libavcodec/vp9.c:801: error: Buffer Overrun L1
  Offset: 2 Size: 2 by call to `ff_vp9_decode_block`.

libavcodec/vp9.c:784:18: Call
782.     } else if (col + hbs < s->cols) {
783.         if (row + hbs < s->rows) {
784.             bp = vp8_rac_get_tree(&s->c, ff_vp9_partition_tree, p);
                      ^
785.             switch (bp) {
786.             case PARTITION_NONE:

libavcodec/vp56.h:385:1: Parameter `(*tree)[*]`
  383. // how probabilities are associated with decisions is different I think
  384. // well, the new scheme fits in the old but this way has one fewer branches per decision
  385. static av_always_inline
       ^
  386. int vp8_rac_get_tree(VP56RangeCoder *c, const int8_t (*tree)[2],
  387.                      const uint8_t *probs)

libavcodec/vp56.h:389:12: Call
  387.                      const uint8_t *probs)
  388. {
  389.     return vp8_rac_get_tree_with_offset(c, tree, probs, 0);
                  ^
  390. }
  391. 

libavcodec/vp56.h:372:1: Parameter `(*tree)[*]`
    370.  * used to save a bit after a 0 token (by disallowing EOB to immediately follow.)
    371.  */
    372. static av_always_inline
         ^
    373. int vp8_rac_get_tree_with_offset(VP56RangeCoder *c, const int8_t (*tree)[2],
    374.                                  const uint8_t *probs, int i)

libavcodec/vp56.h:377:9: Assignment
    375. {
    376.     do {
    377.         i = tree[i][vp56_rac_get_prob(c, probs[i])];
                 ^
    378.     } while (i > 0);
    379. 

libavcodec/vp56.h:380:5: Assignment
    378.     } while (i > 0);
    379. 
    380.     return -i;
             ^
    381. }
    382. 

libavcodec/vp56.h:389:5: Assignment
  387.                      const uint8_t *probs)
  388. {
  389.     return vp8_rac_get_tree_with_offset(c, tree, probs, 0);
           ^
  390. }
  391. 

libavcodec/vp9.c:784:13: Assignment
782.     } else if (col + hbs < s->cols) {
783.         if (row + hbs < s->rows) {
784.             bp = vp8_rac_get_tree(&s->c, ff_vp9_partition_tree, p);
                 ^
785.             switch (bp) {
786.             case PARTITION_NONE:

libavcodec/vp9.c:801:23: Call
799.                 break;
800.             case PARTITION_V:
801.                 ret = ff_vp9_decode_block(avctx, row, col, lflvl, yoff, uvoff,
                           ^
802.                                           bl, bp);
803.                 if (!ret) {

libavcodec/vp9block.c:1572:1: Parameter `bp`
  1570. }
  1571. 
  1572. int ff_vp9_decode_block(AVCodecContext *avctx, int row, int col,
        ^
  1573.                         VP9Filter *lflvl, ptrdiff_t yoff, ptrdiff_t uvoff,
  1574.                         enum BlockLevel bl, enum BlockPartition bp)

libavcodec/vp9block.c:1596:9: Assignment
  1594.         b->bs = bs;
  1595.         b->bl = bl;
  1596.         b->bp = bp;
                ^
  1597.         decode_mode(s, b);
  1598.         b->uvtx = b->tx - (w4 * 2 == (1 << b->tx) || h4 * 2 == (1 << b->tx));

libavcodec/vp9block.c:1597:9: Call
  1595.         b->bl = bl;
  1596.         b->bp = bp;
  1597.         decode_mode(s, b);
                ^
  1598.         b->uvtx = b->tx - (w4 * 2 == (1 << b->tx) || h4 * 2 == (1 << b->tx));
  1599. 

libavcodec/vp9block.c:44:1: <Offset trace>
42. 
43. // differential forward probability updates
44. static void decode_mode(VP9Context *s, VP9Block *const b)
    ^
45. {
46.     static const uint8_t left_ctx[N_BS_SIZES] = {

libavcodec/vp9block.c:44:1: Parameter `s->signbias[*]`
    42. 
    43. // differential forward probability updates
    44. static void decode_mode(VP9Context *s, VP9Block *const b)
        ^
    45. {
    46.     static const uint8_t left_ctx[N_BS_SIZES] = {

libavcodec/vp9block.c:338:17: Assignment
    336.             // memory accesses below
    337.             if (b->comp) { /* two references */
    338.                 int fix_idx = s->signbias[s->fixcompref], var_idx = !fix_idx, c, bit;
                         ^
    339. 
    340.                 b->ref[fix_idx] = s->fixcompref;

libavcodec/vp9block.c:44:1: <Length trace>
42. 
43. // differential forward probability updates
44. static void decode_mode(VP9Context *s, VP9Block *const b)
    ^
45. {
46.     static const uint8_t left_ctx[N_BS_SIZES] = {

libavcodec/vp9block.c:44:1: Parameter `b->ref[*]`
    42. 
    43. // differential forward probability updates
    44. static void decode_mode(VP9Context *s, VP9Block *const b)
        ^
    45. {
    46.     static const uint8_t left_ctx[N_BS_SIZES] = {

libavcodec/vp9block.c:340:17: Array access: Offset: 2 Size: 2 by call to `ff_vp9_decode_block` 
    338.                 int fix_idx = s->signbias[s->fixcompref], var_idx = !fix_idx, c, bit;
    339. 
    340.                 b->ref[fix_idx] = s->fixcompref;
                         ^
    341.                 // FIXME can this codeblob be replaced by some sort of LUT?
    342.                 if (have_a) {
