libavcodec/aac.c:1769: error: Buffer Overrun L1
  Offset: -1 Size: 7 by call to `output_configure`.

libavcodec/aac.c:1769:23: Call
1767.                        "Not evaluating a further program_config_element as this construct is dubious at best.\n");
1768.             else
1769.                 err = output_configure(ac, ac->che_pos, new_che_pos, 0, OC_TRIAL_PCE);
                            ^
1770.             break;
1771.         }

libavcodec/aac.c:194:1: <Offset trace>
192.  * @return  Returns error status. 0 - OK, !0 - error
193.  */
194. static int output_configure(AACContext *ac,
     ^
195.                             enum ChannelPosition che_pos[4][MAX_ELEM_ID],
196.                             enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],

libavcodec/aac.c:194:1: Parameter `channel_config`
  192.  * @return  Returns error status. 0 - OK, !0 - error
  193.  */
  194. static int output_configure(AACContext *ac,
       ^
  195.                             enum ChannelPosition che_pos[4][MAX_ELEM_ID],
  196.                             enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],

libavcodec/aacdectab.h:74:1: <Length trace>
72. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 0, 0, 0, 0, 0 };
73. 
74. static const uint8_t aac_channel_layout_map[7][5][2] = {
    ^
75.     { { TYPE_SCE, 0 }, },
76.     { { TYPE_CPE, 0 }, },

libavcodec/aacdectab.h:74:1: Array declaration
  72. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 0, 0, 0, 0, 0 };
  73. 
  74. static const uint8_t aac_channel_layout_map[7][5][2] = {
      ^
  75.     { { TYPE_SCE, 0 }, },
  76.     { { TYPE_CPE, 0 }, },

libavcodec/aac.c:207:38: Array access: Offset: -1 Size: 7 by call to `output_configure` 
  205.         for (i = 0; i < tags_per_config[channel_config]; i++) {
  206.             if ((ret = che_configure(ac, che_pos,
  207.                                      aac_channel_layout_map[channel_config - 1][i][0],
                                            ^
  208.                                      aac_channel_layout_map[channel_config - 1][i][1],
  209.                                      &channels)))

