libavcodec/aacsbr.c:741: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 8.

libavcodec/aacsbr.c:627:1: <Offset trace>
625. };
626. 
627. static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
     ^
628.                          GetBitContext *gb, SBRData *ch_data)
629. {

libavcodec/aacsbr.c:627:1: Parameter `ch_data->bs_num_env`
625. };
626. 
627. static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
     ^
628.                          GetBitContext *gb, SBRData *ch_data)
629. {

libavcodec/aacsbr.c:627:1: <Length trace>
625. };
626. 
627. static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
     ^
628.                          GetBitContext *gb, SBRData *ch_data)
629. {

libavcodec/aacsbr.c:627:1: Parameter `ch_data->t_env[*]`
625. };
626. 
627. static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
     ^
628.                          GetBitContext *gb, SBRData *ch_data)
629. {

libavcodec/aacsbr.c:741:43: Array access: Offset: [-1, +oo] Size: 8
739. 
740.     ch_data->t_q[0]                     = ch_data->t_env[0];
741.     ch_data->t_q[ch_data->bs_num_noise] = ch_data->t_env[ch_data->bs_num_env];
                                               ^
742.     if (ch_data->bs_num_noise > 1) {
743.         int idx;

static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,
                         GetBitContext *gb, SBRData *ch_data)
{
    int i;
    int bs_pointer = 0;
    int abs_bord_trail = 16;
    int num_rel_lead, num_rel_trail;
    unsigned bs_num_env_old = ch_data->bs_num_env;
    ch_data->bs_freq_res[0] = ch_data->bs_freq_res[ch_data->bs_num_env];
    ch_data->bs_amp_res = sbr->bs_amp_res_header;
    ch_data->t_env_num_env_old = ch_data->t_env[bs_num_env_old];
    switch (ch_data->bs_frame_class = get_bits(gb, 2)) {
    case FIXFIX:
        ch_data->bs_num_env                 = 1 << get_bits(gb, 2);
        num_rel_lead                        = ch_data->bs_num_env - 1;
        if (ch_data->bs_num_env == 1)
            ch_data->bs_amp_res = 0;
        if (ch_data->bs_num_env > 4) {
            av_log(ac->avctx, AV_LOG_ERROR,
                   "Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\n",
                   ch_data->bs_num_env);
            return -1;
        }
        ch_data->t_env[0]                   = 0;
        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
        abs_bord_trail = (abs_bord_trail + (ch_data->bs_num_env >> 1)) /
                   ch_data->bs_num_env;
        for (i = 0; i < num_rel_lead; i++)
            ch_data->t_env[i + 1] = ch_data->t_env[i] + abs_bord_trail;
        ch_data->bs_freq_res[1] = get_bits1(gb);
        for (i = 1; i < ch_data->bs_num_env; i++)
            ch_data->bs_freq_res[i + 1] = ch_data->bs_freq_res[1];
        break;
    case FIXVAR:
        abs_bord_trail                     += get_bits(gb, 2);
        num_rel_trail                       = get_bits(gb, 2);
        ch_data->bs_num_env                 = num_rel_trail + 1;
        ch_data->t_env[0]                   = 0;
        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
        for (i = 0; i < num_rel_trail; i++)
            ch_data->t_env[ch_data->bs_num_env - 1 - i] =
                ch_data->t_env[ch_data->bs_num_env - i] - 2 * get_bits(gb, 2) - 2;
        bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]);
        for (i = 0; i < ch_data->bs_num_env; i++)
            ch_data->bs_freq_res[ch_data->bs_num_env - i] = get_bits1(gb);
        break;
    case VARFIX:
        ch_data->t_env[0]                   = get_bits(gb, 2);
        num_rel_lead                        = get_bits(gb, 2);
        ch_data->bs_num_env                 = num_rel_lead + 1;
        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
        for (i = 0; i < num_rel_lead; i++)
            ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2;
        bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]);
        get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env);
        break;
    case VARVAR:
        ch_data->t_env[0]                   = get_bits(gb, 2);
