libavcodec/vp6.c:280: error: Buffer Overrun L2
  Offset: [0, 11] (⇐ [0, 1] + [0, 10]) Size: 2 by call to `vp6_build_huff_tree`.

libavcodec/vp6.c:235:1: Parameter `s->modelp->coeff_dccv[*]`
233. }
234. 
235. static void vp6_parse_coeff_models(VP56Context *s)
     ^
236. {
237.     VP56RangeCoder *c = &s->c;

libavcodec/vp6.c:280:13: Call
278.     if (s->use_huffman) {
279.         for (pt=0; pt<2; pt++) {
280.             vp6_build_huff_tree(s, model->coeff_dccv[pt],
                 ^
281.                                 vp6_huff_coeff_map, 12, &s->dccv_vlc[pt]);
282.             vp6_build_huff_tree(s, model->coeff_runv[pt],

libavcodec/vp6.c:215:1: <Offset trace>
213. }
214. 
215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     ^
216.                                 const uint8_t *map, unsigned size, VLC *vlc)
217. {

libavcodec/vp6.c:215:1: Parameter `size`
  213. }
  214. 
  215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
       ^
  216.                                 const uint8_t *map, unsigned size, VLC *vlc)
  217. {

libavcodec/vp6.c:215:1: <Length trace>
213. }
214. 
215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
     ^
216.                                 const uint8_t *map, unsigned size, VLC *vlc)
217. {

libavcodec/vp6.c:215:1: Parameter `*coeff_model`
  213. }
  214. 
  215. static void vp6_build_huff_tree(VP56Context *s, uint8_t coeff_model[],
       ^
  216.                                 const uint8_t *map, unsigned size, VLC *vlc)
  217. {

libavcodec/vp6.c:224:35: Array access: Offset: [0, 11] (⇐ [0, 1] + [0, 10]) Size: 2 by call to `vp6_build_huff_tree` 
  222.     tmp[0].count = 256;
  223.     for (i=0; i<size-1; i++) {
  224.         a = tmp[i].count *        coeff_model[i]  >> 8;
                                         ^
  225.         b = tmp[i].count * (255 - coeff_model[i]) >> 8;
  226.         nodes[map[2*i  ]].count = a + !a;
