fmt & 8) {\n            for (j = 0; j < ctx->cursor_h; j++) {\n                for (i = 0; i < ctx->cursor_w; i++) {\n                    int val = bytestream2_get_be32(&ctx->gbc);\n                    *dst++ = val >> 24;\n                    *dst++ = val >> 16;\n                    *dst++ = val >>  8;\n                    *dst++ = val >>  0;\n                }\n                dst += ctx->cursor_stride - ctx->cursor_w * 4;\n            }\n        } else {\n            for (j = 0; j < ctx->cursor_h; j++) {\n                for (i = 0; i < ctx->cursor_w; i++) {\n                    int val = bytestream2_get_be32(&ctx->gbc);\n                    *dst++ = val >>  0;\n                    *dst++ = val >> 24;\n                    *dst++ = val >> 16;\n                    *dst++ = val >>  8;\n                }\n                dst += ctx->cursor_stride - ctx->cursor_w * 4;\n            }\n        }\n        break;\n    default:\n        avpriv_request_sample(avctx, "Cursor format %08x", cursor_fmt);\n        return AVERROR_PATCHWELCOME;\n    }\n    return 0;\n}', 'DEF(unsigned int, le16, 2, AV_RL16, AV_WL16)']