libavcodec/hevc.c:2878: error: Buffer Overrun L3
  Offset: [-2, +oo] Size: 4 by call to `decode_nal_units`.

libavcodec/hevc.c:2878:14: Call
2876. 
2877.     s->ref = NULL;
2878.     ret    = decode_nal_units(s, avpkt->data, avpkt->size);
                   ^
2879.     if (ret < 0)
2880.         return ret;

libavcodec/hevc.c:2697:1: Parameter `s->sps->log2_ctb_size`
  2695. }
  2696. 
  2697. static int decode_nal_units(HEVCContext *s, const uint8_t *buf, int length)
        ^
  2698. {
  2699.     int i, consumed, ret = 0;

libavcodec/hevc.c:2774:19: Call
  2772.     /* parse the NAL units */
  2773.     for (i = 0; i < s->nb_nals; i++) {
  2774.         int ret = decode_nal_unit(s, s->nals[i].data, s->nals[i].size);
                          ^
  2775.         if (ret < 0) {
  2776.             av_log(s->avctx, AV_LOG_WARNING,

libavcodec/hevc.c:2462:1: Parameter `s->sps->log2_ctb_size`
    2460. }
    2461. 
    2462. static int decode_nal_unit(HEVCContext *s, const uint8_t *nal, int length)
          ^
    2463. {
    2464.     HEVCLocalContext *lc = &s->HEVClc;

libavcodec/hevc.c:2566:23: Call
    2564.         }
    2565. 
    2566.         ctb_addr_ts = hls_slice_data(s);
                                ^
    2567.         if (ctb_addr_ts >= (s->sps->ctb_width * s->sps->ctb_height)) {
    2568.             s->is_decoded = 1;

libavcodec/hevc.c:2269:1: Parameter `s->sps->log2_ctb_size`
      2267. }
      2268. 
      2269. static int hls_slice_data(HEVCContext *s)
            ^
      2270. {
      2271.     int ctb_size    = 1 << s->sps->log2_ctb_size;

libavcodec/hevc.c:2293:15: Call
      2291.         s->filter_slice_edges[ctb_addr_rs]  = s->sh.slice_loop_filter_across_slices_enabled_flag;
      2292. 
      2293.         ret = hls_coding_quadtree(s, x_ctb, y_ctb, s->sps->log2_ctb_size, 0);
                          ^
      2294.         if (ret < 0)
      2295.             return ret;

libavcodec/hevc.c:2168:1: Parameter `log2_cb_size`
        2166. }
        2167. 
        2168. static int hls_coding_quadtree(HEVCContext *s, int x0, int y0,
              ^
        2169.                                int log2_cb_size, int cb_depth)
        2170. {

libavcodec/hevc.c:2211:19: Call
        2209.         SUBDIVIDE(x1, y1);
        2210.     } else {
        2211.         int ret = hls_coding_unit(s, x0, y0, log2_cb_size);
                                ^
        2212.         if (ret < 0)
        2213.             return ret;

libavcodec/hevc.c:2019:1: Parameter `log2_cb_size`
          2017. }
          2018. 
          2019. static int hls_coding_unit(HEVCContext *s, int x0, int y0, int log2_cb_size)
                ^
          2020. {
          2021.     int cb_size          = 1 << log2_cb_size;

libavcodec/hevc.c:2142:23: Call
          2140.                                          s->sps->max_transform_hierarchy_depth_intra + lc->cu.intra_split_flag :
          2141.                                          s->sps->max_transform_hierarchy_depth_inter;
          2142.                 ret = hls_transform_tree(s, x0, y0, x0, y0, x0, y0,
                                      ^
          2143.                                          log2_cb_size,
          2144.                                          log2_cb_size, 0, 0, 0, 0);

libavcodec/hevc.c:1334:1: Parameter `log2_trafo_size`
            1332. }
            1333. 
            1334. static int hls_transform_tree(HEVCContext *s, int x0, int y0,
                  ^
            1335.                               int xBase, int yBase, int cb_xBase, int cb_yBase,
            1336.                               int log2_cb_size, int log2_trafo_size,

libavcodec/hevc.c:1406:15: Call
            1404.             cbf_luma = ff_hevc_cbf_luma_decode(s, trafo_depth);
            1405. 
            1406.         ret = hls_transform_unit(s, x0, y0, xBase, yBase, cb_xBase, cb_yBase,
                                ^
            1407.                                  log2_cb_size, log2_trafo_size,
            1408.                                  blk_idx, cbf_luma, cbf_cb, cbf_cr);

libavcodec/hevc.c:1233:1: Parameter `log2_trafo_size`
              1231. }
              1232. 
              1233. static int hls_transform_unit(HEVCContext *s, int x0, int y0,
                    ^
              1234.                               int xBase, int yBase, int cb_xBase, int cb_yBase,
              1235.                               int log2_cb_size, int log2_trafo_size,

libavcodec/hevc.c:1303:13: Call
              1301. 
              1302.         if (cbf_luma)
              1303.             hls_residual_coding(s, x0, y0, log2_trafo_size, scan_idx, 0);
                                ^
              1304.         if (log2_trafo_size > 2) {
              1305.             if (cbf_cb)

libavcodec/hevc.c:884:1: <Offset trace>
882. #undef CTB
883. 
884. static void hls_residual_coding(HEVCContext *s, int x0, int y0,
     ^
885.                                 int log2_trafo_size, enum ScanType scan_idx,
886.                                 int c_idx)

libavcodec/hevc.c:884:1: Parameter `log2_trafo_size`
                882. #undef CTB
                883. 
                884. static void hls_residual_coding(HEVCContext *s, int x0, int y0,
                     ^
                885.                                 int log2_trafo_size, enum ScanType scan_idx,
                886.                                 int c_idx)

libavcodec/hevc.c:884:1: <Length trace>
882. #undef CTB
883. 
884. static void hls_residual_coding(HEVCContext *s, int x0, int y0,
     ^
885.                                 int log2_trafo_size, enum ScanType scan_idx,
886.                                 int c_idx)

libavcodec/hevc.c:884:1: Parameter `s->hevcdsp.transquant_bypass[*]`
                882. #undef CTB
                883. 
                884. static void hls_residual_coding(HEVCContext *s, int x0, int y0,
                     ^
                885.                                 int log2_trafo_size, enum ScanType scan_idx,
                886.                                 int c_idx)

libavcodec/hevc.c:1221:9: Array access: Offset: [-2, +oo] Size: 4 by call to `decode_nal_units` 
                1219. 
                1220.     if (lc->cu.cu_transquant_bypass_flag) {
                1221.         s->hevcdsp.transquant_bypass[log2_trafo_size - 2](dst, coeffs, stride);
                              ^
                1222.     } else {
                1223.         if (transform_skip_flag)
