libavformat/avidec.c:718: error: Buffer Overrun L2
  Offset: [0, 7] Size: 3 by call to `dv_produce_packet`.

libavformat/avidec.c:709:13: Assignment
707. 
708.         if(ast->has_pal && pkt->data && pkt->size<(unsigned)INT_MAX/2){
709.             ast->has_pal=0;
                 ^
710.             pkt->size += 4*256;
711.             pkt->data = av_realloc(pkt->data, pkt->size + FF_INPUT_BUFFER_PADDING_SIZE);

libavformat/avidec.c:718:20: Call
716.         if (ENABLE_DV_DEMUXER && avi->dv_demux) {
717.             dstr = pkt->destruct;
718.             size = dv_produce_packet(avi->dv_demux, pkt,
                        ^
719.                                     pkt->data, pkt->size);
720.             pkt->destruct = dstr;

libavformat/dv.c:315:1: Parameter `*buf`
  313. }
  314. 
  315. int dv_produce_packet(DVDemuxContext *c, AVPacket *pkt,
       ^
  316.                       uint8_t* buf, int buf_size)
  317. {

libavformat/dv.c:322:20: Call
  320. 
  321.     if (buf_size < DV_PROFILE_BYTES ||
  322.         !(c->sys = dv_frame_profile(buf)) ||
                          ^
  323.         buf_size < c->sys->frame_size) {
  324.           return -1;   /* Broken frame, or not enough data */

libavcodec/dvdata.h:6376:1: Parameter `*frame`
    6374. #define DV_MAX_BPM 8
    6375. 
    6376. static inline const DVprofile* dv_frame_profile(const uint8_t* frame)
          ^
    6377. {
    6378.    int i;

libavformat/dv.c:335:5: Call
  333.        ppcm[i] = c->audio_buf[i];
  334.     }
  335.     dv_extract_audio(buf, ppcm, c->sys);
           ^
  336.     c->abytes += size;
  337. 

libavformat/dv.c:102:1: <Offset trace>
100.  *    are converted into 16bit linear ones.
101.  */
102. static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
     ^
103.                             const DVprofile *sys)
104. {

libavformat/dv.c:102:1: Parameter `*frame`
    100.  *    are converted into 16bit linear ones.
    101.  */
    102. static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
         ^
    103.                             const DVprofile *sys)
    104. {

libavformat/dv.c:110:15: Call
    108.     uint8_t *pcm, ipcm;
    109. 
    110.     as_pack = dv_extract_pack(frame, dv_audio_source);
                       ^
    111.     if (!as_pack)    /* No audio ? */
    112.         return 0;

libavformat/dv.c:73:1: Parameter `t`
      71.  * to have a fallback mechanism for complete search of missing packs.
      72.  */
      73. static const uint8_t* dv_extract_pack(uint8_t* frame, enum dv_pack_type t)
          ^
      74. {
      75.     int offs;

libavformat/dv.c:115:5: Assignment
    113. 
    114.     smpls = as_pack[1] & 0x3f; /* samples in this frame - min. samples */
    115.     freq = (as_pack[4] >> 3) & 0x07; /* 0 - 48kHz, 1 - 44,1kHz, 2 - 32kHz */
             ^
    116.     quant = as_pack[4] & 0x07; /* 0 - 16bit linear, 1 - 12bit nonlinear */
    117. 

libavformat/dv.c:102:1: <Length trace>
100.  *    are converted into 16bit linear ones.
101.  */
102. static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
     ^
103.                             const DVprofile *sys)
104. {

libavformat/dv.c:102:1: Parameter `sys->audio_min_samples[*]`
    100.  *    are converted into 16bit linear ones.
    101.  */
    102. static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
         ^
    103.                             const DVprofile *sys)
    104. {

libavformat/dv.c:121:13: Array access: Offset: [0, 7] Size: 3 by call to `dv_produce_packet` 
    119.         return -1; /* Unsupported quantization */
    120. 
    121.     size = (sys->audio_min_samples[freq] + smpls) * 4; /* 2ch, 2bytes */
                     ^
    122.     half_ch = sys->difseg_size/2;
    123. 
