libavcodec/mpegaudiodec.c:1849: error: Buffer Overrun L1
  Offset: [12, +oo] (⇐ [0, +oo] + [12, 17]) Size: 2 by call to `compute_imdct`.

libavcodec/mpegaudiodec.c:1613:1: Parameter `s->mdct_buf[*]`
1611. 
1612. /* main layer3 decoding function */
1613. static int mp_decode_layer3(MPADecodeContext *s)
      ^
1614. {
1615.     int nb_granules, main_data_begin, private_bits;

libavcodec/mpegaudiodec.c:1849:13: Call
1847.             reorder_block(s, g);
1848.             RENAME(compute_antialias)(s, g);
1849.             compute_imdct(s, g, &s->sb_samples[ch][18 * gr][0], s->mdct_buf[ch]);
                  ^
1850.         }
1851.     } /* gr */

libavcodec/mpegaudiodec.c:1579:13: <Offset trace>
1577.         }
1578.         imdct12(out2, ptr + 0);
1579.         for(i=0;i<6;i++) {
                  ^
1580.             *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*1];
1581.             buf[i + 6*2] = MULH3(out2[i + 6], win[i + 6], 1);

libavcodec/mpegaudiodec.c:1579:13: Assignment
  1577.         }
  1578.         imdct12(out2, ptr + 0);
  1579.         for(i=0;i<6;i++) {
                    ^
  1580.             *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*1];
  1581.             buf[i + 6*2] = MULH3(out2[i + 6], win[i + 6], 1);

libavcodec/mpegaudiodec.c:1521:1: <Length trace>
1519. #endif
1520. 
1521. static void compute_imdct(MPADecodeContext *s,
      ^
1522.                           GranuleDef *g,
1523.                           INTFLOAT *sb_samples,

libavcodec/mpegaudiodec.c:1521:1: Parameter `*mdct_buf`
  1519. #endif
  1520. 
  1521. static void compute_imdct(MPADecodeContext *s,
        ^
  1522.                           GranuleDef *g,
  1523.                           INTFLOAT *sb_samples,

libavcodec/mpegaudiodec.c:1552:5: Assignment
  1550.     }
  1551. 
  1552.     buf = mdct_buf;
            ^
  1553.     ptr = g->sb_hybrid;
  1554.     for(j=0;j<mdct_long_end;j++) {

libavcodec/mpegaudiodec.c:1581:13: Array access: Offset: [12, +oo] (⇐ [0, +oo] + [12, 17]) Size: 2 by call to `compute_imdct` 
  1579.         for(i=0;i<6;i++) {
  1580.             *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*1];
  1581.             buf[i + 6*2] = MULH3(out2[i + 6], win[i + 6], 1);
                    ^
  1582.             out_ptr += SBLIMIT;
  1583.         }

