libavcodec/mpegaudiodec.c:1537: error: Buffer Overrun L2
  Offset: [-oo, 60] Size: 40 by call to `compute_stereo`.

libavcodec/mpegaudiodec.c:1371:13: Call
1369.             }
1370.             ff_region_offset2size(g);
1371.             ff_compute_band_indexes(s, g);
                  ^
1372. 
1373.             g->preflag = 0;

libavcodec/mpegaudiodec.c:207:17: Assignment
  205.                 exponents as long blocks (XXX: check this!) */
  206.             if (s->sample_rate_index <= 2)
  207.                 g->long_end = 8;
                       ^
  208.             else if (s->sample_rate_index != 8)
  209.                 g->long_end = 6;

libavcodec/mpegaudiodec.c:1537:13: Call
1535. 
1536.         if (s->mode == MPA_JSTEREO)
1537.             compute_stereo(s, &s->granules[0][gr], &s->granules[1][gr]);
                  ^
1538. 
1539.         for (ch = 0; ch < s->nb_channels; ch++) {

libavcodec/mpegaudiodec.c:1072:18: <Offset trace>
1070.                 k -= 3;
1071.             len = band_size_short[s->sample_rate_index][i];
1072.             for (l = 2; l >= 0; l--) {
                       ^
1073.                 tab0 -= len;
1074.                 tab1 -= len;

libavcodec/mpegaudiodec.c:1072:18: Assignment
  1070.                 k -= 3;
  1071.             len = band_size_short[s->sample_rate_index][i];
  1072.             for (l = 2; l >= 0; l--) {
                         ^
  1073.                 tab0 -= len;
  1074.                 tab1 -= len;

libavcodec/mpegaudiodec.c:1043:1: <Length trace>
1041. #define ISQRT2 FIXR(0.70710678118654752440)
1042. 
1043. static void compute_stereo(MPADecodeContext *s, GranuleDef *g0, GranuleDef *g1)
      ^
1044. {
1045.     int i, j, k, l;

libavcodec/mpegaudiodec.c:1043:1: Parameter `g1->scale_factors[*]`
  1041. #define ISQRT2 FIXR(0.70710678118654752440)
  1042. 
  1043. static void compute_stereo(MPADecodeContext *s, GranuleDef *g0, GranuleDef *g1)
        ^
  1044. {
  1045.     int i, j, k, l;

libavcodec/mpegaudiodec.c:1083:26: Array access: Offset: [-oo, 60] Size: 40 by call to `compute_stereo` 
  1081.                         }
  1082.                     }
  1083.                     sf = g1->scale_factors[k + l];
                                 ^
  1084.                     if (sf >= sf_max)
  1085.                         goto found1;

