libavcodec/ffv1enc.c:787: error: Buffer Overrun L2
  Offset: [256-max(244, `avctx->priv_data->state_transition`), 256] Size: 256 by call to `find_best_state`.

libavcodec/ffv1enc.c:559:1: Parameter `avctx->priv_data->state_transition`
557. }
558. 
559. static av_cold int ffv1_encode_init(AVCodecContext *avctx)
     ^
560. {
561.     FFV1Context *s = avctx->priv_data;

libavcodec/ffv1enc.c:785:9: Call
783.                 break;
784.         }
785.         sort_stt(s, s->state_transition);
             ^
786. 
787.         find_best_state(best_state, s->state_transition);

libavcodec/ffv1enc.c:500:1: Parameter `*stt`
  498. }
  499. 
  500. static int sort_stt(FFV1Context *s, uint8_t stt[256])
       ^
  501. {
  502.     int i, i2, changed, print = 0;

libavcodec/ffv1enc.c:787:9: Call
785.         sort_stt(s, s->state_transition);
786. 
787.         find_best_state(best_state, s->state_transition);
             ^
788. 
789.         for (i = 0; i < s->quant_table_count; i++) {

libavcodec/ffv1enc.c:43:1: <Offset trace>
41. #include "ffv1.h"
42. 
43. static void find_best_state(uint8_t best_state[256][256],
    ^
44.                             const uint8_t one_state[256])
45. {

libavcodec/ffv1enc.c:43:1: Parameter `*one_state`
  41. #include "ffv1.h"
  42. 
  43. static void find_best_state(uint8_t best_state[256][256],
      ^
  44.                             const uint8_t one_state[256])
  45. {

libavcodec/ffv1enc.c:43:1: <Length trace>
41. #include "ffv1.h"
42. 
43. static void find_best_state(uint8_t best_state[256][256],
    ^
44.                             const uint8_t one_state[256])
45. {

libavcodec/ffv1enc.c:43:1: Array declaration
  41. #include "ffv1.h"
  42. 
  43. static void find_best_state(uint8_t best_state[256][256],
      ^
  44.                             const uint8_t one_state[256])
  45. {

libavcodec/ffv1enc.c:77:25: Array access: Offset: [256-max(244, avctx->priv_data->state_transition), 256] Size: 256 by call to `find_best_state` 
  75.                     if (occ[m]) {
  76.                         newocc[one_state[m]]             += occ[m] * p;
  77.                         newocc[256 - one_state[256 - m]] += occ[m] * (1 - p);
                              ^
  78.                     }
  79.                 memcpy(occ, newocc, sizeof(occ));
