libavcodec/vp6.c:276: error: Buffer Overrun L2
  Offset: [0, 11] (⇐ [0, 1] + [0, 10]) Size: 2 by call to `vp6_build_huff_tree`.

libavcodec/vp6.c:231:1: Parameter `s->modelp->coeff_dccv[*]`
229. }
230. 
231. static void vp6_parse_coeff_models(vp56_context_t *s)
     ^
232. {
233.     vp56_range_coder_t *c = &s->c;

libavcodec/vp6.c:276:13: Call
274.     if (s->use_huffman) {
275.         for (pt=0; pt<2; pt++) {
276.             vp6_build_huff_tree(s, model->coeff_dccv[pt],
                 ^
277.                                 vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]);
278.             vp6_build_huff_tree(s, model->coeff_runv[pt],

libavcodec/vp6.c:211:1: <Offset trace>
209. }
210. 
211. static void vp6_build_huff_tree(vp56_context_t *s, uint8_t coeff_model[],
     ^
212.                                 const uint8_t *map, unsigned size, VLC *vlc)
213. {

libavcodec/vp6.c:211:1: Parameter `size`
  209. }
  210. 
  211. static void vp6_build_huff_tree(vp56_context_t *s, uint8_t coeff_model[],
       ^
  212.                                 const uint8_t *map, unsigned size, VLC *vlc)
  213. {

libavcodec/vp6.c:211:1: <Length trace>
209. }
210. 
211. static void vp6_build_huff_tree(vp56_context_t *s, uint8_t coeff_model[],
     ^
212.                                 const uint8_t *map, unsigned size, VLC *vlc)
213. {

libavcodec/vp6.c:211:1: Parameter `*coeff_model`
  209. }
  210. 
  211. static void vp6_build_huff_tree(vp56_context_t *s, uint8_t coeff_model[],
       ^
  212.                                 const uint8_t *map, unsigned size, VLC *vlc)
  213. {

libavcodec/vp6.c:220:35: Array access: Offset: [0, 11] (⇐ [0, 1] + [0, 10]) Size: 2 by call to `vp6_build_huff_tree` 
  218.     tmp[0].count = 256;
  219.     for (i=0; i<size-1; i++) {
  220.         a = tmp[i].count *        coeff_model[i]  >> 8;
                                         ^
  221.         b = tmp[i].count * (255 - coeff_model[i]) >> 8;
  222.         nodes[map[2*i  ]].count = a + !a;
