libavcodec/vp56.c:99: error: Buffer Overrun L2
  Offset: [0, 9] Size: 3.

libavcodec/vp56.c:90:18: <Offset trace>
88.         }
89.         if (vp56_rac_get_prob(c, 254)) {
90.             for (type=0; type<10; type++) {
                     ^
91.                 for(i=0; i<2; i++) {
92.                     if (vp56_rac_get_prob(c, 205)) {

libavcodec/vp56.c:90:18: Assignment
88.         }
89.         if (vp56_rac_get_prob(c, 254)) {
90.             for (type=0; type<10; type++) {
                     ^
91.                 for(i=0; i<2; i++) {
92.                     if (vp56_rac_get_prob(c, 205)) {

libavcodec/vp56.c:76:1: <Length trace>
74. }
75. 
76. static void vp56_parse_mb_type_models(VP56Context *s)
    ^
77. {
78.     VP56RangeCoder *c = &s->c;

libavcodec/vp56.c:76:1: Parameter `s->modelp->mb_types_stats[*][*]`
74. }
75. 
76. static void vp56_parse_mb_type_models(VP56Context *s)
    ^
77. {
78.     VP56RangeCoder *c = &s->c;

libavcodec/vp56.c:99:25: Array access: Offset: [0, 9] Size: 3
 97.                         if (!delta)
 98.                             delta = 4 * vp56_rac_gets(c, 7);
 99.                         model->mb_types_stats[ctx][type][i] += (delta ^ -sign) + sign;
                             ^
100.                     }
101.                 }
