libavcodec/aacdec.c:437: error: Buffer Overrun L2
  Offset: [1, 64] Size: 64 by call to `che_configure`.

libavcodec/aacdec.c:419:5: Assignment
417. {
418.     AVCodecContext *avctx = ac->avctx;
419.     int i, channels = 0, ret;
         ^
420.     uint64_t layout = 0;
421. 

libavcodec/aacdec.c:437:15: Call
435.         // Allocate or free elements depending on if they are in the
436.         // current program configuration.
437.         ret = che_configure(ac, position, type, id, &channels);
                   ^
438.         if (ret < 0)
439.             return ret;

libavcodec/aacdec.c:140:1: <Offset trace>
138.  * @return  Returns error status. 0 - OK, !0 - error
139.  */
140. static av_cold int che_configure(AACContext *ac,
     ^
141.                                  enum ChannelPosition che_pos,
142.                                  int type, int id, int *channels)

libavcodec/aacdec.c:140:1: Parameter `*channels`
  138.  * @return  Returns error status. 0 - OK, !0 - error
  139.  */
  140. static av_cold int che_configure(AACContext *ac,
       ^
  141.                                  enum ChannelPosition che_pos,
  142.                                  int type, int id, int *channels)

libavcodec/aacdec.c:153:32: Assignment
  151.         }
  152.         if (type != TYPE_CCE) {
  153.             ac->output_element[(*channels)++] = &ac->che[type][id]->ch[0];
                                      ^
  154.             if (type == TYPE_CPE ||
  155.                 (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1)) {

libavcodec/aacdec.c:140:1: <Length trace>
138.  * @return  Returns error status. 0 - OK, !0 - error
139.  */
140. static av_cold int che_configure(AACContext *ac,
     ^
141.                                  enum ChannelPosition che_pos,
142.                                  int type, int id, int *channels)

libavcodec/aacdec.c:140:1: Parameter `ac->output_element[*]`
  138.  * @return  Returns error status. 0 - OK, !0 - error
  139.  */
  140. static av_cold int che_configure(AACContext *ac,
       ^
  141.                                  enum ChannelPosition che_pos,
  142.                                  int type, int id, int *channels)

libavcodec/aacdec.c:156:17: Array access: Offset: [1, 64] Size: 64 by call to `che_configure` 
  154.             if (type == TYPE_CPE ||
  155.                 (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1)) {
  156.                 ac->output_element[(*channels)++] = &ac->che[type][id]->ch[1];
                       ^
  157.             }
  158.         }

static av_cold int che_configure(AACContext *ac,
                                 enum ChannelPosition che_pos,
                                 int type, int id, int *channels)
{
    if (*channels >= MAX_CHANNELS)
        return AVERROR_INVALIDDATA;
    if (che_pos) {
        if (!ac->che[type][id]) {
            if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))
                return AVERROR(ENOMEM);
            ff_aac_sbr_ctx_init(ac, &ac->che[type][id]->sbr);
        }
        if (type != TYPE_CCE) {
            ac->output_element[(*channels)++] = &ac->che[type][id]->ch[0];
            if (type == TYPE_CPE ||
                (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1)) {
                ac->output_element[(*channels)++] = &ac->che[type][id]->ch[1];
            }
        }
    } else {
        if (ac->che[type][id])
            ff_aac_sbr_ctx_close(&ac->che[type][id]->sbr);
        av_freep(&ac->che[type][id]);
    }
    return 0;
}
['static int output_configure(AACContext *ac,\n                            uint8_t layout_map[MAX_ELEM_ID*4][3], int tags,\n                            enum OCStatus oc_type, int get_new_frame)\n{\n    AVCodecContext *avctx = ac->avctx;\n    int i, channels = 0, ret;\n    uint64_t layout = 0;\n    if (ac->oc[1].layout_map != layout_map) {\n        memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));\n        ac->oc[1].layout_map_tags = tags;\n    }\n    if (avctx->request_channel_layout != AV_CH_LAYOUT_NATIVE)\n        layout = sniff_channel_order(layout_map, tags);\n    for (i = 0; i < tags; i++) {\n        int type =     layout_map[i][0];\n        int id =       layout_map[i][1];\n        int position = layout_map[i][2];\n        ret = che_configure(ac, position, type, id, &channels);\n        if (ret < 0)\n            return ret;\n    }\n    if (ac->oc[1].m4ac.ps == 1 && channels == 2) {\n        if (layout == AV_CH_FRONT_CENTER) {\n            layout = AV_CH_FRONT_LEFT|AV_CH_FRONT_RIGHT;\n        } else {\n            layout = 0;\n        }\n    }\n    memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));\n    avctx->channel_layout = ac->oc[1].channel_layout = layout;\n    avctx->channels = ac->oc[1].channels = channels;\n    ac->oc[1].status = oc_type;\n    if (get_new_frame) {\n        if ((ret = frame_configure_elements(ac->avctx)) < 0)\n            return ret;\n    }\n    return 0;\n}', 'static av_cold int che_configure(AACContext *ac,\n                                 enum ChannelPosition che_pos,\n                                 int type, int id, int *channels)\n{\n    if (*channels >= MAX_CHANNELS)\n        return AVERROR_INVALIDDATA;\n    if (che_pos) {\n        if (!ac->che[type][id]) {\n            if (!(ac->che[type][id] = av_mallocz(sizeof(ChannelElement))))\n                return AVERROR(ENOMEM);\n            ff_aac_sbr_ctx_init(ac, &ac->che[type][id]->sbr);\n        }\n        if (type != TYPE_CCE) {\n            ac->output_element[(*channels)++] = &ac->che[type][id]->ch[0];\n            if (type == TYPE_CPE ||\n                (type == TYPE_SCE && ac->oc[1].m4ac.ps == 1)) {\n                ac->output_element[(*channels)++] = &ac->che[type][id]->ch[1];\n            }\n        }\n    } else {\n        if (ac->che[type][id])\n            ff_aac_sbr_ctx_close(&ac->che[type][id]->sbr);\n        av_freep(&ac->che[type][id]);\n    }\n    return 0;\n}']