libavcodec/snow.c:3608: error: Buffer Overrun L2
  Offset: [-oo, 4] Size: 4.

libavcodec/snow.c:3603:24: <Offset trace>
3601.                 Plane *p= &s->plane[plane_index];
3602.                 p->diag_mc= get_rac(&s->c, s->header_state);
3603.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                             ^
3604.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3605.                     return -1;

libavcodec/snow.c:3603:24: Call
3601.                 Plane *p= &s->plane[plane_index];
3602.                 p->diag_mc= get_rac(&s->c, s->header_state);
3603.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                             ^
3604.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3605.                     return -1;

libavcodec/snow.c:659:9: Assignment
  657. static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){
  658.     if(get_rac(c, state+0))
  659.         return 0;
               ^
  660.     else{
  661.         int i, e, a;

libavcodec/snow.c:3603:17: Assignment
3601.                 Plane *p= &s->plane[plane_index];
3602.                 p->diag_mc= get_rac(&s->c, s->header_state);
3603.                 htaps= get_symbol(&s->c, s->header_state, 0)*2 + 2;
                      ^
3604.                 if((unsigned)htaps > HTAPS_MAX || htaps==0)
3605.                     return -1;

libavcodec/snow.c:3607:21: Assignment
3605.                     return -1;
3606.                 p->htaps= htaps;
3607.                 for(i= htaps/2; i; i--){
                          ^
3608.                     p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
3609.                     sum += p->hcoeff[i];

libavcodec/snow.c:3565:1: <Length trace>
3563.     dst= tmp;
3564. 
3565. static int decode_header(SnowContext *s){
      ^
3566.     int plane_index, tmp;
3567.     uint8_t kstate[32];

libavcodec/snow.c:3565:1: Parameter `s->plane[*].hcoeff[*]`
3563.     dst= tmp;
3564. 
3565. static int decode_header(SnowContext *s){
      ^
3566.     int plane_index, tmp;
3567.     uint8_t kstate[32];

libavcodec/snow.c:3608:21: Array access: Offset: [-oo, 4] Size: 4
3606.                 p->htaps= htaps;
3607.                 for(i= htaps/2; i; i--){
3608.                     p->hcoeff[i]= get_symbol(&s->c, s->header_state, 0) * (1-2*(i&1));
                          ^
3609.                     sum += p->hcoeff[i];
3610.                 }
