libavcodec/nellymoserdec.c:102: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 128 by call to `ff_nelly_get_sample_bits`.

libavcodec/nellymoserdec.c:76:1: Array declaration
74. }
75. 
76. static void nelly_decode_block(NellyMoserDecodeContext *s,
    ^
77.                                const unsigned char block[NELLY_BLOCK_LEN],
78.                                float audio[NELLY_SAMPLES])

libavcodec/nellymoserdec.c:102:5: Call
100.     }
101. 
102.     ff_nelly_get_sample_bits(buf, bits);
         ^
103. 
104.     for (i = 0; i < 2; i++) {

libavcodec/nellymoser.c:211:15: <Offset trace>
209. 
210.     if (bitsum > NELLY_DETAIL_BITS) {
211.         tmp = i = 0;
                   ^
212.         while (tmp < NELLY_DETAIL_BITS) {
213.             tmp += bits[i];

libavcodec/nellymoser.c:211:15: Assignment
  209. 
  210.     if (bitsum > NELLY_DETAIL_BITS) {
  211.         tmp = i = 0;
                     ^
  212.         while (tmp < NELLY_DETAIL_BITS) {
  213.             tmp += bits[i];

libavcodec/nellymoser.c:114:1: <Length trace>
112. 
113. 
114. void ff_nelly_get_sample_bits(const float *buf, int *bits)
     ^
115. {
116.     int i, j;

libavcodec/nellymoser.c:114:1: Parameter `*bits`
  112. 
  113. 
  114. void ff_nelly_get_sample_bits(const float *buf, int *bits)
       ^
  115. {
  116.     int i, j;

libavcodec/nellymoser.c:217:9: Array access: Offset: [-1, +oo] Size: 128 by call to `ff_nelly_get_sample_bits` 
  215.         }
  216. 
  217.         bits[i-1] -= tmp - NELLY_DETAIL_BITS;
               ^
  218.         for(; i < NELLY_FILL_LEN; i++)
  219.             bits[i] = 0;