static void compute_stereo(MPADecodeContext *s, GranuleDef *g0, GranuleDef *g1)
{
    int i, j, k, l;
    int sf_max, sf, len, non_zero_found;
    INTFLOAT (*is_tab)[16], *tab0, *tab1, tmp0, tmp1, v1, v2;
    int non_zero_found_short[3];
    if (s->mode_ext & MODE_EXT_I_STEREO) {
        if (!s->lsf) {
            is_tab = is_table;
            sf_max = 7;
        } else {
            is_tab = is_table_lsf[g1->scalefac_compress & 1];
            sf_max = 16;
        }
        tab0 = g0->sb_hybrid + 576;
        tab1 = g1->sb_hybrid + 576;
        non_zero_found_short[0] = 0;
        non_zero_found_short[1] = 0;
        non_zero_found_short[2] = 0;
        k = (13 - g1->short_start) * 3 + g1->long_end - 3;
        for (i = 12; i >= g1->short_start; i--) {
            if (i != 11)
                k -= 3;
            len = band_size_short[s->sample_rate_index][i];
            for (l = 2; l >= 0; l--) {
                tab0 -= len;
                tab1 -= len;
                if (!non_zero_found_short[l]) {
                    for (j = 0; j < len; j++) {
                        if (tab1[j] != 0) {
                            non_zero_found_short[l] = 1;
                            goto found1;
                        }
                    }
                    sf = g1->scale_factors[k + l];
                    if (sf >= sf_max)
                        goto found1;
                    v1 = is_tab[0][sf];
                    v2 = is_tab[1][sf];
                    for (j = 0; j < len; j++) {
                        tmp0    = tab0[j];
                        tab0[j] = MULLx(tmp0, v1, FRAC_BITS);
                        tab1[j] = MULLx(tmp0, v2, FRAC_BITS);
                    }
                } else {
found1:
                    if (s->mode_ext & MODE_EXT_MS_STEREO) {
                        for (j = 0; j < len; j++) {
                            tmp0    = tab0[j];
                            tmp1    = tab1[j];
                            tab0[j] = MULLx(tmp0 + tmp1, ISQRT2, FRAC_BITS);
                            tab1[j] = MULLx(tmp0 - tmp1, ISQRT2, FRAC_BITS);
                        }
                    }
                }
            }
        }
        non_zero_found = non_zero_found_short[0] |
                         non_zero_found_short[1] |
                         non_zero_found_short[2];
        for (i = g1->long_end - 1;i >= 0;i--) {
            len   = band_size_long[s->sample_rate_index][i];
            tab0 -= len;
            tab1 -= len;
            if (!non_zero_found) {
                for (j = 0; j < len; j++) {
                    if (tab1[j] != 0) {
                        non_zero_found = 1;
                        goto found2;
                    }
                }
                k  = (i == 21) ? 20 : i;
                sf = g1->scale_factors[k];
                if (sf >= sf_max)
                    goto found2;
                v1 = is_tab[0][sf];
                v2 = is_tab[1][sf];
                for (j = 0; j < len; j++) {
                    tmp0    = tab0[j];
                    tab0[j] = MULLx(tmp0, v1, FRAC_BITS);
                    tab1[j] = MULLx(tmp0, v2, FRAC_BITS);
                }
            } else {
found2:
                if (s->mode_ext & MODE_EXT_MS_STEREO) {
                    for (j = 0; j < len; j++) {
                        tmp0    = tab0[j];
                        tmp1    = tab1[j];
                        tab0[j] = MULLx(tmp0 + tmp1, ISQRT2, FRAC_BITS);
                        tab1[j] = MULLx(tmp0 - tmp1, ISQRT2, FRAC_BITS);
                    }
                }
            }
        }
    } else if (s->mode_ext & MODE_EXT_MS_STEREO) {
#if CONFIG_FLOAT
       s-> dsp.butterflies_float(g0->sb_hybrid, g1->sb_hybrid, 576);
#else
        tab0 = g0->sb_hybrid;
        tab1 = g1->sb_hybrid;
        for (i = 0; i < 576; i++) {
            tmp0    = tab0[i];
            tmp1    = tab1[i];
            tab0[i] = tmp0 + tmp1;
            tab1[i] = tmp0 - tmp1;
        }
#endif
    }
}
