libavcodec/aacdec.c:1823: error: Buffer Overrun L3
  Offset added: 4096 Size: [0, +oo].

libavcodec/aacdec.c:1796:1: <Length trace>
1794.  * Update the LTP buffer for next frame
1795.  */
1796. static void update_ltp(AACContext *ac, SingleChannelElement *sce)
      ^
1797. {
1798.     IndividualChannelStream *ics = &sce->ics;

libavcodec/aacdec.c:1796:1: Parameter `sce->ltp_state[*]`
1794.  * Update the LTP buffer for next frame
1795.  */
1796. static void update_ltp(AACContext *ac, SingleChannelElement *sce)
      ^
1797. {
1798.     IndividualChannelStream *ics = &sce->ics;

libavcodec/aacdec.c:1823:5: Array access: Offset added: 4096 Size: [0, +oo]
1821.     }
1822. 
1823.     memcpy(sce->ltp_state,      sce->ltp_state+1024, 1024 * sizeof(*sce->ltp_state));
          ^
1824.     memcpy(sce->ltp_state+1024, sce->ret,            1024 * sizeof(*sce->ltp_state));
1825.     memcpy(sce->ltp_state+2048, saved_ltp,           1024 * sizeof(*sce->ltp_state));

static void update_ltp(AACContext *ac, SingleChannelElement *sce)
{
    IndividualChannelStream *ics = &sce->ics;
    float *saved     = sce->saved;
    float *saved_ltp = sce->coeffs;
    const float *lwindow = ics->use_kb_window[0] ? ff_aac_kbd_long_1024 : ff_sine_1024;
    const float *swindow = ics->use_kb_window[0] ? ff_aac_kbd_short_128 : ff_sine_128;
    int i;
    if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {
        memcpy(saved_ltp,       saved, 512 * sizeof(float));
        memset(saved_ltp + 576, 0,     448 * sizeof(float));
        ac->dsp.vector_fmul_reverse(saved_ltp + 448, ac->buf_mdct + 960,     &swindow[64],      64);
        for (i = 0; i < 64; i++)
            saved_ltp[i + 512] = ac->buf_mdct[1023 - i] * swindow[63 - i];
    } else if (ics->window_sequence[0] == LONG_START_SEQUENCE) {
        memcpy(saved_ltp,       ac->buf_mdct + 512, 448 * sizeof(float));
        memset(saved_ltp + 576, 0,                  448 * sizeof(float));
        ac->dsp.vector_fmul_reverse(saved_ltp + 448, ac->buf_mdct + 960,     &swindow[64],      64);
        for (i = 0; i < 64; i++)
            saved_ltp[i + 512] = ac->buf_mdct[1023 - i] * swindow[63 - i];
    } else {
        ac->dsp.vector_fmul_reverse(saved_ltp,       ac->buf_mdct + 512,     &lwindow[512],     512);
        for (i = 0; i < 512; i++)
            saved_ltp[i + 512] = ac->buf_mdct[1023 - i] * lwindow[511 - i];
    }
    memcpy(sce->ltp_state,      sce->ltp_state+1024, 1024 * sizeof(*sce->ltp_state));
    memcpy(sce->ltp_state+1024, sce->ret,            1024 * sizeof(*sce->ltp_state));
    memcpy(sce->ltp_state+2048, saved_ltp,           1024 * sizeof(*sce->ltp_state));
}
['static void update_ltp(AACContext *ac, SingleChannelElement *sce)\n{\n    IndividualChannelStream *ics = &sce->ics;\n    float *saved     = sce->saved;\n    float *saved_ltp = sce->coeffs;\n    const float *lwindow = ics->use_kb_window[0] ? ff_aac_kbd_long_1024 : ff_sine_1024;\n    const float *swindow = ics->use_kb_window[0] ? ff_aac_kbd_short_128 : ff_sine_128;\n    int i;\n    if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {\n        memcpy(saved_ltp,       saved, 512 * sizeof(float));\n        memset(saved_ltp + 576, 0,     448 * sizeof(float));\n        ac->dsp.vector_fmul_reverse(saved_ltp + 448, ac->buf_mdct + 960,     &swindow[64],      64);\n        for (i = 0; i < 64; i++)\n            saved_ltp[i + 512] = ac->buf_mdct[1023 - i] * swindow[63 - i];\n    } else if (ics->window_sequence[0] == LONG_START_SEQUENCE) {\n        memcpy(saved_ltp,       ac->buf_mdct + 512, 448 * sizeof(float));\n        memset(saved_ltp + 576, 0,                  448 * sizeof(float));\n        ac->dsp.vector_fmul_reverse(saved_ltp + 448, ac->buf_mdct + 960,     &swindow[64],      64);\n        for (i = 0; i < 64; i++)\n            saved_ltp[i + 512] = ac->buf_mdct[1023 - i] * swindow[63 - i];\n    } else {\n        ac->dsp.vector_fmul_reverse(saved_ltp,       ac->buf_mdct + 512,     &lwindow[512],     512);\n        for (i = 0; i < 512; i++)\n            saved_ltp[i + 512] = ac->buf_mdct[1023 - i] * lwindow[511 - i];\n    }\n    memcpy(sce->ltp_state,      sce->ltp_state+1024, 1024 * sizeof(*sce->ltp_state));\n    memcpy(sce->ltp_state+1024, sce->ret,            1024 * sizeof(*sce->ltp_state));\n    memcpy(sce->ltp_state+2048, saved_ltp,           1024 * sizeof(*sce->ltp_state));\n}']