libavcodec/nellymoserdec.c:301: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 128 by call to `get_sample_bits`.

libavcodec/nellymoserdec.c:277:1: Array declaration
275. }
276. 
277. void nelly_decode_block(NellyMoserDecodeContext *s, const unsigned char block[NELLY_BLOCK_LEN], float audio[NELLY_SAMPLES])
     ^
278. {
279.     int i,j;

libavcodec/nellymoserdec.c:301:5: Call
299.     }
300. 
301.     get_sample_bits(buf, bits);
         ^
302. 
303.     for (i = 0; i < 2; i++) {

libavcodec/nellymoserdec.c:265:15: <Offset trace>
263. 
264.     if (bitsum > NELLY_DETAIL_BITS) {
265.         tmp = i = 0;
                   ^
266.         while (tmp < NELLY_DETAIL_BITS) {
267.             tmp += bits[i];

libavcodec/nellymoserdec.c:265:15: Assignment
  263. 
  264.     if (bitsum > NELLY_DETAIL_BITS) {
  265.         tmp = i = 0;
                     ^
  266.         while (tmp < NELLY_DETAIL_BITS) {
  267.             tmp += bits[i];

libavcodec/nellymoserdec.c:167:1: <Length trace>
165. 
166. 
167. static void get_sample_bits(const float *buf, int *bits)
     ^
168. {
169.     int i, j;

libavcodec/nellymoserdec.c:167:1: Parameter `*bits`
  165. 
  166. 
  167. static void get_sample_bits(const float *buf, int *bits)
       ^
  168. {
  169.     int i, j;

libavcodec/nellymoserdec.c:271:9: Array access: Offset: [-1, +oo] Size: 128 by call to `get_sample_bits` 
  269.         }
  270. 
  271.         bits[i-1] -= tmp - NELLY_DETAIL_BITS;
               ^
  272.         for(; i < NELLY_FILL_LEN; i++)
  273.             bits[i] = 0;
