libavcodec/snow.c:3599: error: Buffer Overrun L2
  Offset: [-oo, 4] Size: 4.

libavcodec/snow.c:3594:24: <Offset trace>
3592.                 Plane *p= &s->plane[plane_index];
3593.                 p->diag_mc= get_rac(&s->c, s->header_state);
3594.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                             ^
3595.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3596.                     return -1;

libavcodec/snow.c:3594:24: Call
3592.                 Plane *p= &s->plane[plane_index];
3593.                 p->diag_mc= get_rac(&s->c, s->header_state);
3594.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                             ^
3595.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3596.                     return -1;

libavcodec/snow.c:656:9: Assignment
  654. static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){
  655.     if(get_rac(c, state+0))
  656.         return 0;
               ^
  657.     else{
  658.         int i, e, a;

libavcodec/snow.c:3594:17: Assignment
3592.                 Plane *p= &s->plane[plane_index];
3593.                 p->diag_mc= get_rac(&s->c, s->header_state);
3594.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                      ^
3595.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3596.                     return -1;

libavcodec/snow.c:3598:21: Assignment
3596.                     return -1;
3597.                 p->htaps= htaps;
3598.                 for(i= htaps/2; i; i--){
                          ^
3599.                     p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
3600.                     sum += p->hcoeff[i];

libavcodec/snow.c:3553:1: <Length trace>
3551. }
3552. 
3553. static int decode_header(SnowContext *s){
      ^
3554.     int plane_index;
3555.     uint8_t kstate[32];

libavcodec/snow.c:3553:1: Parameter `s->plane[*].hcoeff[*]`
3551. }
3552. 
3553. static int decode_header(SnowContext *s){
      ^
3554.     int plane_index;
3555.     uint8_t kstate[32];

libavcodec/snow.c:3599:21: Array access: Offset: [-oo, 4] Size: 4
3597.                 p->htaps= htaps;
3598.                 for(i= htaps/2; i; i--){
3599.                     p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
                          ^
3600.                     sum += p->hcoeff[i];
3601.                 }
