libavcodec/aacsbr.c:604: error: Buffer Overrun L3
  Offset added: [2, +oo] Size: [0, +oo] by call to `sbr_make_f_tablelim`.

libavcodec/aacsbr.c:559:1: Parameter `sbr->n[*]`
557. 
558. /// Derived Frequency Band Tables (14496-3 sp04 p197)
559. static int sbr_make_f_derived(AACContext *ac, SpectralBandReplication *sbr)
     ^
560. {
561.     int k, temp;

libavcodec/aacsbr.c:604:5: Call
602.         return -1;
603. 
604.     sbr_make_f_tablelim(sbr);
         ^
605. 
606.     sbr->data[0].f_indexnoise = 0;

libavcodec/aacsbr.c:177:1: <Offset trace>
175. 
176. /// Limiter Frequency Band Table (14496-3 sp04 p198)
177. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
     ^
178. {
179.     int k;

libavcodec/aacsbr.c:177:1: Parameter `sbr->n[*]`
  175. 
  176. /// Limiter Frequency Band Table (14496-3 sp04 p198)
  177. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
       ^
  178. {
  179.     int k;

libavcodec/aacsbr.c:177:1: <Length trace>
175. 
176. /// Limiter Frequency Band Table (14496-3 sp04 p198)
177. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
     ^
178. {
179.     int k;

libavcodec/aacsbr.c:177:1: Parameter `sbr->f_tablelim[*]`
  175. 
  176. /// Limiter Frequency Band Table (14496-3 sp04 p198)
  177. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
       ^
  178. {
  179.     int k;

libavcodec/aacsbr.c:192:9: Array access: Offset added: [2, +oo] Size: [0, +oo] by call to `sbr_make_f_tablelim` 
  190.             patch_borders[k] = patch_borders[k-1] + sbr->patch_num_subbands[k-1];
  191. 
  192.         memcpy(sbr->f_tablelim, sbr->f_tablelow,
               ^
  193.                (sbr->n[0] + 1) * sizeof(sbr->f_tablelow[0]));
  194.         if (sbr->num_patches > 1)