static int output_configure(AACContext *ac,
                            enum ChannelPosition che_pos[4][MAX_ELEM_ID],
                            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],
                            int channel_config, enum OCStatus oc_type)
{
    AVCodecContext *avctx = ac->avccontext;
    int i, type, channels = 0, ret;
    memcpy(che_pos, new_che_pos, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));
    if (channel_config) {
        for (i = 0; i < tags_per_config[channel_config]; i++) {
            if ((ret = che_configure(ac, che_pos,
                                     aac_channel_layout_map[channel_config - 1][i][0],
                                     aac_channel_layout_map[channel_config - 1][i][1],
                                     &channels)))
                return ret;
        }
        memset(ac->tag_che_map, 0,       4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));
        ac->tags_mapped = 0;
        avctx->channel_layout = aac_channel_layout[channel_config - 1];
    } else {
        for (i = 0; i < MAX_ELEM_ID; i++) {
            for (type = 0; type < 4; type++) {
                if ((ret = che_configure(ac, che_pos, type, i, &channels)))
                    return ret;
            }
        }
        memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));
        ac->tags_mapped = 4 * MAX_ELEM_ID;
        avctx->channel_layout = 0;
    }
    avctx->channels = channels;
    ac->output_configured = oc_type;
    return 0;
}
['static int aac_decode_frame(AVCodecContext *avccontext, void *data,\n                            int *data_size, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    AACContext *ac = avccontext->priv_data;\n    ChannelElement *che = NULL;\n    GetBitContext gb;\n    enum RawDataBlockType elem_type;\n    int err, elem_id, data_size_tmp;\n    init_get_bits(&gb, buf, buf_size * 8);\n    if (show_bits(&gb, 12) == 0xfff) {\n        if (parse_adts_frame_header(ac, &gb) < 0) {\n            av_log(avccontext, AV_LOG_ERROR, "Error decoding AAC frame header.\\n");\n            return -1;\n        }\n        if (ac->m4ac.sampling_index > 12) {\n            av_log(ac->avccontext, AV_LOG_ERROR, "invalid sampling rate index %d\\n", ac->m4ac.sampling_index);\n            return -1;\n        }\n    }\n    while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {\n        elem_id = get_bits(&gb, 4);\n        if (elem_type < TYPE_DSE && !(che=get_che(ac, elem_type, elem_id))) {\n            av_log(ac->avccontext, AV_LOG_ERROR, "channel element %d.%d is not allocated\\n", elem_type, elem_id);\n            return -1;\n        }\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &che->ch[0], &gb, 0, 0);\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, &gb, che);\n            break;\n        case TYPE_CCE:\n            err = decode_cce(ac, &gb, che);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &che->ch[0], &gb, 0, 0);\n            break;\n        case TYPE_DSE:\n            skip_data_stream_element(&gb);\n            err = 0;\n            break;\n        case TYPE_PCE: {\n            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID];\n            memset(new_che_pos, 0, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n            if ((err = decode_pce(ac, new_che_pos, &gb)))\n                break;\n            if (ac->output_configured <= OC_TRIAL_PCE)\n                av_log(avccontext, AV_LOG_ERROR,\n                       "Not evaluating a further program_config_element as this construct is dubious at best.\\n");\n            else\n                err = output_configure(ac, ac->che_pos, new_che_pos, 0, OC_TRIAL_PCE);\n            break;\n        }\n        case TYPE_FIL:\n            if (elem_id == 15)\n                elem_id += get_bits(&gb, 8) - 1;\n            while (elem_id > 0)\n                elem_id -= decode_extension_payload(ac, &gb, elem_id);\n            err = 0;\n            break;\n        default:\n            err = -1;\n            break;\n        }\n        if (err)\n            return err;\n    }\n    spectral_to_sample(ac);\n    if (!ac->is_saved) {\n        ac->is_saved = 1;\n        *data_size = 0;\n        return buf_size;\n    }\n    data_size_tmp = 1024 * avccontext->channels * sizeof(int16_t);\n    if (*data_size < data_size_tmp) {\n        av_log(avccontext, AV_LOG_ERROR,\n               "Output buffer too small (%d) or trying to output too many samples (%d) for this frame.\\n",\n               *data_size, data_size_tmp);\n        return -1;\n    }\n    *data_size = data_size_tmp;\n    ac->dsp.float_to_int16_interleave(data, (const float **)ac->output_data, 1024, avccontext->channels);\n    if (ac->output_configured)\n        ac->output_configured = OC_LOCKED;\n    return buf_size;\n}', 'static int output_configure(AACContext *ac,\n                            enum ChannelPosition che_pos[4][MAX_ELEM_ID],\n                            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],\n                            int channel_config, enum OCStatus oc_type)\n{\n    AVCodecContext *avctx = ac->avccontext;\n    int i, type, channels = 0, ret;\n    memcpy(che_pos, new_che_pos, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n    if (channel_config) {\n        for (i = 0; i < tags_per_config[channel_config]; i++) {\n            if ((ret = che_configure(ac, che_pos,\n                                     aac_channel_layout_map[channel_config - 1][i][0],\n                                     aac_channel_layout_map[channel_config - 1][i][1],\n                                     &channels)))\n                return ret;\n        }\n        memset(ac->tag_che_map, 0,       4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));\n        ac->tags_mapped = 0;\n        avctx->channel_layout = aac_channel_layout[channel_config - 1];\n    } else {\n        for (i = 0; i < MAX_ELEM_ID; i++) {\n            for (type = 0; type < 4; type++) {\n                if ((ret = che_configure(ac, che_pos, type, i, &channels)))\n                    return ret;\n            }\n        }\n        memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));\n        ac->tags_mapped = 4 * MAX_ELEM_ID;\n        avctx->channel_layout = 0;\n    }\n    avctx->channels = channels;\n    ac->output_configured = oc_type;\n    return 0;\n}']