        abs_bord_trail                     += get_bits(gb, 2);
        num_rel_lead                        = get_bits(gb, 2);
        num_rel_trail                       = get_bits(gb, 2);
        ch_data->bs_num_env                 = num_rel_lead + num_rel_trail + 1;
        if (ch_data->bs_num_env > 5) {
            av_log(ac->avctx, AV_LOG_ERROR,
                   "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\n",
                   ch_data->bs_num_env);
            return -1;
        }
        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;
        for (i = 0; i < num_rel_lead; i++)
            ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2;
        for (i = 0; i < num_rel_trail; i++)
            ch_data->t_env[ch_data->bs_num_env - 1 - i] =
                ch_data->t_env[ch_data->bs_num_env - i] - 2 * get_bits(gb, 2) - 2;
        bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]);
        get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env);
        break;
    }
    if (bs_pointer < 0 || bs_pointer > ch_data->bs_num_env + 1) {
        av_log(ac->avctx, AV_LOG_ERROR,
               "Invalid bitstream, bs_pointer points to a middle noise border outside the time borders table: %d\n",
               bs_pointer);
        return -1;
    }
    for (i = 1; i <= ch_data->bs_num_env; i++) {
        if (ch_data->t_env[i-1] > ch_data->t_env[i]) {
            av_log(ac->avctx, AV_LOG_ERROR, "Non monotone time borders\n");
            return -1;
        }
    }
    ch_data->bs_num_noise = (ch_data->bs_num_env > 1) + 1;
    ch_data->t_q[0]                     = ch_data->t_env[0];
    ch_data->t_q[ch_data->bs_num_noise] = ch_data->t_env[ch_data->bs_num_env];
    if (ch_data->bs_num_noise > 1) {
        int idx;
        if (ch_data->bs_frame_class == FIXFIX) {
            idx = ch_data->bs_num_env >> 1;
        } else if (ch_data->bs_frame_class & 1) {
            idx = ch_data->bs_num_env - FFMAX(bs_pointer - 1, 1);
        } else {
            if (!bs_pointer)
                idx = 1;
            else if (bs_pointer == 1)
                idx = ch_data->bs_num_env - 1;
            else
                idx = bs_pointer - 1;
        }
        ch_data->t_q[1] = ch_data->t_env[idx];
    }
    ch_data->e_a[0] = -(ch_data->e_a[1] != bs_num_env_old);
    ch_data->e_a[1] = -1;
    if ((ch_data->bs_frame_class & 1) && bs_pointer) {
        ch_data->e_a[1] = ch_data->bs_num_env + 1 - bs_pointer;
    } else if ((ch_data->bs_frame_class == 2) && (bs_pointer > 1))
        ch_data->e_a[1] = bs_pointer - 1;
    return 0;
}
['static int read_sbr_grid(AACContext *ac, SpectralBandReplication *sbr,\n                         GetBitContext *gb, SBRData *ch_data)\n{\n    int i;\n    int bs_pointer = 0;\n    int abs_bord_trail = 16;\n    int num_rel_lead, num_rel_trail;\n    unsigned bs_num_env_old = ch_data->bs_num_env;\n    ch_data->bs_freq_res[0] = ch_data->bs_freq_res[ch_data->bs_num_env];\n    ch_data->bs_amp_res = sbr->bs_amp_res_header;\n    ch_data->t_env_num_env_old = ch_data->t_env[bs_num_env_old];\n    switch (ch_data->bs_frame_class = get_bits(gb, 2)) {\n    case FIXFIX:\n        ch_data->bs_num_env                 = 1 << get_bits(gb, 2);\n        num_rel_lead                        = ch_data->bs_num_env - 1;\n        if (ch_data->bs_num_env == 1)\n            ch_data->bs_amp_res = 0;\n        if (ch_data->bs_num_env > 4) {\n            av_log(ac->avctx, AV_LOG_ERROR,\n                   "Invalid bitstream, too many SBR envelopes in FIXFIX type SBR frame: %d\\n",\n                   ch_data->bs_num_env);\n            return -1;\n        }\n        ch_data->t_env[0]                   = 0;\n        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;\n        abs_bord_trail = (abs_bord_trail + (ch_data->bs_num_env >> 1)) /\n                   ch_data->bs_num_env;\n        for (i = 0; i < num_rel_lead; i++)\n            ch_data->t_env[i + 1] = ch_data->t_env[i] + abs_bord_trail;\n        ch_data->bs_freq_res[1] = get_bits1(gb);\n        for (i = 1; i < ch_data->bs_num_env; i++)\n            