libavutil/aes.c:102: error: Buffer Overrun L1
  Offset: -2 Size: 4 by call to `crypt`.

libavutil/aes.c:102:13: Call
100.         }else{
101.             if(iv) addkey(a->state[1], a->state[1], iv);
102.             crypt(a, 2,     sbox, enc_multbl);
                 ^
103.             addkey(dst, a->state[0], a->round_key[0]);
104.             if(iv) memcpy(iv, dst, 16);

libavutil/aes.c:80:1: Parameter `s`
  78. }
  79. 
  80. static inline void crypt(AVAES *a, int s, const uint8_t *sbox, uint32_t multbl[][256]){
      ^
  81.     int r;
  82. 

libavutil/aes.c:87:5: Call
  85.         addkey(a->state[1], a->state[0], a->round_key[r]);
  86.     }
  87.     subshift(a->state[0][0], s, sbox);
          ^
  88. }
  89. 

libavutil/aes.c:55:1: <Length trace>
53. }
54. 
55. static void subshift(uint8_t s0[2][16], int s, const uint8_t *box){
    ^
56.     uint8_t (*s1)[16]= s0[0] - s;
57.     uint8_t (*s3)[16]= s0[0] + s;

libavutil/aes.c:55:1: Parameter `s`
    53. }
    54. 
    55. static void subshift(uint8_t s0[2][16], int s, const uint8_t *box){
        ^
    56.     uint8_t (*s1)[16]= s0[0] - s;
    57.     uint8_t (*s3)[16]= s0[0] + s;

libavutil/aes.c:56:5: Assignment
    54. 
    55. static void subshift(uint8_t s0[2][16], int s, const uint8_t *box){
    56.     uint8_t (*s1)[16]= s0[0] - s;
            ^
    57.     uint8_t (*s3)[16]= s0[0] + s;
    58.     s0[0][0]=box[s0[1][ 0]]; s0[0][ 4]=box[s0[1][ 4]]; s0[0][ 8]=box[s0[1][ 8]]; s0[0][12]=box[s0[1][12]];

libavutil/aes.c:59:5: Array access: Offset: -2 Size: 4 by call to `crypt` 
    57.     uint8_t (*s3)[16]= s0[0] + s;
    58.     s0[0][0]=box[s0[1][ 0]]; s0[0][ 4]=box[s0[1][ 4]]; s0[0][ 8]=box[s0[1][ 8]]; s0[0][12]=box[s0[1][12]];
    59.     s1[0][3]=box[s1[1][ 7]]; s1[0][ 7]=box[s1[1][11]]; s1[0][11]=box[s1[1][15]]; s1[0][15]=box[s1[1][ 3]];
            ^
    60.     s0[0][2]=box[s0[1][10]]; s0[0][10]=box[s0[1][ 2]]; s0[0][ 6]=box[s0[1][14]]; s0[0][14]=box[s0[1][ 6]];
    61.     s3[0][1]=box[s3[1][13]]; s3[0][13]=box[s3[1][ 9]]; s3[0][ 9]=box[s3[1][ 5]]; s3[0][ 5]=box[s3[1][ 1]];
