libavcodec/ffv1dec.c:393: error: Buffer Overrun L3
  Offset: [-2, +oo] (⇐ [0, +oo] + -2) Size: 2 by call to `decode_rgb_frame`.

libavcodec/ffv1dec.c:352:9: Call
350.         return ret;
351.     if (f->cur->key_frame)
352.         ffv1_clear_slice_state(f, fs);
             ^
353.     width  = fs->slice_width;
354.     height = fs->slice_height;

libavcodec/ffv1.c:256:17: Assignment
  254.             for (j = 0; j < p->context_count; j++) {
  255.                 p->vlc_state[j].drift     = 0;
  256.                 p->vlc_state[j].error_sum = 4;    //FFMAX((RANGE + 32)/64, 2);
                       ^
  257.                 p->vlc_state[j].bias      = 0;
  258.                 p->vlc_state[j].count     = 1;

libavcodec/ffv1dec.c:353:5: Assignment
351.     if (f->cur->key_frame)
352.         ffv1_clear_slice_state(f, fs);
353.     width  = fs->slice_width;
         ^
354.     height = fs->slice_height;
355.     x      = fs->slice_x;

libavcodec/ffv1dec.c:393:9: Call
391.                                p->data[1] + ps * x + y * p->linesize[1],
392.                                p->data[2] + ps * x + y * p->linesize[2] };
393.         decode_rgb_frame(fs, planes, width, height, p->linesize);
             ^
394.     }
395.     if (fs->ac && f->version > 2) {

libavcodec/ffv1dec.c:211:1: Array declaration
  209. }
  210. 
  211. static void decode_rgb_frame(FFV1Context *s, uint8_t *src[3], int w, int h,
       ^
  212.                              int stride[3])
  213. {

libavcodec/ffv1dec.c:241:17: Call
  239.             sample[p][0][w]  = sample[p][0][w - 1];
  240.             if (lbd)
  241.                 decode_line(s, w, sample[p], (p + 1) / 2, 9);
                       ^
  242.             else
  243.                 decode_line(s, w, sample[p], (p + 1) / 2, bits + 1);

libavcodec/ffv1dec.c:99:1: Parameter `w`
     97. }
     98. 
     99. static av_always_inline void decode_line(FFV1Context *s, int w,
         ^
    100.                                          int16_t *sample[2],
    101.                                          int plane_index, int bits)

libavcodec/ffv1dec.c:113:19: Call
    111.         int diff, context, sign;
    112. 
    113.         context = get_context(p, sample[1] + x, sample[0] + x, sample[1] + x);
                           ^
    114.         if (context < 0) {
    115.             context = -context;

libavcodec/ffv1.h:142:1: <Length trace>
140. }
141. 
142. static inline int get_context(PlaneContext *p, int16_t *src,
     ^
143.                               int16_t *last, int16_t *last2)
144. {

libavcodec/ffv1.h:142:1: Parameter `*src`
      140. }
      141. 
      142. static inline int get_context(PlaneContext *p, int16_t *src,
           ^
      143.                               int16_t *last, int16_t *last2)
      144. {

libavcodec/ffv1.h:152:24: Array access: Offset: [-2, +oo] (⇐ [0, +oo] + -2) Size: 2 by call to `decode_rgb_frame` 
      150.     if (p->quant_table[3][127]) {
      151.         const int TT = last2[0];
      152.         const int LL = src[-2];
                                  ^
      153.         return p->quant_table[0][(L - LT) & 0xFF] +
      154.                p->quant_table[1][(LT - T) & 0xFF] +

