libavcodec/vp8.c:1330: error: Buffer Overrun L1
  Offset: [9, 10] Size: 3 by call to `vp7_decode_block_coeffs_internal`.

libavcodec/vp8.c:1321:1: Parameter `(*probs)[*]`
1319.  *         otherwise, the index of the last coeff decoded plus one
1320.  */
1321. static av_always_inline
      ^
1322. int decode_block_coeffs(VP56RangeCoder *c, int16_t block[16],
1323.                         uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:1327:5: Assignment
1325.                         const uint8_t scan[16], int vp7)
1326. {
1327.     uint8_t *token_prob = probs[i][zero_nhood];
          ^
1328.     if (!vp56_rac_get_prob_branchy(c, token_prob[0]))   // DCT_EOB
1329.         return 0;

libavcodec/vp8.c:1330:18: Call
1328.     if (!vp56_rac_get_prob_branchy(c, token_prob[0]))   // DCT_EOB
1329.         return 0;
1330.     return vp7 ? vp7_decode_block_coeffs_internal(c, block, probs, i,
                       ^
1331.                                                   token_prob, qmul, scan)
1332.                : vp8_decode_block_coeffs_internal(c, block, probs, i,

libavcodec/vp8.c:1286:1: Parameter `*token_prob`
  1284. }
  1285. 
  1286. static int vp7_decode_block_coeffs_internal(VP56RangeCoder *r,
        ^
  1287.                                             int16_t block[16],
  1288.                                             uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:1293:12: Call
  1291.                                             const uint8_t scan[16])
  1292. {
  1293.     return decode_block_coeffs_internal(r, block, probs, i,
                   ^
  1294.                                         token_prob, qmul, scan, IS_VP7);
  1295. }

libavcodec/vp8.c:1247:31: <Offset trace>
1245.                     }
1246.                 } else {    // DCT_CAT3 and up
1247.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                                    ^
1248.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
1249.                     int cat = (a << 1) + b;

libavcodec/vp8.c:1247:31: Call
    1245.                     }
    1246.                 } else {    // DCT_CAT3 and up
    1247.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                                        ^
    1248.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
    1249.                     int cat = (a << 1) + b;

libavcodec/vp56.h:250:15: Assignment
      248.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
      249.     unsigned int low_shift = low << 16;
      250.     int bit = code_word >= low_shift;
                         ^
      251. 
      252.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:250:5: Assignment
      248.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
      249.     unsigned int low_shift = low << 16;
      250.     int bit = code_word >= low_shift;
               ^
      251. 
      252.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:255:5: Assignment
      253.     c->code_word = bit ? code_word - low_shift : code_word;
      254. 
      255.     return bit;
               ^
      256. }
      257. #endif

libavcodec/vp8.c:1247:21: Assignment
    1245.                     }
    1246.                 } else {    // DCT_CAT3 and up
    1247.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                              ^
    1248.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
    1249.                     int cat = (a << 1) + b;

libavcodec/vp8.c:1203:1: <Length trace>
1201.  *         otherwise, the index of the last coeff decoded plus one
1202.  */
1203. static av_always_inline
      ^
1204. int decode_block_coeffs_internal(VP56RangeCoder *r, int16_t block[16],
1205.                                  uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:1203:1: Parameter `*token_prob`
    1201.  *         otherwise, the index of the last coeff decoded plus one
    1202.  */
    1203. static av_always_inline
          ^
    1204. int decode_block_coeffs_internal(VP56RangeCoder *r, int16_t block[16],
    1205.                                  uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:1248:53: Array access: Offset: [9, 10] Size: 3 by call to `vp7_decode_block_coeffs_internal` 
    1246.                 } else {    // DCT_CAT3 and up
    1247.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
    1248.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
                                                              ^
    1249.                     int cat = (a << 1) + b;
    1250.                     coeff  = 3 + (8 << cat);