['static int mp_decode_layer3(MPADecodeContext *s)\n{\n    int nb_granules, main_data_begin;\n    int gr, ch, blocksplit_flag, i, j, k, n, bits_pos;\n    GranuleDef *g;\n    int16_t exponents[576];\n    if (s->lsf) {\n        main_data_begin = get_bits(&s->gb, 8);\n        skip_bits(&s->gb, s->nb_channels);\n        nb_granules = 1;\n    } else {\n        main_data_begin = get_bits(&s->gb, 9);\n        if (s->nb_channels == 2)\n            skip_bits(&s->gb, 3);\n        else\n            skip_bits(&s->gb, 5);\n        nb_granules = 2;\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            s->granules[ch][0].scfsi = 0;\n            s->granules[ch][1].scfsi = get_bits(&s->gb, 4);\n        }\n    }\n    for (gr = 0; gr < nb_granules; gr++) {\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            av_dlog(s->avctx, "gr=%d ch=%d: side_info\\n", gr, ch);\n            g = &s->granules[ch][gr];\n            g->part2_3_length = get_bits(&s->gb, 12);\n            g->big_values     = get_bits(&s->gb,  9);\n            if (g->big_values > 288) {\n                av_log(s->avctx, AV_LOG_ERROR, "big_values too big\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            g->global_gain = get_bits(&s->gb, 8);\n            if ((s->mode_ext & (MODE_EXT_MS_STEREO | MODE_EXT_I_STEREO)) ==\n                MODE_EXT_MS_STEREO)\n                g->global_gain -= 2;\n            if (s->lsf)\n                g->scalefac_compress = get_bits(&s->gb, 9);\n            else\n                g->scalefac_compress = get_bits(&s->gb, 4);\n            blocksplit_flag = get_bits1(&s->gb);\n            if (blocksplit_flag) {\n                g->block_type = get_bits(&s->gb, 2);\n                if (g->block_type == 0) {\n                    av_log(s->avctx, AV_LOG_ERROR, "invalid block type\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                g->switch_point = get_bits1(&s->gb);\n                for (i = 0; i < 2; i++)\n                    g->table_select[i] = get_bits(&s->gb, 5);\n                for (i = 0; i < 3; i++)\n                    g->subblock_gain[i] = get_bits(&s->gb, 3);\n                ff_init_short_region(s, g);\n            } else {\n                int region_address1, region_address2;\n                g->block_type = 0;\n                g->switch_point = 0;\n                for (i = 0; i < 3; i++)\n                    g->table_select[i] = get_bits(&s->gb, 5);\n                region_address1 = get_bits(&s->gb, 4);\n                region_address2 = get_bits(&s->gb, 3);\n                av_dlog(s->avctx, "region1=%d region2=%d\\n",\n                        region_address1, region_address2);\n                ff_init_long_region(s, g, region_address1, region_address2);\n            }\n            ff_region_offset2size(g);\n            ff_compute_band_indexes(s, g);\n            g->preflag = 0;\n            if (!s->lsf)\n                g->preflag = get_bits1(&s->gb);\n            g->scalefac_scale     = get_bits1(&s->gb);\n            g->count1table_select = get_bits1(&s->gb);\n            av_dlog(s->avctx, "block_type=%d switch_point=%d\\n",\n                    g->block_type, g->switch_point);\n        }\n    }\n    if (!s->adu_mode) {\n        int skip;\n        const uint8_t *ptr = s->gb.buffer + (get_bits_count(&s->gb)>>3);\n        int extrasize = av_clip(get_bits_left(&s->gb) >> 3, 0,\n                                FFMAX(0, LAST_BUF_SIZE - s->last_buf_size));\n        assert((get_bits_count(&s->gb) & 7) == 0);\n        av_dlog(s->avctx, "seekback: %d\\n", main_data_begin);\n        memcpy(s->last_buf + s->last_buf_size, ptr, extrasize);\n        s->in_gb = s->gb;\n        init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);\n#if !UNCHECKED_BITSTREAM_READER\n        s->gb.size_in_bits_plus8 += extrasize * 8;\n#endif\n        s->last_buf_size <<= 3;\n        for (gr = 0; gr < nb_granules && (s->last_buf_size >> 3) < main_data_begin; gr++) {\n            for (ch = 0; ch < s->nb_channels; ch++) {\n                g = &s->granules[ch][gr];\n                s->last_buf_size += g->part2_3_length;\n                memset(g->sb_hybrid, 0, sizeof(g->sb_hybrid));\n            }\n        }\n        skip = s->last_buf_size - 8 * main_data_begin;\n        if (skip >= s->gb.size_in_bits && s->in_gb.buffer) {\n            skip_bits_long(&s->in_gb, skip - s->gb.size_in_bits);\n            s->gb           = s->in_gb;\n            s->in_gb.buffer = NULL;\n        } else {\n            skip_bits_long(&s->gb, skip);\n        }\n    } else {\n        gr = 0;\n    }\n    for (; gr < nb_granules; gr++) {\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            g = &s->granules[ch][gr];\n            bits_pos = get_bits_count(&s->gb);\n            if (!s->lsf) {\n                uint8_t *sc;\n                int slen, slen1, slen2;\n                slen1 = slen_table[0][g->scalefac_compress];\n                slen2 = slen_table[1][g->scalefac_compress];\n                av_dlog(s->avctx, "slen1=%d slen2=%d\\n", slen1, slen2);\n                if (g->block_type == 2) {\n                    n = g->switch_point ? 