static inline int get_context(PlaneContext *p, int16_t *src,
                              int16_t *last, int16_t *last2)
{
    const int LT = last[-1];
    const int T  = last[0];
    const int RT = last[1];
    const int L  = src[-1];
    if (p->quant_table[3][127]) {
        const int TT = last2[0];
        const int LL = src[-2];
        return p->quant_table[0][(L - LT) & 0xFF] +
               p->quant_table[1][(LT - T) & 0xFF] +
               p->quant_table[2][(T - RT) & 0xFF] +
               p->quant_table[3][(LL - L) & 0xFF] +
               p->quant_table[4][(TT - T) & 0xFF];
    } else
        return p->quant_table[0][(L - LT) & 0xFF] +
               p->quant_table[1][(LT - T) & 0xFF] +
               p->quant_table[2][(T - RT) & 0xFF];
}
['static int decode_slice(AVCodecContext *c, void *arg)\n{\n    FFV1Context *fs = *(void **)arg;\n    FFV1Context *f  = fs->avctx->priv_data;\n    int width, height, x, y, ret;\n    const int ps = (av_pix_fmt_desc_get(c->pix_fmt)->flags & PIX_FMT_PLANAR)\n                   ? (c->bits_per_raw_sample > 8) + 1\n                   : 4;\n    AVFrame *const p = f->cur;\n    if (f->version > 2) {\n        if (decode_slice_header(f, fs) < 0) {\n            fs->slice_damaged = 1;\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    if ((ret = ffv1_init_slice_state(f, fs)) < 0)\n        return ret;\n    if (f->cur->key_frame)\n        ffv1_clear_slice_state(f, fs);\n    width  = fs->slice_width;\n    height = fs->slice_height;\n    x      = fs->slice_x;\n    y      = fs->slice_y;\n    if (!fs->ac) {\n        if (f->version == 3 && f->minor_version > 1 || f->version > 3)\n            get_rac(&fs->c, (uint8_t[]) { 129 });\n        fs->ac_byte_count = f->version > 2 || (!x && !y) ? fs->c.bytestream - fs->c.bytestream_start - 1 : 0;\n        init_get_bits(&fs->gb, fs->c.bytestream_start + fs->ac_byte_count,\n                      (fs->c.bytestream_end - fs->c.bytestream_start -\n                       fs->ac_byte_count) * 8);\n    }\n    av_assert1(width && height);\n    if (f->colorspace == 0) {\n        const int chroma_width  = -((-width) >> f->chroma_h_shift);\n        const int chroma_height = -((-height) >> f->chroma_v_shift);\n        const int cx            = x >> f->chroma_h_shift;\n        const int cy            = y >> f->chroma_v_shift;\n        decode_plane(fs, p->data[0] + ps * x + y * p->linesize[0], width,\n                     height, p->linesize[0],\n                     0);\n        if (f->chroma_planes) {\n            decode_plane(fs, p->data[1] + ps * cx + cy * p->linesize[1],\n                         chroma_width, chroma_height, p->linesize[1],\n                         1);\n            decode_plane(fs, p->data[2] + ps * cx + cy * p->linesize[2],\n                         chroma_width, chroma_height, p->linesize[2],\n                         1);\n        }\n        if (fs->transparency)\n            decode_plane(fs, p->data[3] + ps * x + y * p->linesize[3], width,\n                         height, p->linesize[3],\n                         2);\n    } else {\n        uint8_t *planes[3] = { p->data[0] + ps * x + y * p->linesize[0],\n                               p->data[1] + ps * x + y * p->linesize[1],\n                               p->data[2] + ps * x + y * p->linesize[2] };\n        decode_rgb_frame(fs, planes, width, height, p->linesize);\n    }\n    if (fs->ac && f->version > 2) {\n        int v;\n        get_rac(&fs->c, (uint8_t[]) { 129 });\n        v = fs->c.bytestream_end - fs->c.bytestream - 2 - 5 * f->ec;\n        if (v) {\n            av_log(f->avctx, AV_LOG_ERROR, "bytestream end mismatching by %d\\n",\n                   v);\n            fs->slice_damaged = 1;\n        }\n    }\n    emms_c();\n    return 0;\n}', 'void ffv1_clear_slice_state(FFV1Context *f, FFV1Context *fs)\n{\n    int i, j;\n    for (i = 0; i < f->plane_count; i++) {\n        PlaneContext *p = &fs->plane[i];\n        p->interlace_bit_state[0] = 128;\n        p->interlace_bit_state[1] = 128;\n        if (fs->ac) {\n            if (f->initial_states[p->quant_table_index]) {\n                memcpy(p->state, f->initial_states[p->quant_table_index],\n                       CONTEXT_SIZE * p->context_count);\n            } else\n                memset(p->state, 128, CONTEXT_SIZE * p->context_count);\n        } else {\n            for (j = 0; j < p->context_count; j++) {\n                p->vlc_state[j].drift     = 0;\n                p->vlc_state[j].error_sum = 4;\n                p->vlc_state[j].bias      = 0;\n                p->vlc_state[j].count     = 1;\n            }\n        }\n    }\n}', 'static void decode_rgb_frame(FFV1Context *s, uint8_t *src[3], int w, int h,\n                             int stride[3])\n{\n    int x, y, p;\n    int16_t *sample[4][2];\n    int lbd  = s->avctx->bits_per_raw_sample <= 8;\n    int bits = s->avctx->bits_per_raw_sample > 0\n               ? s->avctx->bits_per_raw_sample\n               : 8;\n    int offset = 1 << bits;\n    for (x = 0; x < 4; x++) {\n        sample[x][0] = s->sample_buffer +  x * 2      * (w + 6) + 3;\n        sample[x][1] = s->sample_buffer + (x * 2 + 1) * (w + 6) + 3;\n    }\n    s->run_index = 0;\n    memset(s->sample_buffer, 0, 8 * (w + 6) * sizeof(*s->sample_buffer));\n    for (y = 0; y < h; y++) {\n        for (p = 0; p < 3 + s->transparency; p++) {\n            int16_t *temp = sample[p][0];\n            sample[p][0] = sample[p][1];\n            sample[p][1] = temp;\n            sample[p][1][-1] = sample[p][0][0];\n            sample[p][0][w]  = sample[p][0][w - 1];\n            if (lbd)\n                decode_line(s, w, sample[p], (p + 1) / 2, 9);\n            else\n                decode_line(s, w, sample[p], (p + 1) / 2, bits + 1);\n        }\n        for (x = 0; x < w; x++) {\n            int g = sample[0][1][x];\n            int b = sample[1][1][x];\n            int r = sample[2][1][x];\n            int a = sample[3][1][x];\n            b -= offset;\n            r -= offset;\n            g -= (b + r) >> 2;\n            b += g;\n            r += g;\n            if (lbd)\n                *((uint32_t *)(src[0] + x * 4 + stride[0] * y)) = b +\n                    (g << 8) + (r << 16) + (a << 24);\n            else {\n                *((uint16_t *)(src[0] + x * 2 + stride[0] * y)) = b;\n                *((uint16_t *)(src[1] + x * 2 + stride[1] * y)) = g;\n                *((uint16_t *)(src[2] + x * 2 + stride[2] * y)) = r;\n            }\n        }\n    }\n}', 'static av_always_inline void decode_line(FFV1Context *s, int w,\n                                         int16_t *sample[2],\n                                         int plane_index, int bits)\n{\n    PlaneContext *const p = &s->plane[plane_index];\n    RangeCoder *const c   = &s->c;\n    int x;\n    int run_count = 0;\n    int run_mode  = 0;\n    int run_index = s->run_index;\n    for (x = 0; x < w; x++) {\n        int diff, context, sign;\n        context = get_context(p, sample[1] + x, sample[0] + x, sample[1] + x);\n        if (context < 0) {\n            context = -context;\n            sign    = 1;\n        } else\n            sign = 0;\n        av_assert2(context < p->context_count);\n        if (s->ac) {\n            diff = get_symbol_inline(c, p->state[context], 1);\n        } else {\n            if (context == 0 && run_mode == 0)\n                run_mode = 1;\n            if (run_mode) {\n                if (run_count == 0 && run_mode == 1) {\n                    if (get_bits1(&s->gb)) {\n                        run_count = 1 << ff_log2_run[run_index];\n                        if (x + run_count <= w)\n                            run_index++;\n                    } else {\n                        if (ff_log2_run[run_index])\n                            run_count = get_bits(&s->gb, ff_log2_run[run_index]);\n                        else\n                            run_count = 0;\n                        if (run_index)\n                            run_index--;\n                        run_mode = 2;\n                    }\n                }\n                run_count--;\n                if (run_count < 0) {\n                    run_mode  = 0;\n                    run_count = 0;\n                    diff      = get_vlc_symbol(&s->gb, &p->vlc_state[context],\n                                               bits);\n                    if (diff >= 0)\n                        diff++;\n                } else\n                    diff = 0;\n            } else\n                diff = get_vlc_symbol(&s->gb, &p->vlc_state[context], bits);\n            av_dlog(s->avctx, "count:%d index:%d, mode:%d, x:%d pos:%d\\n",\n                    run_count, run_index, run_mode, x, get_bits_count(&s->gb));\n        }\n        if (sign)\n            diff = -diff;\n        sample[1][x] = (predict(sample[1] + x, sample[0] + x) + diff) &\n                       ((1 << bits) - 1);\n    }\n    s->run_index = run_index;\n}', 'static inline int get_context(PlaneContext *p, int16_t *src,\n                              int16_t *last, int16_t *last2)\n{\n    const int LT = last[-1];\n    const int T  = last[0];\n    const int RT = last[1];\n    const int L  = src[-1];\n    if (p->quant_table[3][127]) {\n        const int TT = last2[0];\n        const int LL = src[-2];\n        return p->quant_table[0][(L - LT) & 0xFF] +\n               p->quant_table[1][(LT - T) & 0xFF] +\n               p->quant_table[2][(T - RT) & 0xFF] +\n               p->quant_table[3][(LL - L) & 0xFF] +\n               p->quant_table[4][(TT - T) & 0xFF];\n    } else\n        return p->quant_table[0][(L - LT) & 0xFF] +\n               p->quant_table[1][(LT - T) & 0xFF] +\n               p->quant_table[2][(T - RT) & 0xFF];\n}']