libavcodec/vc1dec.c:3967: error: Buffer Overrun L2
  Offset: [1, 1+max(1, `avctx->priv_data->two_sprites`)] (⇐ [0, max(1, `avctx->priv_data->two_sprites`)] + 1) Size: 2 by call to `vc1_decode_sprites`.

libavcodec/vc1dec.c:3758:1: Parameter `avctx->priv_data->two_sprites`
3756.  * @todo TODO: Handle VC-1 IDUs (Transport level?)
3757.  */
3758. static int vc1_decode_frame(AVCodecContext *avctx,
      ^
3759.                             void *data, int *data_size,
3760.                             AVPacket *avpkt)

libavcodec/vc1dec.c:3967:13: Call
3965.         if (avctx->skip_frame >= AVDISCARD_NONREF) goto end;
3966. #if CONFIG_WMV3IMAGE_DECODER || CONFIG_VC1IMAGE_DECODER
3967.         if (vc1_decode_sprites(v, &s->gb)) goto err;
                  ^
3968. #endif
3969.         *pict = v->sprite_output_frame;

libavcodec/vc1dec.c:3501:1: Parameter `v->two_sprites`
  3499. 
  3500. 
  3501. static int vc1_decode_sprites(VC1Context *v, GetBitContext* gb)
        ^
  3502. {
  3503.     MpegEncContext *s = &v->s;

libavcodec/vc1dec.c:3507:5: Call
  3505.     SpriteData sd;
  3506. 
  3507.     vc1_parse_sprites(v, gb, &sd);
            ^
  3508. 
  3509.     if (!s->current_picture.f.data[0]) {

libavcodec/vc1dec.c:3341:1: Parameter `sd->coefs[*]`
    3339. }
    3340. 
    3341. static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)
          ^
    3342. {
    3343.     AVCodecContext *avctx = v->s.avctx;

libavcodec/vc1dec.c:3347:9: Call
    3345. 
    3346.     for (sprite = 0; sprite <= v->two_sprites; sprite++) {
    3347.         vc1_sprite_parse_transform(gb, sd->coefs[sprite]);
                  ^
    3348.         if (sd->coefs[sprite][1] || sd->coefs[sprite][3])
    3349.             av_log_ask_for_sample(avctx, "Rotation coefficients are not zero");

libavcodec/vc1dec.c:3307:1: <Length trace>
3305. }
3306. 
3307. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      ^
3308. {
3309.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:3307:1: Parameter `*c`
      3305. }
      3306. 
      3307. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
            ^
      3308. {
      3309.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:3309:5: Array access: Offset: [1, 1+max(1, avctx->priv_data->two_sprites)] (⇐ [0, max(1, avctx->priv_data->two_sprites)] + 1) Size: 2 by call to `vc1_decode_sprites` 
      3307. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      3308. {
      3309.     c[1] = c[3] = 0;
                ^
      3310. 
      3311.     switch (get_bits(gb, 2)) {