17 : 18;\n                    j = 0;\n                    if (slen1) {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, slen1);\n                    } else {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                    if (slen2) {\n                        for (i = 0; i < 18; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, slen2);\n                        for (i = 0; i < 3; i++)\n                            g->scale_factors[j++] = 0;\n                    } else {\n                        for (i = 0; i < 21; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                } else {\n                    sc = s->granules[ch][0].scale_factors;\n                    j = 0;\n                    for (k = 0; k < 4; k++) {\n                        n = k == 0 ? 6 : 5;\n                        if ((g->scfsi & (0x8 >> k)) == 0) {\n                            slen = (k < 2) ? slen1 : slen2;\n                            if (slen) {\n                                for (i = 0; i < n; i++)\n                                    g->scale_factors[j++] = get_bits(&s->gb, slen);\n                            } else {\n                                for (i = 0; i < n; i++)\n                                    g->scale_factors[j++] = 0;\n                            }\n                        } else {\n                            for (i = 0; i < n; i++) {\n                                g->scale_factors[j] = sc[j];\n                                j++;\n                            }\n                        }\n                    }\n                    g->scale_factors[j++] = 0;\n                }\n            } else {\n                int tindex, tindex2, slen[4], sl, sf;\n                if (g->block_type == 2)\n                    tindex = g->switch_point ? 2 : 1;\n                else\n                    tindex = 0;\n                sf = g->scalefac_compress;\n                if ((s->mode_ext & MODE_EXT_I_STEREO) && ch == 1) {\n                    sf >>= 1;\n                    if (sf < 180) {\n                        lsf_sf_expand(slen, sf, 6, 6, 0);\n                        tindex2 = 3;\n                    } else if (sf < 244) {\n                        lsf_sf_expand(slen, sf - 180, 4, 4, 0);\n                        tindex2 = 4;\n                    } else {\n                        lsf_sf_expand(slen, sf - 244, 3, 0, 0);\n                        tindex2 = 5;\n                    }\n                } else {\n                    if (sf < 400) {\n                        lsf_sf_expand(slen, sf, 5, 4, 4);\n                        tindex2 = 0;\n                    } else if (sf < 500) {\n                        lsf_sf_expand(slen, sf - 400, 5, 4, 0);\n                        tindex2 = 1;\n                    } else {\n                        lsf_sf_expand(slen, sf - 500, 3, 0, 0);\n                        tindex2 = 2;\n                        g->preflag = 1;\n                    }\n                }\n                j = 0;\n                for (k = 0; k < 4; k++) {\n                    n  = lsf_nsf_table[tindex2][tindex][k];\n                    sl = slen[k];\n                    if (sl) {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, sl);\n                    } else {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                }\n                for (; j < 40; j++)\n                    g->scale_factors[j] = 0;\n            }\n            exponents_from_scale_factors(s, g, exponents);\n            huffman_decode(s, g, exponents, bits_pos + g->part2_3_length);\n        }\n        if (s->mode == MPA_JSTEREO)\n            compute_stereo(s, &s->granules[0][gr], &s->granules[1][gr]);\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            g = &s->granules[ch][gr];\n            reorder_block(s, g);\n            compute_antialias(s, g);\n            compute_imdct(s, g, &s->sb_samples[ch][18 * gr][0], s->mdct_buf[ch]);\n        }\n    }\n    if (get_bits_count(&s->gb) < 0)\n        skip_bits_long(&s->gb, -get_bits_count(&s->gb));\n    return nb_granules * 18;\n}', 'static void ff_compute_band_indexes(MPADecodeContext *s, GranuleDef *g)\n{\n    if (g->block_type == 2) {\n        if (g->switch_point) {\n            if (s->sample_rate_index <= 2)\n                g->long_end = 8;\n            else