static void compute_imdct(MPADecodeContext *s,
                          GranuleDef *g,
                          INTFLOAT *sb_samples,
                          INTFLOAT *mdct_buf)
{
    INTFLOAT *win, *win1, *out_ptr, *ptr, *buf, *ptr1;
    INTFLOAT out2[12];
    int i, j, mdct_long_end, sblimit;
    ptr = g->sb_hybrid + 576;
    ptr1 = g->sb_hybrid + 2 * 18;
    while (ptr >= ptr1) {
        int32_t *p;
        ptr -= 6;
        p= (int32_t*)ptr;
        if(p[0] | p[1] | p[2] | p[3] | p[4] | p[5])
            break;
    }
    sblimit = ((ptr - g->sb_hybrid) / 18) + 1;
    if (g->block_type == 2) {
        if (g->switch_point)
            mdct_long_end = 2;
        else
            mdct_long_end = 0;
    } else {
        mdct_long_end = sblimit;
    }
    buf = mdct_buf;
    ptr = g->sb_hybrid;
    for(j=0;j<mdct_long_end;j++) {
        out_ptr = sb_samples + j;
        if (g->switch_point && j < 2)
            win1 = mdct_win[0];
        else
            win1 = mdct_win[g->block_type];
        win = win1 + ((4 * 36) & -(j & 1));
        imdct36(out_ptr, buf, ptr, win);
        out_ptr += 18*SBLIMIT;
        ptr += 18;
        buf += 18;
    }
    for(j=mdct_long_end;j<sblimit;j++) {
        win = mdct_win[2] + ((4 * 36) & -(j & 1));
        out_ptr = sb_samples + j;
        for(i=0; i<6; i++){
            *out_ptr = buf[i];
            out_ptr += SBLIMIT;
        }
        imdct12(out2, ptr + 0);
        for(i=0;i<6;i++) {
            *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*1];
            buf[i + 6*2] = MULH3(out2[i + 6], win[i + 6], 1);
            out_ptr += SBLIMIT;
        }
        imdct12(out2, ptr + 1);
        for(i=0;i<6;i++) {
            *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*2];
            buf[i + 6*0] = MULH3(out2[i + 6], win[i + 6], 1);
            out_ptr += SBLIMIT;
        }
        imdct12(out2, ptr + 2);
        for(i=0;i<6;i++) {
            buf[i + 6*0] = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*0];
            buf[i + 6*1] = MULH3(out2[i + 6], win[i + 6], 1);
            buf[i + 6*2] = 0;
        }
        ptr += 18;
        buf += 18;
    }
    for(j=sblimit;j<SBLIMIT;j++) {
        out_ptr = sb_samples + j;
        for(i=0;i<18;i++) {
            *out_ptr = buf[i];
            buf[i] = 0;
            out_ptr += SBLIMIT;
        }
        buf += 18;
    }
}
['static int mp_decode_layer3(MPADecodeContext *s)\n{\n    int nb_granules, main_data_begin, private_bits;\n    int gr, ch, blocksplit_flag, i, j, k, n, bits_pos;\n    GranuleDef *g;\n    int16_t exponents[576];\n    if (s->lsf) {\n        main_data_begin = get_bits(&s->gb, 8);\n        private_bits = get_bits(&s->gb, s->nb_channels);\n        nb_granules = 1;\n    } else {\n        main_data_begin = get_bits(&s->gb, 9);\n        if (s->nb_channels == 2)\n            private_bits = get_bits(&s->gb, 3);\n        else\n            private_bits = get_bits(&s->gb, 5);\n        nb_granules = 2;\n        for(ch=0;ch<s->nb_channels;ch++) {\n            s->granules[ch][0].scfsi = 0;\n            s->granules[ch][1].scfsi = get_bits(&s->gb, 4);\n        }\n    }\n    for(gr=0;gr<nb_granules;gr++) {\n        for(ch=0;ch<s->nb_channels;ch++) {\n            av_dlog(s->avctx, "gr=%d ch=%d: side_info\\n", gr, ch);\n            g = &s->granules[ch][gr];\n            g->part2_3_length = get_bits(&s->gb, 12);\n            g->big_values = get_bits(&s->gb, 9);\n            if(g->big_values > 288){\n                av_log(s->avctx, AV_LOG_ERROR, "big_values too big\\n");\n                return -1;\n            }\n            g->global_gain = get_bits(&s->gb, 8);\n            if ((s->mode_ext & (MODE_EXT_MS_STEREO | MODE_EXT_I_STEREO)) ==\n                MODE_EXT_MS_STEREO)\n                g->global_gain -= 2;\n            if (s->lsf)\n                g->scalefac_compress = get_bits(&s->gb, 9);\n            else\n                g->scalefac_compress = get_bits(&s->gb, 4);\n            blocksplit_flag = get_bits1(&s->gb);\n            if (blocksplit_flag) {\n                g->block_type = get_bits(&s->gb, 2);\n                if (g->block_type == 0){\n                    av_log(s->avctx, AV_LOG_ERROR, "invalid block type\\n");\n                    return -1;\n                }\n                g->switch_point = get_bits1(&s->gb);\n                for(i=0;i<2;i++)\n                    g->table_select[i] = get_bits(&s->gb, 5);\n                for(i=0;i<3;i++)\n                    g->subblock_gain[i] = get_bits(&s->gb, 3);\n                ff_init_short_region(s, g);\n            } else {\n                int