ch_data->bs_freq_res[i + 1] = ch_data->bs_freq_res[1];\n        break;\n    case FIXVAR:\n        abs_bord_trail                     += get_bits(gb, 2);\n        num_rel_trail                       = get_bits(gb, 2);\n        ch_data->bs_num_env                 = num_rel_trail + 1;\n        ch_data->t_env[0]                   = 0;\n        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;\n        for (i = 0; i < num_rel_trail; i++)\n            ch_data->t_env[ch_data->bs_num_env - 1 - i] =\n                ch_data->t_env[ch_data->bs_num_env - i] - 2 * get_bits(gb, 2) - 2;\n        bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]);\n        for (i = 0; i < ch_data->bs_num_env; i++)\n            ch_data->bs_freq_res[ch_data->bs_num_env - i] = get_bits1(gb);\n        break;\n    case VARFIX:\n        ch_data->t_env[0]                   = get_bits(gb, 2);\n        num_rel_lead                        = get_bits(gb, 2);\n        ch_data->bs_num_env                 = num_rel_lead + 1;\n        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;\n        for (i = 0; i < num_rel_lead; i++)\n            ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2;\n        bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]);\n        get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env);\n        break;\n    case VARVAR:\n        ch_data->t_env[0]                   = get_bits(gb, 2);\n        abs_bord_trail                     += get_bits(gb, 2);\n        num_rel_lead                        = get_bits(gb, 2);\n        num_rel_trail                       = get_bits(gb, 2);\n        ch_data->bs_num_env                 = num_rel_lead + num_rel_trail + 1;\n        if (ch_data->bs_num_env > 5) {\n            av_log(ac->avctx, AV_LOG_ERROR,\n                   "Invalid bitstream, too many SBR envelopes in VARVAR type SBR frame: %d\\n",\n                   ch_data->bs_num_env);\n            return -1;\n        }\n        ch_data->t_env[ch_data->bs_num_env] = abs_bord_trail;\n        for (i = 0; i < num_rel_lead; i++)\n            ch_data->t_env[i + 1] = ch_data->t_env[i] + 2 * get_bits(gb, 2) + 2;\n        for (i = 0; i < num_rel_trail; i++)\n            ch_data->t_env[ch_data->bs_num_env - 1 - i] =\n                ch_data->t_env[ch_data->bs_num_env - i] - 2 * get_bits(gb, 2) - 2;\n        bs_pointer = get_bits(gb, ceil_log2[ch_data->bs_num_env]);\n        get_bits1_vector(gb, ch_data->bs_freq_res + 1, ch_data->bs_num_env);\n        break;\n    }\n    if (bs_pointer < 0 || bs_pointer > ch_data->bs_num_env + 1) {\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "Invalid bitstream, bs_pointer points to a middle noise border outside the time borders table: %d\\n",\n               bs_pointer);\n        return -1;\n    }\n    for (i = 1; i <= ch_data->bs_num_env; i++) {\n        if (ch_data->t_env[i-1] > ch_data->t_env[i]) {\n            av_log(ac->avctx, AV_LOG_ERROR, "Non monotone time borders\\n");\n            return -1;\n        }\n    }\n    ch_data->bs_num_noise = (ch_data->bs_num_env > 1) + 1;\n    ch_data->t_q[0]                     = ch_data->t_env[0];\n    ch_data->t_q[ch_data->bs_num_noise] = ch_data->t_env[ch_data->bs_num_env];\n    if (ch_data->bs_num_noise > 1) {\n        int idx;\n        if (ch_data->bs_frame_class == FIXFIX) {\n            idx = ch_data->bs_num_env >> 1;\n        } else if (ch_data->bs_frame_class & 1) {\n            idx = ch_data->bs_num_env - FFMAX(bs_pointer - 1, 1);\n        } else {\n            if (!bs_pointer)\n                idx = 1;\n            else if (bs_pointer == 1)\n                idx = ch_data->bs_num_env - 1;\n            else\n                idx = bs_pointer - 1;\n        }\n        ch_data->t_q[1] = ch_data->t_env[idx];\n    }\n    ch_data->e_a[0] = -(ch_data->e_a[1] != bs_num_env_old);\n    ch_data->e_a[1] = -1;\n    if ((ch_data->bs_frame_class & 1) && bs_pointer) {\n        ch_data->e_a[1] = ch_data->bs_num_env + 1 - bs_pointer;\n    } else if ((ch_data->bs_frame_class == 2) && (bs_pointer > 1))\n        ch_data->e_a[1] = bs_pointer - 1;\n    return 0;\n}']