libavcodec/vp6.c:295: error: Buffer Overrun L2
  Offset: [0, 10] Size: 6 by call to `vp6_build_huff_tree`.

libavcodec/vp6.c:242:1: Parameter `s->modelp->coeff_ract[*][*][*]`
240. }
241. 
242. static int vp6_parse_coeff_models(VP56Context *s)
     ^
243. {
244.     VP56RangeCoder *c = &s->c;

libavcodec/vp6.c:295:25: Call
293.             for (ct=0; ct<3; ct++)
294.                 for (cg = 0; cg < 6; cg++)
295.                     if (vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
                             ^
296.                                             vp6_huff_coeff_map, 12,
297.                                             &s->ract_vlc[pt][ct][cg]))

libavcodec/vp6.c:221:1: <Offset trace>
219. }
220. 
221. static int vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     ^
222.                                const uint8_t *map, unsigned size, VLC *vlc)
223. {

libavcodec/vp6.c:221:1: Parameter `size`
  219. }
  220. 
  221. static int vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
       ^
  222.                                const uint8_t *map, unsigned size, VLC *vlc)
  223. {

libavcodec/vp6.c:221:1: <Length trace>
219. }
220. 
221. static int vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     ^
222.                                const uint8_t *map, unsigned size, VLC *vlc)
223. {

libavcodec/vp6.c:221:1: Parameter `*coeff_model`
  219. }
  220. 
  221. static int vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
       ^
  222.                                const uint8_t *map, unsigned size, VLC *vlc)
  223. {

libavcodec/vp6.c:230:35: Array access: Offset: [0, 10] Size: 6 by call to `vp6_build_huff_tree` 
  228.     tmp[0].count = 256;
  229.     for (i=0; i<size-1; i++) {
  230.         a = tmp[i].count *        coeff_model[i]  >> 8;
                                         ^
  231.         b = tmp[i].count * (255 - coeff_model[i]) >> 8;
  232.         nodes[map[2*i  ]].count = a + !a;