region_address1, region_address2;\n                g->block_type = 0;\n                g->switch_point = 0;\n                for(i=0;i<3;i++)\n                    g->table_select[i] = get_bits(&s->gb, 5);\n                region_address1 = get_bits(&s->gb, 4);\n                region_address2 = get_bits(&s->gb, 3);\n                av_dlog(s->avctx, "region1=%d region2=%d\\n",\n                        region_address1, region_address2);\n                ff_init_long_region(s, g, region_address1, region_address2);\n            }\n            ff_region_offset2size(g);\n            ff_compute_band_indexes(s, g);\n            g->preflag = 0;\n            if (!s->lsf)\n                g->preflag = get_bits1(&s->gb);\n            g->scalefac_scale = get_bits1(&s->gb);\n            g->count1table_select = get_bits1(&s->gb);\n            av_dlog(s->avctx, "block_type=%d switch_point=%d\\n",\n                    g->block_type, g->switch_point);\n        }\n    }\n  if (!s->adu_mode) {\n    const uint8_t *ptr = s->gb.buffer + (get_bits_count(&s->gb)>>3);\n    assert((get_bits_count(&s->gb) & 7) == 0);\n    av_dlog(s->avctx, "seekback: %d\\n", main_data_begin);\n    memcpy(s->last_buf + s->last_buf_size, ptr, EXTRABYTES);\n    s->in_gb= s->gb;\n        init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);\n        skip_bits_long(&s->gb, 8*(s->last_buf_size - main_data_begin));\n  }\n    for(gr=0;gr<nb_granules;gr++) {\n        for(ch=0;ch<s->nb_channels;ch++) {\n            g = &s->granules[ch][gr];\n            if(get_bits_count(&s->gb)<0){\n                av_log(s->avctx, AV_LOG_DEBUG, "mdb:%d, lastbuf:%d skipping granule %d\\n",\n                                            main_data_begin, s->last_buf_size, gr);\n                skip_bits_long(&s->gb, g->part2_3_length);\n                memset(g->sb_hybrid, 0, sizeof(g->sb_hybrid));\n                if(get_bits_count(&s->gb) >= s->gb.size_in_bits && s->in_gb.buffer){\n                    skip_bits_long(&s->in_gb, get_bits_count(&s->gb) - s->gb.size_in_bits);\n                    s->gb= s->in_gb;\n                    s->in_gb.buffer=NULL;\n                }\n                continue;\n            }\n            bits_pos = get_bits_count(&s->gb);\n            if (!s->lsf) {\n                uint8_t *sc;\n                int slen, slen1, slen2;\n                slen1 = slen_table[0][g->scalefac_compress];\n                slen2 = slen_table[1][g->scalefac_compress];\n                av_dlog(s->avctx, "slen1=%d slen2=%d\\n", slen1, slen2);\n                if (g->block_type == 2) {\n                    n = g->switch_point ? 17 : 18;\n                    j = 0;\n                    if(slen1){\n                        for(i=0;i<n;i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, slen1);\n                    }else{\n                        for(i=0;i<n;i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                    if(slen2){\n                        for(i=0;i<18;i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, slen2);\n                        for(i=0;i<3;i++)\n                            g->scale_factors[j++] = 0;\n                    }else{\n                        for(i=0;i<21;i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                } else {\n                    sc = s->granules[ch][0].scale_factors;\n                    j = 0;\n                    for(k=0;k<4;k++) {\n                        n = (k == 0 ? 6 : 5);\n                        if ((g->scfsi & (0x8 >> k)) == 0) {\n                            slen = (k < 2) ? slen1 : slen2;\n                            if(slen){\n                                for(i=0;i<n;i++)\n                                    g->scale_factors[j++] = get_bits(&s->gb, slen);\n                            }else{\n                                for(i=0;i<n;i++)\n                                    g->scale_factors[j++] = 0;\n                            }\n                        } else {\n                            for(i=0;i<n;i++) {\n                                g->scale_factors[j] = sc[j];\n                                j++;\n                            }\n                        }\n                    }\n                    g->scale_factors[j++] = 0;\n                }\n            } else {\n                int tindex, tindex2, slen[4], sl, sf;\n                if (g->block_type == 2) {\n                    tindex = g->switch_point ? 