libavcodec/vp6.c:468: error: Buffer Overrun L1
  Offset: [8, 14] (⇐ [0, 1] + [8, 13]) Size: 2.

libavcodec/vp6.c:467:37: <Offset trace>
465.                     run = vp56_rac_get_tree(c, vp6_pcr_tree, model3);
466.                     if (!run)
467.                         for (run=9, i=0; i<6; i++)
                                         ^
468.                             run += vp56_rac_get_prob(c, model3[i+8]) << i;
469.                 }

libavcodec/vp6.c:467:37: Assignment
465.                     run = vp56_rac_get_tree(c, vp6_pcr_tree, model3);
466.                     if (!run)
467.                         for (run=9, i=0; i<6; i++)
                                         ^
468.                             run += vp56_rac_get_prob(c, model3[i+8]) << i;
469.                 }

libavcodec/vp6.c:409:1: <Length trace>
407. }
408. 
409. static void vp6_parse_coeff(VP56Context *s)
     ^
410. {
411.     VP56RangeCoder *c = s->ccp;

libavcodec/vp6.c:409:1: Parameter `s->modelp->coeff_runv[*]`
407. }
408. 
409. static void vp6_parse_coeff(VP56Context *s)
     ^
410. {
411.     VP56RangeCoder *c = s->ccp;

libavcodec/vp6.c:464:21: Assignment
462.                         break;
463. 
464.                     model3 = model->coeff_runv[coeff_idx >= 6];
                         ^
465.                     run = vp56_rac_get_tree(c, vp6_pcr_tree, model3);
466.                     if (!run)

libavcodec/vp6.c:468:57: Array access: Offset: [8, 14] (⇐ [0, 1] + [8, 13]) Size: 2
466.                     if (!run)
467.                         for (run=9, i=0; i<6; i++)
468.                             run += vp56_rac_get_prob(c, model3[i+8]) << i;
                                                             ^
469.                 }
470.             }
