libavcodec/cavsdec.c:529: error: Buffer Overrun L3
  Offset: [-3, +oo] Size: 9 by call to `decode_mb_i`.

libavcodec/cavsdec.c:529:13: Call
527.     if(h->pic_type == FF_I_TYPE) {
528.         do {
529.             decode_mb_i(h, 0);
                 ^
530.         } while(ff_cavs_next_mb(h));
531.     } else if(h->pic_type == FF_P_TYPE) {

libavcodec/cavsdec.c:189:1: <Offset trace>
187.  ****************************************************************************/
188. 
189. static int decode_mb_i(AVSContext *h, int cbp_code) {
     ^
190.     GetBitContext *gb = &h->s.gb;
191.     int block, pred_mode_uv;

libavcodec/cavsdec.c:189:1: Global `ff_cavs_scan3x3`
  187.  ****************************************************************************/
  188. 
  189. static int decode_mb_i(AVSContext *h, int cbp_code) {
       ^
  190.     GetBitContext *gb = &h->s.gb;
  191.     int block, pred_mode_uv;

libavcodec/cavsdec.c:201:9: Assignment
  199.     for(block=0;block<4;block++) {
  200.         int nA,nB,predpred;
  201.         int pos = ff_cavs_scan3x3[block];
               ^
  202. 
  203.         nA = h->pred_mode_Y[pos-1];

libavcodec/cavsdec.c:189:1: <Length trace>
187.  ****************************************************************************/
188. 
189. static int decode_mb_i(AVSContext *h, int cbp_code) {
     ^
190.     GetBitContext *gb = &h->s.gb;
191.     int block, pred_mode_uv;

libavcodec/cavsdec.c:189:1: Parameter `h->pred_mode_Y[*]`
  187.  ****************************************************************************/
  188. 
  189. static int decode_mb_i(AVSContext *h, int cbp_code) {
       ^
  190.     GetBitContext *gb = &h->s.gb;
  191.     int block, pred_mode_uv;

libavcodec/cavsdec.c:204:14: Array access: Offset: [-3, +oo] Size: 9 by call to `decode_mb_i` 
  202. 
  203.         nA = h->pred_mode_Y[pos-1];
  204.         nB = h->pred_mode_Y[pos-3];
                    ^
  205.         predpred = FFMIN(nA,nB);
  206.         if(predpred == NOT_AVAIL) // if either is not available
