libavcodec/vp8.c:882: error: Buffer Overrun L1
  Offset: [9, 10] Size: 3 by call to `decode_block_coeffs_internal`.

libavcodec/vp8.c:874:1: Parameter `(*probs)[*]`
872. #endif
873. 
874. static av_always_inline
     ^
875. int decode_block_coeffs(VP56RangeCoder *c, DCTELEM block[16],
876.                         uint8_t probs[8][3][NUM_DCT_TOKENS-1],

libavcodec/vp8.c:879:5: Assignment
877.                         int i, int zero_nhood, int16_t qmul[2])
878. {
879.     uint8_t *token_prob = probs[i][zero_nhood];
         ^
880.     if (!vp56_rac_get_prob_branchy(c, token_prob[0]))   // DCT_EOB
881.         return 0;

libavcodec/vp8.c:882:12: Call
880.     if (!vp56_rac_get_prob_branchy(c, token_prob[0]))   // DCT_EOB
881.         return 0;
882.     return decode_block_coeffs_internal(c, block, probs, i, token_prob, qmul);
                ^
883. }
884. 

libavcodec/vp8.c:858:29: <Offset trace>
856.                     }
857.                 } else {    // DCT_CAT3 and up
858.                     int a = vp56_rac_get_prob(c, token_prob[8]);
                                 ^
859.                     int b = vp56_rac_get_prob(c, token_prob[9+a]);
860.                     int cat = (a<<1) + b;

libavcodec/vp8.c:858:29: Call
  856.                     }
  857.                 } else {    // DCT_CAT3 and up
  858.                     int a = vp56_rac_get_prob(c, token_prob[8]);
                                   ^
  859.                     int b = vp56_rac_get_prob(c, token_prob[9+a]);
  860.                     int cat = (a<<1) + b;

libavcodec/vp56.h:217:15: Assignment
    215.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
    216.     unsigned int low_shift = low << 16;
    217.     int bit = code_word >= low_shift;
                       ^
    218. 
    219.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:217:5: Assignment
    215.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
    216.     unsigned int low_shift = low << 16;
    217.     int bit = code_word >= low_shift;
             ^
    218. 
    219.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:222:5: Assignment
    220.     c->code_word = bit ? code_word - low_shift : code_word;
    221. 
    222.     return bit;
             ^
    223. }
    224. #endif

libavcodec/vp8.c:858:21: Assignment
  856.                     }
  857.                 } else {    // DCT_CAT3 and up
  858.                     int a = vp56_rac_get_prob(c, token_prob[8]);
                           ^
  859.                     int b = vp56_rac_get_prob(c, token_prob[9+a]);
  860.                     int cat = (a<<1) + b;

libavcodec/vp8.c:820:1: <Length trace>
818.  *         otherwise, the index of the last coeff decoded plus one
819.  */
820. static int decode_block_coeffs_internal(VP56RangeCoder *c, DCTELEM block[16],
     ^
821.                                         uint8_t probs[8][3][NUM_DCT_TOKENS-1],
822.                                         int i, uint8_t *token_prob, int16_t qmul[2])

libavcodec/vp8.c:820:1: Parameter `*token_prob`
  818.  *         otherwise, the index of the last coeff decoded plus one
  819.  */
  820. static int decode_block_coeffs_internal(VP56RangeCoder *c, DCTELEM block[16],
       ^
  821.                                         uint8_t probs[8][3][NUM_DCT_TOKENS-1],
  822.                                         int i, uint8_t *token_prob, int16_t qmul[2])

libavcodec/vp8.c:859:50: Array access: Offset: [9, 10] Size: 3 by call to `decode_block_coeffs_internal` 
  857.                 } else {    // DCT_CAT3 and up
  858.                     int a = vp56_rac_get_prob(c, token_prob[8]);
  859.                     int b = vp56_rac_get_prob(c, token_prob[9+a]);
                                                        ^
  860.                     int cat = (a<<1) + b;
  861.                     coeff  = 3 + (8<<cat);
