libavcodec/hevc.c:3122: error: Buffer Overrun L1
  Offset: -1 Size: 7 by call to `set_sps`.

libavcodec/hevc.c:3095:9: Call
3093. 
3094.     for (i = 0; i < FF_ARRAY_ELEMS(s->vps_list); i++) {
3095.         av_buffer_unref(&s->vps_list[i]);
              ^
3096.         if (s0->vps_list[i]) {
3097.             s->vps_list[i] = av_buffer_ref(s0->vps_list[i]);

libavutil/buffer.c:106:1: Parameter `**buf`
  104. }
  105. 
  106. void av_buffer_unref(AVBufferRef **buf)
       ^
  107. {
  108.     AVBuffer *b;

libavcodec/hevc.c:3122:15: Call
3120. 
3121.     if (s->sps != s0->sps)
3122.         ret = set_sps(s, s0->sps);
                    ^
3123. 
3124.     s->seq_decode = s0->seq_decode;

libavcodec/hevc.c:432:1: Parameter `sps->max_sub_layers`
  430. }
  431. 
  432. static int set_sps(HEVCContext *s, const HEVCSPS *sps)
       ^
  433. {
  434.     #define HWACCEL_MAX (CONFIG_HEVC_DXVA2_HWACCEL + CONFIG_HEVC_D3D11VA_HWACCEL)

libavcodec/hevc.c:438:5: Call
  436.     int ret;
  437. 
  438.     export_stream_params(s->avctx, s, sps);
           ^
  439. 
  440.     pic_arrays_free(s);

libavcodec/hevc.c:386:1: <Offset trace>
384. }
385. 
386. static void export_stream_params(AVCodecContext *avctx,
     ^
387.                                  const HEVCContext *s, const HEVCSPS *sps)
388. {

libavcodec/hevc.c:386:1: Parameter `sps->max_sub_layers`
    384. }
    385. 
    386. static void export_stream_params(AVCodecContext *avctx,
         ^
    387.                                  const HEVCContext *s, const HEVCSPS *sps)
    388. {

libavcodec/hevc.c:386:1: <Length trace>
384. }
385. 
386. static void export_stream_params(AVCodecContext *avctx,
     ^
387.                                  const HEVCContext *s, const HEVCSPS *sps)
388. {

libavcodec/hevc.c:386:1: Parameter `sps->temporal_layer[*]`
    384. }
    385. 
    386. static void export_stream_params(AVCodecContext *avctx,
         ^
    387.                                  const HEVCContext *s, const HEVCSPS *sps)
    388. {

libavcodec/hevc.c:397:34: Array access: Offset: -1 Size: 7 by call to `set_sps` 
    395.     avctx->width               = sps->output_width;
    396.     avctx->height              = sps->output_height;
    397.     avctx->has_b_frames        = sps->temporal_layer[sps->max_sub_layers - 1].num_reorder_pics;
                                          ^
    398.     avctx->profile             = sps->ptl.general_ptl.profile_idc;
    399.     avctx->level               = sps->ptl.general_ptl.level_idc;
