libavcodec/vc1dec.c:5646: error: Buffer Overrun L2
  Offset: [1, 1+max(1, `avctx->priv_data->two_sprites`)] (⇐ [0, max(1, `avctx->priv_data->two_sprites`)] + 1) Size: 2 by call to `vc1_decode_sprites`.

libavcodec/vc1dec.c:5309:1: Parameter `avctx->priv_data->two_sprites`
5307.  * @todo TODO: Handle VC-1 IDUs (Transport level?)
5308.  */
5309. static int vc1_decode_frame(AVCodecContext *avctx, void *data,
      ^
5310.                             int *got_frame, AVPacket *avpkt)
5311. {

libavcodec/vc1dec.c:5646:13: Call
5644.             goto end;
5645. #if CONFIG_WMV3IMAGE_DECODER || CONFIG_VC1IMAGE_DECODER
5646.         if (vc1_decode_sprites(v, &s->gb))
                  ^
5647.             goto err;
5648. #endif

libavcodec/vc1dec.c:5009:1: Parameter `v->two_sprites`
  5007. 
  5008. 
  5009. static int vc1_decode_sprites(VC1Context *v, GetBitContext* gb)
        ^
  5010. {
  5011.     MpegEncContext *s     = &v->s;

libavcodec/vc1dec.c:5015:5: Call
  5013.     SpriteData sd;
  5014. 
  5015.     vc1_parse_sprites(v, gb, &sd);
            ^
  5016. 
  5017.     if (!s->current_picture.f.data[0]) {

libavcodec/vc1dec.c:4845:1: Parameter `sd->coefs[*]`
    4843. }
    4844. 
    4845. static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd)
          ^
    4846. {
    4847.     AVCodecContext *avctx = v->s.avctx;

libavcodec/vc1dec.c:4851:9: Call
    4849. 
    4850.     for (sprite = 0; sprite <= v->two_sprites; sprite++) {
    4851.         vc1_sprite_parse_transform(gb, sd->coefs[sprite]);
                  ^
    4852.         if (sd->coefs[sprite][1] || sd->coefs[sprite][3])
    4853.             avpriv_request_sample(avctx, "Non-zero rotation coefficients");

libavcodec/vc1dec.c:4811:1: <Length trace>
4809. }
4810. 
4811. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      ^
4812. {
4813.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:4811:1: Parameter `*c`
      4809. }
      4810. 
      4811. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
            ^
      4812. {
      4813.     c[1] = c[3] = 0;

libavcodec/vc1dec.c:4813:5: Array access: Offset: [1, 1+max(1, avctx->priv_data->two_sprites)] (⇐ [0, max(1, avctx->priv_data->two_sprites)] + 1) Size: 2 by call to `vc1_decode_sprites` 
      4811. static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7])
      4812. {
      4813.     c[1] = c[3] = 0;
                ^
      4814. 
      4815.     switch (get_bits(gb, 2)) {
