libavcodec/on2avc.c:891: error: Buffer Overrun L3
  Offset added: [4096, +oo] (⇐ [0, +oo] + 4096) Size: [0, +oo] by call to `on2avc_decode_subframe`.

libavcodec/on2avc.c:891:24: Call
889.         while (bytestream2_get_bytes_left(&gb) > 2) {
890.             frame_size = bytestream2_get_le16(&gb);
891.             if ((ret = on2avc_decode_subframe(c, gb.buffer, frame_size,
                            ^
892.                                               frame, audio_off)) < 0)
893.                 return ret;

libavcodec/on2avc.c:799:1: Parameter `c->band_type[*].strlen`
  797. }
  798. 
  799. static int on2avc_decode_subframe(On2AVCContext *c, const uint8_t *buf,
       ^
  800.                                   int buf_size, AVFrame *dst, int offset)
  801. {

libavcodec/on2avc.c:891:24: Call
889.         while (bytestream2_get_bytes_left(&gb) > 2) {
890.             frame_size = bytestream2_get_le16(&gb);
891.             if ((ret = on2avc_decode_subframe(c, gb.buffer, frame_size,
                            ^
892.                                               frame, audio_off)) < 0)
893.                 return ret;

libavcodec/on2avc.c:799:1: Parameter `c->avctx->channels`
  797. }
  798. 
  799. static int on2avc_decode_subframe(On2AVCContext *c, const uint8_t *buf,
       ^
  800.                                   int buf_size, AVFrame *dst, int offset)
  801. {

libavcodec/on2avc.c:828:20: Call
  826.     on2avc_read_ms_info(c, &bc);
  827.     for (i = 0; i < c->avctx->channels; i++)
  828.         if ((ret = on2avc_read_channel_data(c, &bc, i)) < 0)
                          ^
  829.             return AVERROR_INVALIDDATA;
  830.     if (c->avctx->channels == 2 && c->ms_present)

libavcodec/on2avc.c:254:1: <Length trace>
252. }
253. 
254. static int on2avc_read_channel_data(On2AVCContext *c, BitstreamContext *bc, int ch)
     ^
255. {
256.     int ret;

libavcodec/on2avc.c:254:1: Parameter `ch`
    252. }
    253. 
    254. static int on2avc_read_channel_data(On2AVCContext *c, BitstreamContext *bc, int ch)
         ^
    255. {
    256.     int ret;

libavcodec/on2avc.c:265:5: Assignment
    263.         return ret;
    264. 
    265.     coeff_ptr = c->coeffs[ch];
             ^
    266.     band_idx  = 0;
    267.     memset(coeff_ptr, 0, ON2AVC_SUBFRAME_SIZE * sizeof(*coeff_ptr));

libavcodec/on2avc.c:267:5: Array access: Offset added: [4096, +oo] (⇐ [0, +oo] + 4096) Size: [0, +oo] by call to `on2avc_decode_subframe` 
    265.     coeff_ptr = c->coeffs[ch];
    266.     band_idx  = 0;
    267.     memset(coeff_ptr, 0, ON2AVC_SUBFRAME_SIZE * sizeof(*coeff_ptr));
             ^
    268.     for (w = 0; w < c->num_windows; w++) {
    269.         for (b = 0; b < c->num_bands; b++) {