2 : 1;\n                } else {\n                    tindex = 0;\n                }\n                sf = g->scalefac_compress;\n                if ((s->mode_ext & MODE_EXT_I_STEREO) && ch == 1) {\n                    sf >>= 1;\n                    if (sf < 180) {\n                        lsf_sf_expand(slen, sf, 6, 6, 0);\n                        tindex2 = 3;\n                    } else if (sf < 244) {\n                        lsf_sf_expand(slen, sf - 180, 4, 4, 0);\n                        tindex2 = 4;\n                    } else {\n                        lsf_sf_expand(slen, sf - 244, 3, 0, 0);\n                        tindex2 = 5;\n                    }\n                } else {\n                    if (sf < 400) {\n                        lsf_sf_expand(slen, sf, 5, 4, 4);\n                        tindex2 = 0;\n                    } else if (sf < 500) {\n                        lsf_sf_expand(slen, sf - 400, 5, 4, 0);\n                        tindex2 = 1;\n                    } else {\n                        lsf_sf_expand(slen, sf - 500, 3, 0, 0);\n                        tindex2 = 2;\n                        g->preflag = 1;\n                    }\n                }\n                j = 0;\n                for(k=0;k<4;k++) {\n                    n = lsf_nsf_table[tindex2][tindex][k];\n                    sl = slen[k];\n                    if(sl){\n                        for(i=0;i<n;i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, sl);\n                    }else{\n                        for(i=0;i<n;i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                }\n                for(;j<40;j++)\n                    g->scale_factors[j] = 0;\n            }\n            exponents_from_scale_factors(s, g, exponents);\n            huffman_decode(s, g, exponents, bits_pos + g->part2_3_length);\n        }\n        if (s->nb_channels == 2)\n            compute_stereo(s, &s->granules[0][gr], &s->granules[1][gr]);\n        for(ch=0;ch<s->nb_channels;ch++) {\n            g = &s->granules[ch][gr];\n            reorder_block(s, g);\n            RENAME(compute_antialias)(s, g);\n            compute_imdct(s, g, &s->sb_samples[ch][18 * gr][0], s->mdct_buf[ch]);\n        }\n    }\n    if(get_bits_count(&s->gb)<0)\n        skip_bits_long(&s->gb, -get_bits_count(&s->gb));\n    return nb_granules * 18;\n}', 'static void compute_imdct(MPADecodeContext *s,\n                          GranuleDef *g,\n                          INTFLOAT *sb_samples,\n                          INTFLOAT *mdct_buf)\n{\n    INTFLOAT *win, *win1, *out_ptr, *ptr, *buf, *ptr1;\n    INTFLOAT out2[12];\n    int i, j, mdct_long_end, sblimit;\n    ptr = g->sb_hybrid + 576;\n    ptr1 = g->sb_hybrid + 2 * 18;\n    while (ptr >= ptr1) {\n        int32_t *p;\n        ptr -= 6;\n        p= (int32_t*)ptr;\n        if(p[0] | p[1] | p[2] | p[3] | p[4] | p[5])\n            break;\n    }\n    sblimit = ((ptr - g->sb_hybrid) / 18) + 1;\n    if (g->block_type == 2) {\n        if (g->switch_point)\n            mdct_long_end = 2;\n        else\n            mdct_long_end = 0;\n    } else {\n        mdct_long_end = sblimit;\n    }\n    buf = mdct_buf;\n    ptr = g->sb_hybrid;\n    for(j=0;j<mdct_long_end;j++) {\n        out_ptr = sb_samples + j;\n        if (g->switch_point && j < 2)\n            win1 = mdct_win[0];\n        else\n            win1 = mdct_win[g->block_type];\n        win = win1 + ((4 * 36) & -(j & 1));\n        imdct36(out_ptr, buf, ptr, win);\n        out_ptr += 18*SBLIMIT;\n        ptr += 18;\n        buf += 18;\n    }\n    for(j=mdct_long_end;j<sblimit;j++) {\n        win = mdct_win[2] + ((4 * 36) & -(j & 1));\n        out_ptr = sb_samples + j;\n        for(i=0; i<6; i++){\n            *out_ptr = buf[i];\n            out_ptr += SBLIMIT;\n        }\n        imdct12(out2, ptr + 0);\n        for(i=0;i<6;i++) {\n            *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*1];\n            buf[i + 6*2] = MULH3(out2[i + 6], win[i + 6], 1);\n            out_ptr += SBLIMIT;\n        }\n        imdct12(out2, ptr + 1);\n        for(i=0;i<6;i++) {\n            *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*2];\n            buf[i + 6*0] = MULH3(out2[i + 6], win[i + 6], 1);\n            out_ptr += SBLIMIT;\n        }\n        imdct12(out2, ptr + 2);\n        for(i=0;i<6;i++) {\n            buf[i + 6*0] = MULH3(out2[i    ], win[i    ], 1) + buf[i + 6*0];\n            buf[i + 6*1] = MULH3(out2[i + 6], win[i + 6], 1);\n            buf[i + 6*2] = 0;\n        }\n        ptr += 18;\n        buf += 18;\n    }\n    for(j=sblimit;j<SBLIMIT;j++) {\n        out_ptr = sb_samples + j;\n        for(i=0;i<18;i++) {\n            *out_ptr = buf[i];\n            buf[i] = 0;\n            out_ptr += SBLIMIT;\n        }\n        buf += 18;\n    }\n}']