libavcodec/nellymoserdec.c:87: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 128 by call to `ff_nelly_get_sample_bits`.

libavcodec/nellymoserdec.c:61:1: Array declaration
59. } NellyMoserDecodeContext;
60. 
61. static void nelly_decode_block(NellyMoserDecodeContext *s,
    ^
62.                                const unsigned char block[NELLY_BLOCK_LEN],
63.                                float audio[NELLY_SAMPLES])

libavcodec/nellymoserdec.c:87:5: Call
85.     }
86. 
87.     ff_nelly_get_sample_bits(buf, bits);
        ^
88. 
89.     for (i = 0; i < 2; i++) {

libavcodec/nellymoser.c:215:15: <Offset trace>
213. 
214.     if (bitsum > NELLY_DETAIL_BITS) {
215.         tmp = i = 0;
                   ^
216.         while (tmp < NELLY_DETAIL_BITS) {
217.             tmp += bits[i];

libavcodec/nellymoser.c:215:15: Assignment
  213. 
  214.     if (bitsum > NELLY_DETAIL_BITS) {
  215.         tmp = i = 0;
                     ^
  216.         while (tmp < NELLY_DETAIL_BITS) {
  217.             tmp += bits[i];

libavcodec/nellymoser.c:118:1: <Length trace>
116. 
117. 
118. void ff_nelly_get_sample_bits(const float *buf, int *bits)
     ^
119. {
120.     int i, j;

libavcodec/nellymoser.c:118:1: Parameter `*bits`
  116. 
  117. 
  118. void ff_nelly_get_sample_bits(const float *buf, int *bits)
       ^
  119. {
  120.     int i, j;

libavcodec/nellymoser.c:221:9: Array access: Offset: [-1, +oo] Size: 128 by call to `ff_nelly_get_sample_bits` 
  219.         }
  220. 
  221.         bits[i-1] -= tmp - NELLY_DETAIL_BITS;
               ^
  222.         for(; i < NELLY_FILL_LEN; i++)
  223.             bits[i] = 0;
