libavcodec/vp6.c:286: error: Buffer Overrun L2
  Offset: [0, 10] Size: 6 by call to `vp6_build_huff_tree`.

libavcodec/vp6.c:235:1: Parameter `s->modelp->coeff_ract[*][*][*]`
233. }
234. 
235. static void vp6_parse_coeff_models(VP56Context *s)
     ^
236. {
237.     VP56RangeCoder *c = &s->c;

libavcodec/vp6.c:286:21: Call
284.             for (ct=0; ct<3; ct++)
285.                 for (cg = 0; cg < 6; cg++)
286.                     vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
                         ^
287.                                         vp6_huff_coeff_map, 12,
288.                                         &s->ract_vlc[pt][ct][cg]);

libavcodec/vp6.c:215:1: <Offset trace>
213. }
214. 
215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     ^
216.                                 const uint8_t *map, unsigned size, VLC *vlc)
217. {

libavcodec/vp6.c:215:1: Parameter `size`
  213. }
  214. 
  215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
       ^
  216.                                 const uint8_t *map, unsigned size, VLC *vlc)
  217. {

libavcodec/vp6.c:215:1: <Length trace>
213. }
214. 
215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     ^
216.                                 const uint8_t *map, unsigned size, VLC *vlc)
217. {

libavcodec/vp6.c:215:1: Parameter `*coeff_model`
  213. }
  214. 
  215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
       ^
  216.                                 const uint8_t *map, unsigned size, VLC *vlc)
  217. {

libavcodec/vp6.c:224:35: Array access: Offset: [0, 10] Size: 6 by call to `vp6_build_huff_tree` 
  222.     tmp[0].count = 256;
  223.     for (i=0; i<size-1; i++) {
  224.         a = tmp[i].count *        coeff_model[i]  >> 8;
                                         ^
  225.         b = tmp[i].count * (255 - coeff_model[i]) >> 8;
  226.         nodes[map[2*i  ]].count = a + !a;
