libavcodec/vp6.c:282: error: Buffer Overrun L2
  Offset: [0, 10] Size: 6 by call to `vp6_build_huff_tree`.

libavcodec/vp6.c:231:1: Parameter `s->modelp->coeff_ract[*][*][*]`
229. }
230. 
231. static void vp6_parse_coeff_models(vp56_context_t *s)
     ^
232. {
233.     vp56_range_coder_t *c = &s->c;

libavcodec/vp6.c:282:21: Call
280.             for (ct=0; ct<3; ct++)
281.                 for (cg = 0; cg < 6; cg++)
282.                     vp6_build_huff_tree(s, model->coeff_ract[pt][ct][cg],
                         ^
283.                                         vp6_huff_coeff_map, 12,
284.                                         &s->ract_vlc[pt][ct][cg]);

libavcodec/vp6.c:211:1: <Offset trace>
209. }
210. 
211. static void vp6_build_huff_tree(vp56_context_t *s, uint8_t coeff_model[],
     ^
212.                                 const uint8_t *map, unsigned size, VLC *vlc)
213. {

libavcodec/vp6.c:211:1: Parameter `size`
  209. }
  210. 
  211. static void vp6_build_huff_tree(vp56_context_t *s, uint8_t coeff_model[],
       ^
  212.                                 const uint8_t *map, unsigned size, VLC *vlc)
  213. {

libavcodec/vp6.c:211:1: <Length trace>
209. }
210. 
211. static void vp6_build_huff_tree(vp56_context_t *s, uint8_t coeff_model[],
     ^
212.                                 const uint8_t *map, unsigned size, VLC *vlc)
213. {

libavcodec/vp6.c:211:1: Parameter `*coeff_model`
  209. }
  210. 
  211. static void vp6_build_huff_tree(vp56_context_t *s, uint8_t coeff_model[],
       ^
  212.                                 const uint8_t *map, unsigned size, VLC *vlc)
  213. {

libavcodec/vp6.c:220:35: Array access: Offset: [0, 10] Size: 6 by call to `vp6_build_huff_tree` 
  218.     tmp[0].count = 256;
  219.     for (i=0; i<size-1; i++) {
  220.         a = tmp[i].count *        coeff_model[i]  >> 8;
                                         ^
  221.         b = tmp[i].count * (255 - coeff_model[i]) >> 8;
  222.         nodes[map[2*i  ]].count = a + !a;
