libavcodec/vp8.c:750: error: Buffer Overrun L1
  Offset: [9, 10] Size: 3.

libavcodec/vp8.c:749:29: <Offset trace>
747.                     }
748.                 } else {    // DCT_CAT3 and up
749.                     int a = vp56_rac_get_prob(&c, token_prob[8]);
                                 ^
750.                     int b = vp56_rac_get_prob(&c, token_prob[9+a]);
751.                     int cat = (a<<1) + b;

libavcodec/vp8.c:749:29: Call
747.                     }
748.                 } else {    // DCT_CAT3 and up
749.                     int a = vp56_rac_get_prob(&c, token_prob[8]);
                                 ^
750.                     int b = vp56_rac_get_prob(&c, token_prob[9+a]);
751.                     int cat = (a<<1) + b;

libavcodec/vp56.h:218:15: Assignment
  216.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
  217.     unsigned int low_shift = low << 16;
  218.     int bit = code_word >= low_shift;
                     ^
  219. 
  220.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:218:5: Assignment
  216.     unsigned int low = 1 + (((c->high - 1) * prob) >> 8);
  217.     unsigned int low_shift = low << 16;
  218.     int bit = code_word >= low_shift;
           ^
  219. 
  220.     c->high = bit ? c->high - low : low;

libavcodec/vp56.h:223:5: Assignment
  221.     c->code_word = bit ? code_word - low_shift : code_word;
  222. 
  223.     return bit;
           ^
  224. }
  225. #endif

libavcodec/vp8.c:749:21: Assignment
747.                     }
748.                 } else {    // DCT_CAT3 and up
749.                     int a = vp56_rac_get_prob(&c, token_prob[8]);
                         ^
750.                     int b = vp56_rac_get_prob(&c, token_prob[9+a]);
751.                     int cat = (a<<1) + b;

libavcodec/vp8.c:710:1: <Length trace>
708.  *         otherwise, the index of the last coeff decoded plus one
709.  */
710. static int decode_block_coeffs_internal(VP56RangeCoder *r, DCTELEM block[16],
     ^
711.                                         uint8_t probs[16][3][NUM_DCT_TOKENS-1],
712.                                         int i, uint8_t *token_prob, int16_t qmul[2])

libavcodec/vp8.c:710:1: Parameter `*token_prob`
708.  *         otherwise, the index of the last coeff decoded plus one
709.  */
710. static int decode_block_coeffs_internal(VP56RangeCoder *r, DCTELEM block[16],
     ^
711.                                         uint8_t probs[16][3][NUM_DCT_TOKENS-1],
712.                                         int i, uint8_t *token_prob, int16_t qmul[2])

libavcodec/vp8.c:750:51: Array access: Offset: [9, 10] Size: 3
748.                 } else {    // DCT_CAT3 and up
749.                     int a = vp56_rac_get_prob(&c, token_prob[8]);
750.                     int b = vp56_rac_get_prob(&c, token_prob[9+a]);
                                                       ^
751.                     int cat = (a<<1) + b;
752.                     coeff  = 3 + (8<<cat);