static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
{
    int k;
    if (sbr->bs_limiter_bands > 0) {
        static const float bands_warped[3] = { 1.32715174233856803909f,
                                               1.18509277094158210129f,
                                               1.11987160404675912501f };
        const float lim_bands_per_octave_warped = bands_warped[sbr->bs_limiter_bands - 1];
        int16_t patch_borders[7];
        uint16_t *in = sbr->f_tablelim + 1, *out = sbr->f_tablelim;
        patch_borders[0] = sbr->kx[1];
        for (k = 1; k <= sbr->num_patches; k++)
            patch_borders[k] = patch_borders[k-1] + sbr->patch_num_subbands[k-1];
        memcpy(sbr->f_tablelim, sbr->f_tablelow,
               (sbr->n[0] + 1) * sizeof(sbr->f_tablelow[0]));
        if (sbr->num_patches > 1)
            memcpy(sbr->f_tablelim + sbr->n[0] + 1, patch_borders + 1,
                   (sbr->num_patches - 1) * sizeof(patch_borders[0]));
        qsort(sbr->f_tablelim, sbr->num_patches + sbr->n[0],
              sizeof(sbr->f_tablelim[0]),
              qsort_comparison_function_int16);
        sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;
        while (out < sbr->f_tablelim + sbr->n_lim) {
            if (*in >= *out * lim_bands_per_octave_warped) {
                *++out = *in++;
            } else if (*in == *out ||
                !in_table_int16(patch_borders, sbr->num_patches, *in)) {
                in++;
                sbr->n_lim--;
            } else if (!in_table_int16(patch_borders, sbr->num_patches, *out)) {
                *out = *in++;
                sbr->n_lim--;
            } else {
                *++out = *in++;
            }
        }
    } else {
        sbr->f_tablelim[0] = sbr->f_tablelow[0];
        sbr->f_tablelim[1] = sbr->f_tablelow[sbr->n[0]];
        sbr->n_lim = 1;
    }
}
['static int sbr_make_f_derived(AACContext *ac, SpectralBandReplication *sbr)\n{\n    int k, temp;\n    sbr->n[1] = sbr->n_master - sbr->spectrum_params.bs_xover_band;\n    sbr->n[0] = (sbr->n[1] + 1) >> 1;\n    memcpy(sbr->f_tablehigh, &sbr->f_master[sbr->spectrum_params.bs_xover_band],\n           (sbr->n[1] + 1) * sizeof(sbr->f_master[0]));\n    sbr->m[1] = sbr->f_tablehigh[sbr->n[1]] - sbr->f_tablehigh[0];\n    sbr->kx[1] = sbr->f_tablehigh[0];\n    if (sbr->kx[1] + sbr->m[1] > 64) {\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "Stop frequency border too high: %d\\n", sbr->kx[1] + sbr->m[1]);\n        return -1;\n    }\n    if (sbr->kx[1] > 32) {\n        av_log(ac->avctx, AV_LOG_ERROR, "Start frequency border too high: %d\\n", sbr->kx[1]);\n        return -1;\n    }\n    sbr->f_tablelow[0] = sbr->f_tablehigh[0];\n    temp = sbr->n[1] & 1;\n    for (k = 1; k <= sbr->n[0]; k++)\n        sbr->f_tablelow[k] = sbr->f_tablehigh[2 * k - temp];\n    sbr->n_q = FFMAX(1, lrintf(sbr->spectrum_params.bs_noise_bands *\n                               log2f(sbr->k[2] / (float)sbr->kx[1])));\n    if (sbr->n_q > 5) {\n        av_log(ac->avctx, AV_LOG_ERROR, "Too many noise floor scale factors: %d\\n", sbr->n_q);\n        return -1;\n    }\n    sbr->f_tablenoise[0] = sbr->f_tablelow[0];\n    temp = 0;\n    for (k = 1; k <= sbr->n_q; k++) {\n        temp += (sbr->n[0] - temp) / (sbr->n_q + 1 - k);\n        sbr->f_tablenoise[k] = sbr->f_tablelow[temp];\n    }\n    if (sbr_hf_calc_npatches(ac, sbr) < 0)\n        return -1;\n    sbr_make_f_tablelim(sbr);\n    sbr->data[0].f_indexnoise = 0;\n    sbr->data[1].f_indexnoise = 0;\n    return 0;\n}', 'static void sbr_make_f_tablelim(SpectralBandReplication *sbr)\n{\n    int k;\n    if (sbr->bs_limiter_bands > 0) {\n        static const float bands_warped[3] = { 1.32715174233856803909f,\n                                               1.18509277094158210129f,\n                                               1.11987160404675912501f };\n        const float lim_bands_per_octave_warped = bands_warped[sbr->bs_limiter_bands - 1];\n        int16_t patch_borders[7];\n        uint16_t *in = sbr->f_tablelim + 1, *out = sbr->f_tablelim;\n        patch_borders[0] = sbr->kx[1];\n        for (k = 1; k <= sbr->num_patches; k++)\n            patch_borders[k] = patch_borders[k-1] + sbr->patch_num_subbands[k-1];\n        memcpy(sbr->f_tablelim, sbr->f_tablelow,\n               (sbr->n[0] + 1) * sizeof(sbr->f_tablelow[0]));\n        if (sbr->num_patches > 1)\n            memcpy(sbr->f_tablelim + sbr->n[0] + 1, patch_borders + 1,\n                   (sbr->num_patches - 1) * sizeof(patch_borders[0]));\n        qsort(sbr->f_tablelim, sbr->num_patches + sbr->n[0],\n              sizeof(sbr->f_tablelim[0]),\n              qsort_comparison_function_int16);\n        sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;\n        while (out < sbr->f_tablelim + sbr->n_lim) {\n            if (*in >= *out * lim_bands_per_octave_warped) {\n                *++out = *in++;\n            } else if (*in == *out ||\n                !in_table_int16(patch_borders, sbr->num_patches, *in)) {\n                in++;\n                sbr->n_lim--;\n            } else if (!in_table_int16(patch_borders, sbr->num_patches, *out)) {\n                *out = *in++;\n                sbr->n_lim--;\n            } else {\n                *++out = *in++;\n            }\n        }\n    } else {\n        sbr->f_tablelim[0] = sbr->f_tablelow[0];\n        sbr->f_tablelim[1] = sbr->f_tablelow[sbr->n[0]];\n        sbr->n_lim = 1;\n    }\n}']