libavcodec/opt.c:164: error: Buffer Overrun L3
  Offset: [0, 1] Size: [1, 256] by call to `ff_eval2`.

libavcodec/opt.c:118:1: Array declaration
116. }
117. 
118. const AVOption *av_set_string(void *obj, const char *name, const char *val){
     ^
119.     const AVOption *o= av_find_opt(obj, name, NULL, 0, 0);
120.     if(o && o->offset==0 && o->type == FF_OPT_TYPE_CONST && o->unit){

libavcodec/opt.c:164:17: Call
162.             val+= i;
163. 
164.             d = ff_eval2(buf, const_values, const_names, NULL, NULL, NULL, NULL, NULL, &error);
                     ^
165.             if(isnan(d)) {
166.                 const AVOption *o_named= av_find_opt(obj, buf, o->unit, 0, 0);

libavcodec/eval.c:415:1: Parameter `s->strlen`
  413. }
  414. 
  415. double ff_eval2(const char *s, double *const_value, const char **const_name,
       ^
  416.                double (**func1)(void *, double), const char **func1_name,
  417.                double (**func2)(void *, double, double), char **func2_name,

libavcodec/eval.c:419:22: Call
  417.                double (**func2)(void *, double, double), char **func2_name,
  418.                void *opaque, const char **error){
  419.     AVEvalExpr * e = ff_parse(s, const_name, func1, func1_name, func2, func2_name, error);
                            ^
  420.     double d;
  421.     if (!e) return NAN;

libavcodec/eval.c:378:1: Parameter `s->strlen`
    376. }
    377. 
    378. AVEvalExpr * ff_parse(const char *s, const char **const_name,
         ^
    379.                double (**func1)(void *, double), const char **func1_name,
    380.                double (**func2)(void *, double, double), char **func2_name,

libavcodec/eval.c:384:12: Array declaration
    382.     Parser p;
    383.     AVEvalExpr * e;
    384.     char w[strlen(s) + 1], * wp = w;
                    ^
    385. 
    386.     while (*s)

libavcodec/eval.c:391:5: Assignment
    389. 
    390.     p.stack_index=100;
    391.     p.s= w;
             ^
    392.     p.const_name = const_name;
    393.     p.func1      = func1;

libavcodec/eval.c:399:9: Call
    397.     p.error= error;
    398. 
    399.     e = parse_expr(&p);
                 ^
    400.     if (!verify_expr(e)) {
    401.         ff_eval_free(e);

libavcodec/eval.c:345:1: Parameter `*p->s`
      343. }
      344. 
      345. static AVEvalExpr * parse_expr(Parser *p) {
           ^
      346.     AVEvalExpr * e;
      347. 

libavcodec/eval.c:352:9: Call
      350.     p->stack_index--;
      351. 
      352.     e = parse_subexpr(p);
                   ^
      353. 
      354.     while(*p->s == ';') {

libavcodec/eval.c:336:1: Parameter `*p->s`
        334. }
        335. 
        336. static AVEvalExpr * parse_subexpr(Parser *p) {
             ^
        337.     AVEvalExpr * e = parse_term(p);
        338.     while(*p->s == '+' || *p->s == '-') {

libavcodec/eval.c:337:22: Call
        335. 
        336. static AVEvalExpr * parse_subexpr(Parser *p) {
        337.     AVEvalExpr * e = parse_term(p);
                                  ^
        338.     while(*p->s == '+' || *p->s == '-') {
        339.         e= new_eval_expr(e_add, 1, e, parse_term(p));

libavcodec/eval.c:327:1: Parameter `*p->s`
          325. }
          326. 
          327. static AVEvalExpr * parse_term(Parser *p){
               ^
          328.     AVEvalExpr * e = parse_factor(p);
          329.     while(p->s[0]=='*' || p->s[0]=='/'){

libavcodec/eval.c:328:22: Call
          326. 
          327. static AVEvalExpr * parse_term(Parser *p){
          328.     AVEvalExpr * e = parse_factor(p);
                                    ^
          329.     while(p->s[0]=='*' || p->s[0]=='/'){
          330.         int c= *p->s++;

libavcodec/eval.c:315:1: Parameter `*p->s`
            313. }
            314. 
            315. static AVEvalExpr * parse_factor(Parser *p){
                 ^
            316.     int sign, sign2;
            317.     AVEvalExpr * e = parse_pow(p, &sign);

libavcodec/eval.c:317:22: Call
            315. static AVEvalExpr * parse_factor(Parser *p){
            316.     int sign, sign2;
            317.     AVEvalExpr * e = parse_pow(p, &sign);
                                      ^
            318.     while(p->s[0]=='^'){
            319.         p->s++;

libavcodec/eval.c:309:1: Parameter `*p->s`
              307. }
              308. 
              309. static AVEvalExpr * parse_pow(Parser *p, int *sign){
                   ^
              310.     *sign= (*p->s == '+') - (*p->s == '-');
              311.     p->s += *sign&1;

libavcodec/eval.c:311:5: Assignment
              309. static AVEvalExpr * parse_pow(Parser *p, int *sign){
              310.     *sign= (*p->s == '+') - (*p->s == '-');
              311.     p->s += *sign&1;
                       ^
              312.     return parse_primary(p);
              313. }

libavcodec/eval.c:312:12: Call
              310.     *sign= (*p->s == '+') - (*p->s == '-');
              311.     p->s += *sign&1;
              312.     return parse_primary(p);
                              ^
              313. }
              314. 

libavcodec/eval.c:194:1: <Length trace>
192. }
193. 
194. static AVEvalExpr * parse_primary(Parser *p) {
     ^
195.     AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
196.     char *next= p->s;

libavcodec/eval.c:194:1: Parameter `*p->s`
                192. }
                193. 
                194. static AVEvalExpr * parse_primary(Parser *p) {
                     ^
                195.     AVEvalExpr * d = av_mallocz(sizeof(AVEvalExpr));
                196.     char *next= p->s;

libavcodec/eval.c:226:9: Array access: Offset: [0, 1] Size: [1, 256] by call to `ff_eval2` 
                224.     }
                225.     p->s++; // "("
                226.     if (*next == '(') { // special case do-nothing
                             ^
                227.         av_freep(&d);
                228.         d = parse_expr(p);
