libavcodec/vp8.c:854: error: Buffer Overrun L1
  Offset: [9, 10] Size: 3.

libavcodec/vp8.c:853:29: <Offset trace>
851.                     }
852.                 } else {    // DCT_CAT3 and up
853.                     int a = vp56_rac_get_prob(c, token_prob[8]);
                                 ^
854.                     int b = vp56_rac_get_prob(c, token_prob[9+a]);
855.                     int cat = (a<<1) + b;

libavcodec/vp8.c:853:29: Call
851.                     }
852.                 } else {    // DCT_CAT3 and up
853.                     int a = vp56_rac_get_prob(c, token_prob[8]);
                                 ^
854.                     int b = vp56_rac_get_prob(c, token_prob[9+a]);
855.                     int cat = (a<<1) + b;

libavcodec/vp56.h:222:15: Assignment
  220.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
  221.     unsigned int low_shift = low << 8;
  222.     int bit = code_word >= low_shift;
                     ^
  223. 
  224.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:222:5: Assignment
  220.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
  221.     unsigned int low_shift = low << 8;
  222.     int bit = code_word >= low_shift;
           ^
  223. 
  224.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:227:5: Assignment
  225.     c->code_word = bit ? code_word - low_shift : code_word;
  226. 
  227.     return bit;
           ^
  228. }
  229. #endif

libavcodec/vp8.c:853:21: Assignment
851.                     }
852.                 } else {    // DCT_CAT3 and up
853.                     int a = vp56_rac_get_prob(c, token_prob[8]);
                         ^
854.                     int b = vp56_rac_get_prob(c, token_prob[9+a]);
855.                     int cat = (a<<1) + b;

libavcodec/vp8.c:808:1: <Length trace>
806.  *         otherwise, the index of the last coeff decoded plus one
807.  */
808. static int decode_block_coeffs(VP56RangeCoder *c, DCTELEM block[16],
     ^
809.                                uint8_t probs[8][3][NUM_DCT_TOKENS-1],
810.                                int i, int zero_nhood, int16_t qmul[2])

libavcodec/vp8.c:808:1: Parameter `(*probs)[*]`
806.  *         otherwise, the index of the last coeff decoded plus one
807.  */
808. static int decode_block_coeffs(VP56RangeCoder *c, DCTELEM block[16],
     ^
809.                                uint8_t probs[8][3][NUM_DCT_TOKENS-1],
810.                                int i, int zero_nhood, int16_t qmul[2])

libavcodec/vp8.c:817:9: Assignment
815. 
816.     do {
817.         token_prob = probs[vp8_coeff_band[i]][zero_nhood];
             ^
818. 
819.         if (!vp56_rac_get_prob_branchy(c, token_prob[0]))   // DCT_EOB

libavcodec/vp8.c:854:50: Array access: Offset: [9, 10] Size: 3
852.                 } else {    // DCT_CAT3 and up
853.                     int a = vp56_rac_get_prob(c, token_prob[8]);
854.                     int b = vp56_rac_get_prob(c, token_prob[9+a]);
                                                      ^
855.                     int cat = (a<<1) + b;
856.                     coeff  = 3 + (8<<cat);
