libavcodec/vp8.c:852: error: Buffer Overrun L1
  Offset: [9, 10] Size: 3 by call to `decode_block_coeffs_internal`.

libavcodec/vp8.c:844:1: Parameter `(*probs)[*]`
842.  *         otherwise, the index of the last coeff decoded plus one
843.  */
844. static av_always_inline
     ^
845. int decode_block_coeffs(VP56RangeCoder *c, int16_t block[16],
846.                         uint8_t probs[16][3][NUM_DCT_TOKENS - 1],

libavcodec/vp8.c:849:5: Assignment
847.                         int i, int zero_nhood, int16_t qmul[2])
848. {
849.     uint8_t *token_prob = probs[i][zero_nhood];
         ^
850.     if (!vp56_rac_get_prob_branchy(c, token_prob[0]))   // DCT_EOB
851.         return 0;

libavcodec/vp8.c:852:12: Call
850.     if (!vp56_rac_get_prob_branchy(c, token_prob[0]))   // DCT_EOB
851.         return 0;
852.     return decode_block_coeffs_internal(c, block, probs, i, token_prob, qmul);
                ^
853. }
854. 

libavcodec/vp8.c:815:31: <Offset trace>
813.                     }
814.                 } else {    // DCT_CAT3 and up
815.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                                   ^
816.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
817.                     int cat = (a << 1) + b;

libavcodec/vp8.c:815:31: Call
  813.                     }
  814.                 } else {    // DCT_CAT3 and up
  815.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                                     ^
  816.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
  817.                     int cat = (a << 1) + b;

libavcodec/vp56.h:250:15: Assignment
    248.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
    249.     unsigned int low_shift = low << 16;
    250.     int bit = code_word >= low_shift;
                       ^
    251. 
    252.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:250:5: Assignment
    248.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
    249.     unsigned int low_shift = low << 16;
    250.     int bit = code_word >= low_shift;
             ^
    251. 
    252.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:255:5: Assignment
    253.     c->code_word = bit ? code_word - low_shift : code_word;
    254. 
    255.     return bit;
             ^
    256. }
    257. #endif

libavcodec/vp8.c:815:21: Assignment
  813.                     }
  814.                 } else {    // DCT_CAT3 and up
  815.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
                           ^
  816.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
  817.                     int cat = (a << 1) + b;

libavcodec/vp8.c:775:1: <Length trace>
773.  *         otherwise, the index of the last coeff decoded plus one
774.  */
775. static int decode_block_coeffs_internal(VP56RangeCoder *r, int16_t block[16],
     ^
776.                                         uint8_t probs[16][3][NUM_DCT_TOKENS - 1],
777.                                         int i, uint8_t *token_prob,

libavcodec/vp8.c:775:1: Parameter `*token_prob`
  773.  *         otherwise, the index of the last coeff decoded plus one
  774.  */
  775. static int decode_block_coeffs_internal(VP56RangeCoder *r, int16_t block[16],
       ^
  776.                                         uint8_t probs[16][3][NUM_DCT_TOKENS - 1],
  777.                                         int i, uint8_t *token_prob,

libavcodec/vp8.c:816:53: Array access: Offset: [9, 10] Size: 3 by call to `decode_block_coeffs_internal` 
  814.                 } else {    // DCT_CAT3 and up
  815.                     int a   = vp56_rac_get_prob(&c, token_prob[8]);
  816.                     int b   = vp56_rac_get_prob(&c, token_prob[9 + a]);
                                                           ^
  817.                     int cat = (a << 1) + b;
  818.                     coeff  = 3 + (8 << cat);
