libavcodec/nellymoserdec.c:294: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 128 by call to `get_sample_bits`.

libavcodec/nellymoserdec.c:268:1: Array declaration
266. }
267. 
268. static void nelly_decode_block(NellyMoserDecodeContext *s,
     ^
269.                                const unsigned char block[NELLY_BLOCK_LEN],
270.                                float audio[NELLY_SAMPLES])

libavcodec/nellymoserdec.c:294:5: Call
292.     }
293. 
294.     get_sample_bits(buf, bits);
         ^
295. 
296.     for (i = 0; i < 2; i++) {

libavcodec/nellymoserdec.c:256:15: <Offset trace>
254. 
255.     if (bitsum > NELLY_DETAIL_BITS) {
256.         tmp = i = 0;
                   ^
257.         while (tmp < NELLY_DETAIL_BITS) {
258.             tmp += bits[i];

libavcodec/nellymoserdec.c:256:15: Assignment
  254. 
  255.     if (bitsum > NELLY_DETAIL_BITS) {
  256.         tmp = i = 0;
                     ^
  257.         while (tmp < NELLY_DETAIL_BITS) {
  258.             tmp += bits[i];

libavcodec/nellymoserdec.c:158:1: <Length trace>
156. 
157. 
158. static void get_sample_bits(const float *buf, int *bits)
     ^
159. {
160.     int i, j;

libavcodec/nellymoserdec.c:158:1: Parameter `*bits`
  156. 
  157. 
  158. static void get_sample_bits(const float *buf, int *bits)
       ^
  159. {
  160.     int i, j;

libavcodec/nellymoserdec.c:262:9: Array access: Offset: [-1, +oo] Size: 128 by call to `get_sample_bits` 
  260.         }
  261. 
  262.         bits[i-1] -= tmp - NELLY_DETAIL_BITS;
               ^
  263.         for(; i < NELLY_FILL_LEN; i++)
  264.             bits[i] = 0;