if (s->sample_rate_index != 8)\n                g->long_end = 6;\n            else\n                g->long_end = 4;\n            g->short_start = 2 + (s->sample_rate_index != 8);\n        } else {\n            g->long_end    = 0;\n            g->short_start = 0;\n        }\n    } else {\n        g->short_start = 13;\n        g->long_end    = 22;\n    }\n}', 'static void compute_stereo(MPADecodeContext *s, GranuleDef *g0, GranuleDef *g1)\n{\n    int i, j, k, l;\n    int sf_max, sf, len, non_zero_found;\n    INTFLOAT (*is_tab)[16], *tab0, *tab1, tmp0, tmp1, v1, v2;\n    int non_zero_found_short[3];\n    if (s->mode_ext & MODE_EXT_I_STEREO) {\n        if (!s->lsf) {\n            is_tab = is_table;\n            sf_max = 7;\n        } else {\n            is_tab = is_table_lsf[g1->scalefac_compress & 1];\n            sf_max = 16;\n        }\n        tab0 = g0->sb_hybrid + 576;\n        tab1 = g1->sb_hybrid + 576;\n        non_zero_found_short[0] = 0;\n        non_zero_found_short[1] = 0;\n        non_zero_found_short[2] = 0;\n        k = (13 - g1->short_start) * 3 + g1->long_end - 3;\n        for (i = 12; i >= g1->short_start; i--) {\n            if (i != 11)\n                k -= 3;\n            len = band_size_short[s->sample_rate_index][i];\n            for (l = 2; l >= 0; l--) {\n                tab0 -= len;\n                tab1 -= len;\n                if (!non_zero_found_short[l]) {\n                    for (j = 0; j < len; j++) {\n                        if (tab1[j] != 0) {\n                            non_zero_found_short[l] = 1;\n                            goto found1;\n                        }\n                    }\n                    sf = g1->scale_factors[k + l];\n                    if (sf >= sf_max)\n                        goto found1;\n                    v1 = is_tab[0][sf];\n                    v2 = is_tab[1][sf];\n                    for (j = 0; j < len; j++) {\n                        tmp0    = tab0[j];\n                        tab0[j] = MULLx(tmp0, v1, FRAC_BITS);\n                        tab1[j] = MULLx(tmp0, v2, FRAC_BITS);\n                    }\n                } else {\nfound1:\n                    if (s->mode_ext & MODE_EXT_MS_STEREO) {\n                        for (j = 0; j < len; j++) {\n                            tmp0    = tab0[j];\n                            tmp1    = tab1[j];\n                            tab0[j] = MULLx(tmp0 + tmp1, ISQRT2, FRAC_BITS);\n                            tab1[j] = MULLx(tmp0 - tmp1, ISQRT2, FRAC_BITS);\n                        }\n                    }\n                }\n            }\n        }\n        non_zero_found = non_zero_found_short[0] |\n                         non_zero_found_short[1] |\n                         non_zero_found_short[2];\n        for (i = g1->long_end - 1;i >= 0;i--) {\n            len   = band_size_long[s->sample_rate_index][i];\n            tab0 -= len;\n            tab1 -= len;\n            if (!non_zero_found) {\n                for (j = 0; j < len; j++) {\n                    if (tab1[j] != 0) {\n                        non_zero_found = 1;\n                        goto found2;\n                    }\n                }\n                k  = (i == 21) ? 20 : i;\n                sf = g1->scale_factors[k];\n                if (sf >= sf_max)\n                    goto found2;\n                v1 = is_tab[0][sf];\n                v2 = is_tab[1][sf];\n                for (j = 0; j < len; j++) {\n                    tmp0    = tab0[j];\n                    tab0[j] = MULLx(tmp0, v1, FRAC_BITS);\n                    tab1[j] = MULLx(tmp0, v2, FRAC_BITS);\n                }\n            } else {\nfound2:\n                if (s->mode_ext & MODE_EXT_MS_STEREO) {\n                    for (j = 0; j < len; j++) {\n                        tmp0    = tab0[j];\n                        tmp1    = tab1[j];\n                        tab0[j] = MULLx(tmp0 + tmp1, ISQRT2, FRAC_BITS);\n                        tab1[j] = MULLx(tmp0 - tmp1, ISQRT2, FRAC_BITS);\n                    }\n                }\n            }\n        }\n    } else if (s->mode_ext & MODE_EXT_MS_STEREO) {\n#if CONFIG_FLOAT\n       s-> dsp.butterflies_float(g0->sb_hybrid, g1->sb_hybrid, 576);\n#else\n        tab0 = g0->sb_hybrid;\n        tab1 = g1->sb_hybrid;\n        for (i = 0; i < 576; i++) {\n            tmp0    = tab0[i];\n            tmp1    = tab1[i];\n            tab0[i] = tmp0 + tmp1;\n            tab1[i] = tmp0 - tmp1;\n        }\n#endif\n    }\n}']