libavcodec/hevc.c:2786: error: Buffer Overrun L3
  Offset: [-2, +oo] Size: 4 by call to `decode_nal_units`.

libavcodec/hevc.c:2786:14: Call
2784. 
2785.     s->ref = NULL;
2786.     ret    = decode_nal_units(s, avpkt->data, avpkt->size);
                   ^
2787.     if (ret < 0)
2788.         return ret;

libavcodec/hevc.c:2606:1: Parameter `s->sps->log2_ctb_size`
  2604. }
  2605. 
  2606. static int decode_nal_units(HEVCContext *s, const uint8_t *buf, int length)
        ^
  2607. {
  2608.     int i, consumed, ret = 0;

libavcodec/hevc.c:2683:19: Call
  2681.     /* parse the NAL units */
  2682.     for (i = 0; i < s->nb_nals; i++) {
  2683.         int ret = decode_nal_unit(s, s->nals[i].data, s->nals[i].size);
                          ^
  2684.         if (ret < 0) {
  2685.             av_log(s->avctx, AV_LOG_WARNING,

libavcodec/hevc.c:2381:1: Parameter `s->sps->log2_ctb_size`
    2379. }
    2380. 
    2381. static int decode_nal_unit(HEVCContext *s, const uint8_t *nal, int length)
          ^
    2382. {
    2383.     HEVCLocalContext *lc = &s->HEVClc;

libavcodec/hevc.c:2481:23: Call
    2479.         }
    2480. 
    2481.         ctb_addr_ts = hls_slice_data(s);
                                ^
    2482.         if (ctb_addr_ts >= (s->sps->ctb_width * s->sps->ctb_height)) {
    2483.             s->is_decoded = 1;

libavcodec/hevc.c:2237:1: Parameter `s->sps->log2_ctb_size`
      2235. }
      2236. 
      2237. static int hls_slice_data(HEVCContext *s)
            ^
      2238. {
      2239.     int ctb_size    = 1 << s->sps->log2_ctb_size;

libavcodec/hevc.c:2261:15: Call
      2259.         s->filter_slice_edges[ctb_addr_rs]  = s->sh.slice_loop_filter_across_slices_enabled_flag;
      2260. 
      2261.         ret = hls_coding_quadtree(s, x_ctb, y_ctb, s->sps->log2_ctb_size, 0);
                          ^
      2262.         if (ret < 0)
      2263.             return ret;

libavcodec/hevc.c:2132:1: Parameter `log2_cb_size`
        2130. }
        2131. 
        2132. static int hls_coding_quadtree(HEVCContext *s, int x0, int y0,
              ^
        2133.                                int log2_cb_size, int cb_depth)
        2134. {

libavcodec/hevc.c:2176:19: Call
        2174.         SUBDIVIDE(x1, y1);
        2175.     } else {
        2176.         int ret = hls_coding_unit(s, x0, y0, log2_cb_size);
                                ^
        2177.         if (ret < 0)
        2178.             return ret;

libavcodec/hevc.c:1982:1: Parameter `log2_cb_size`
          1980. }
          1981. 
          1982. static int hls_coding_unit(HEVCContext *s, int x0, int y0, int log2_cb_size)
                ^
          1983. {
          1984.     int cb_size          = 1 << log2_cb_size;

libavcodec/hevc.c:2107:17: Call
          2105.                                          s->sps->max_transform_hierarchy_depth_intra + lc->cu.intra_split_flag :
          2106.                                          s->sps->max_transform_hierarchy_depth_inter;
          2107.                 hls_transform_tree(s, x0, y0, x0, y0, x0, y0, log2_cb_size,
                                ^
          2108.                                    log2_cb_size, 0, 0);
          2109.             } else {

libavcodec/hevc.c:1272:1: Parameter `log2_trafo_size`
            1270. }
            1271. 
            1272. static void hls_transform_tree(HEVCContext *s, int x0, int y0,
                  ^
            1273.                                int xBase, int yBase, int cb_xBase, int cb_yBase,
            1274.                                int log2_cb_size, int log2_trafo_size,

libavcodec/hevc.c:1352:9: Call
            1350.         }
            1351. 
            1352.         hls_transform_unit(s, x0, y0, xBase, yBase, cb_xBase, cb_yBase,
                          ^
            1353.                            log2_cb_size, log2_trafo_size, trafo_depth, blk_idx);
            1354. 

libavcodec/hevc.c:1182:1: Parameter `log2_trafo_size`
              1180. }
              1181. 
              1182. static void hls_transform_unit(HEVCContext *s, int x0, int y0,
                    ^
              1183.                                int xBase, int yBase, int cb_xBase, int cb_yBase,
              1184.                                int log2_cb_size, int log2_trafo_size,

libavcodec/hevc.c:1242:13: Call
              1240. 
              1241.         if (lc->tt.cbf_luma)
              1242.             hls_residual_coding(s, x0, y0, log2_trafo_size, scan_idx, 0);
                                ^
              1243.         if (log2_trafo_size > 2) {
              1244.             if (SAMPLE_CBF(lc->tt.cbf_cb[trafo_depth], x0, y0))

libavcodec/hevc.c:833:1: <Offset trace>
831. #undef CTB
832. 
833. static void hls_residual_coding(HEVCContext *s, int x0, int y0,
     ^
834.                                 int log2_trafo_size, enum ScanType scan_idx,
835.                                 int c_idx)

libavcodec/hevc.c:833:1: Parameter `log2_trafo_size`
                831. #undef CTB
                832. 
                833. static void hls_residual_coding(HEVCContext *s, int x0, int y0,
                     ^
                834.                                 int log2_trafo_size, enum ScanType scan_idx,
                835.                                 int c_idx)

libavcodec/hevc.c:833:1: <Length trace>
831. #undef CTB
832. 
833. static void hls_residual_coding(HEVCContext *s, int x0, int y0,
     ^
834.                                 int log2_trafo_size, enum ScanType scan_idx,
835.                                 int c_idx)

libavcodec/hevc.c:833:1: Parameter `s->hevcdsp.transquant_bypass[*]`
                831. #undef CTB
                832. 
                833. static void hls_residual_coding(HEVCContext *s, int x0, int y0,
                     ^
                834.                                 int log2_trafo_size, enum ScanType scan_idx,
                835.                                 int c_idx)

libavcodec/hevc.c:1170:9: Array access: Offset: [-2, +oo] Size: 4 by call to `decode_nal_units` 
                1168. 
                1169.     if (lc->cu.cu_transquant_bypass_flag) {
                1170.         s->hevcdsp.transquant_bypass[log2_trafo_size - 2](dst, coeffs, stride);
                              ^
                1171.     } else {
                1172.         if (transform_skip_flag)
