libavcodec/vc1dec.c:5749: error: Buffer Overrun L2
  Offset: [1, 1+max(1, `avctx->priv_data->two_sprites`)] (⇐ [0, max(1, `avctx->priv_data->two_sprites`)] + 1) Size: 2 by call to `vc1_decode_sprites`.

libavcodec/vc1dec.c:5436:1: Parameter `avctx->priv_data->two_sprites`
5434.  * @todo TODO: Handle VC-1 IDUs (Transport level?)
5435.  */
5436. static int vc1_decode_frame(AVCodecContext *avctx, void *data,
      ^
5437.                             int *data_size, AVPacket *avpkt)
5438. {

libavcodec/vc1dec.c:5749:13: Call
5747.             goto end;
5748. #if CONFIG_WMV3IMAGE_DECODER || CONFIG_VC1IMAGE_DECODER
5749.         if (vc1_decode_sprites(v, &s->gb))
                  ^
5750.             goto err;
5751. #endif

libavcodec/vc1dec.c:5133:1: Parameter `v->two_sprites`
  5131. 
  5132. 
  5133. static int vc1_decode_sprites(VC1Context *v, GetBitContext* gb)
        ^
  5134. {
  5135.     MpegEncContext *s     = &v->s;

libavcodec/vc1dec.c:5139:5: Call
  5137.     SpriteData sd;
  5138. 
  5139.     vc1_parse_sprites(v, gb, &sd);
            ^
  5140. 
  5141.     if (!s->current_picture.f.data[0]) {

libavcodec/vc1dec.c:4973:1: Parameter `sd->coefs[*]`
    4971. }
    4972. 
    4973. static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)
          ^
    4974. {
    4975.     AVCodecContext *avctx = v->s.avctx;

libavcodec/vc1dec.c:4979:9: Call
    4977. 
    4978.     for (sprite = 0; sprite <= v->two_sprites; sprite++) {
    4979.         vc1_sprite_parse_transform(gb, sd->coefs[sprite]);
                  ^
    4980.         if (sd->coefs[sprite][1] || sd->coefs[sprite][3])
    4981.             av_log_ask_for_sample(avctx, "Rotation coefficients are not zero");

libavcodec/vc1dec.c:4939:1: <Length trace>
4937. }
4938. 
4939. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      ^
4940. {
4941.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:4939:1: Parameter `*c`
      4937. }
      4938. 
      4939. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
            ^
      4940. {
      4941.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:4941:5: Array access: Offset: [1, 1+max(1, avctx->priv_data->two_sprites)] (⇐ [0, max(1, avctx->priv_data->two_sprites)] + 1) Size: 2 by call to `vc1_decode_sprites` 
      4939. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      4940. {
      4941.     c[1] = c[3] = 0;
                ^
      4942. 
      4943.     switch (get_bits(gb, 2)) {
