libavformat/matroskadec.c:1827: error: Buffer Overrun L2
  Offset: [-oo, max(16, `matroska->num_levels`)] Size: 16.

libavformat/matroskadec.c:1691:1: <Offset trace>
1689. }
1690. 
1691. static int
      ^
1692. matroska_parse_seekhead (MatroskaDemuxContext *matroska)
1693. {

libavformat/matroskadec.c:1691:1: Parameter `matroska->num_levels`
1689. }
1690. 
1691. static int
      ^
1692. matroska_parse_seekhead (MatroskaDemuxContext *matroska)
1693. {

libavformat/matroskadec.c:1700:20: Call
1698. 
1699.     while (res == 0) {
1700.         if (!(id = ebml_peek_id(matroska, &matroska->level_up))) {
                         ^
1701.             res = AVERROR(EIO);
1702.             break;

libavformat/matroskadec.c:306:1: Parameter `matroska->num_levels`
  304.  */
  305. 
  306. static uint32_t
       ^
  307. ebml_peek_id (MatroskaDemuxContext *matroska,
  308.               int                  *level_up)

libavformat/matroskadec.c:312:9: Call
  310.     uint32_t id;
  311. 
  312.     if (ebml_read_element_id(matroska, &id, level_up) < 0)
               ^
  313.         return 0;
  314. 

libavformat/matroskadec.c:256:1: Parameter `matroska->num_levels`
    254.  */
    255. 
    256. static int
         ^
    257. ebml_read_element_id (MatroskaDemuxContext *matroska,
    258.                       uint32_t             *id,

libavformat/matroskadec.c:1713:28: Call
1711.                 uint64_t seek_pos = (uint64_t) -1, t;
1712. 
1713.                 if ((res = ebml_read_master(matroska, &id)) < 0)
                                 ^
1714.                     break;
1715. 

libavformat/matroskadec.c:532:1: Parameter `matroska->num_levels`
  530.  */
  531. 
  532. static int
       ^
  533. ebml_read_master (MatroskaDemuxContext *matroska,
  534.                   uint32_t             *id)

libavformat/matroskadec.c:541:16: Call
  539.     int res;
  540. 
  541.     if ((res = ebml_read_element_id(matroska, id, NULL)) < 0 ||
                      ^
  542.         (res = ebml_read_element_length(matroska, &length)) < 0)
  543.         return res;

libavformat/matroskadec.c:256:1: Parameter `matroska->num_levels`
    254.  */
    255. 
    256. static int
         ^
    257. ebml_read_element_id (MatroskaDemuxContext *matroska,
    258.                       uint32_t             *id,

libavformat/matroskadec.c:1787:25: Assignment
1785.                         level.length = (uint64_t)-1;
1786.                         matroska->levels[matroska->num_levels] = level;
1787.                         matroska->num_levels++;
                              ^
1788. 
1789.                         /* check ID */

libavformat/matroskadec.c:1790:36: Call
1788. 
1789.                         /* check ID */
1790.                         if (!(id = ebml_peek_id (matroska,
                                         ^
1791.                                                  &matroska->level_up)))
1792.                             goto finish;

libavformat/matroskadec.c:306:1: Parameter `matroska->num_levels`
  304.  */
  305. 
  306. static uint32_t
       ^
  307. ebml_peek_id (MatroskaDemuxContext *matroska,
  308.               int                  *level_up)

libavformat/matroskadec.c:312:9: Call
  310.     uint32_t id;
  311. 
  312.     if (ebml_read_element_id(matroska, &id, level_up) < 0)
               ^
  313.         return 0;
  314. 

libavformat/matroskadec.c:256:1: Parameter `matroska->num_levels`
    254.  */
    255. 
    256. static int
         ^
    257. ebml_read_element_id (MatroskaDemuxContext *matroska,
    258.                       uint32_t             *id,

libavformat/matroskadec.c:1825:29: Assignment
1823.                         /* remove dummy level */
1824.                         while (matroska->num_levels) {
1825.                             matroska->num_levels--;
                                  ^
1826.                             length =
1827.                                 matroska->levels[matroska->num_levels].length;

libavformat/matroskadec.c:1691:1: <Length trace>
1689. }
1690. 
1691. static int
      ^
1692. matroska_parse_seekhead (MatroskaDemuxContext *matroska)
1693. {

libavformat/matroskadec.c:1691:1: Parameter `matroska->levels[*]`
1689. }
1690. 
1691. static int
      ^
1692. matroska_parse_seekhead (MatroskaDemuxContext *matroska)
1693. {

libavformat/matroskadec.c:1827:33: Array access: Offset: [-oo, max(16, matroska->num_levels)] Size: 16
1825.                             matroska->num_levels--;
1826.                             length =
1827.                                 matroska->levels[matroska->num_levels].length;
                                      ^
1828.                             if (length == (uint64_t)-1)
1829.                                 break;
