libavcodec/aacdec.c:472: error: Buffer Overrun L3
  Offset added: 512 Size: [0, +oo].

libavcodec/aacdec.c:437:1: <Length trace>
435.  * @return  Returns error status. 0 - OK, !0 - error
436.  */
437. static int output_configure(AACContext *ac,
     ^
438.                             uint8_t layout_map[MAX_ELEM_ID * 4][3], int tags,
439.                             enum OCStatus oc_type, int get_new_frame)

libavcodec/aacdec.c:437:1: Parameter `ac->che[*]`
435.  * @return  Returns error status. 0 - OK, !0 - error
436.  */
437. static int output_configure(AACContext *ac,
     ^
438.                             uint8_t layout_map[MAX_ELEM_ID * 4][3], int tags,
439.                             enum OCStatus oc_type, int get_new_frame)

libavcodec/aacdec.c:472:5: Array access: Offset added: 512 Size: [0, +oo]
470.     }
471. 
472.     memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));
         ^
473.     avctx->channel_layout = ac->oc[1].channel_layout = layout;
474.     avctx->channels       = ac->oc[1].channels       = channels;

static int output_configure(AACContext *ac,
                            uint8_t layout_map[MAX_ELEM_ID * 4][3], int tags,
                            enum OCStatus oc_type, int get_new_frame)
{
    AVCodecContext *avctx = ac->avctx;
    int i, channels = 0, ret;
    uint64_t layout = 0;
    if (ac->oc[1].layout_map != layout_map) {
        memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));
        ac->oc[1].layout_map_tags = tags;
    }
    if (avctx->request_channel_layout != AV_CH_LAYOUT_NATIVE)
        layout = sniff_channel_order(layout_map, tags);
    for (i = 0; i < tags; i++) {
        int type =     layout_map[i][0];
        int id =       layout_map[i][1];
        int position = layout_map[i][2];
        ret = che_configure(ac, position, type, id, &channels);
        if (ret < 0)
            return ret;
    }
    if (ac->oc[1].m4ac.ps == 1 && channels == 2) {
        if (layout == AV_CH_FRONT_CENTER) {
            layout = AV_CH_FRONT_LEFT|AV_CH_FRONT_RIGHT;
        } else {
            layout = 0;
        }
    }
    memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));
    avctx->channel_layout = ac->oc[1].channel_layout = layout;
    avctx->channels       = ac->oc[1].channels       = channels;
    ac->oc[1].status = oc_type;
    if (get_new_frame) {
        if ((ret = frame_configure_elements(ac->avctx)) < 0)
            return ret;
    }
    return 0;
}
['static int output_configure(AACContext *ac,\n                            uint8_t layout_map[MAX_ELEM_ID * 4][3], int tags,\n                            enum OCStatus oc_type, int get_new_frame)\n{\n    AVCodecContext *avctx = ac->avctx;\n    int i, channels = 0, ret;\n    uint64_t layout = 0;\n    if (ac->oc[1].layout_map != layout_map) {\n        memcpy(ac->oc[1].layout_map, layout_map, tags * sizeof(layout_map[0]));\n        ac->oc[1].layout_map_tags = tags;\n    }\n    if (avctx->request_channel_layout != AV_CH_LAYOUT_NATIVE)\n        layout = sniff_channel_order(layout_map, tags);\n    for (i = 0; i < tags; i++) {\n        int type =     layout_map[i][0];\n        int id =       layout_map[i][1];\n        int position = layout_map[i][2];\n        ret = che_configure(ac, position, type, id, &channels);\n        if (ret < 0)\n            return ret;\n    }\n    if (ac->oc[1].m4ac.ps == 1 && channels == 2) {\n        if (layout == AV_CH_FRONT_CENTER) {\n            layout = AV_CH_FRONT_LEFT|AV_CH_FRONT_RIGHT;\n        } else {\n            layout = 0;\n        }\n    }\n    memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));\n    avctx->channel_layout = ac->oc[1].channel_layout = layout;\n    avctx->channels       = ac->oc[1].channels       = channels;\n    ac->oc[1].status = oc_type;\n    if (get_new_frame) {\n        if ((ret = frame_configure_elements(ac->avctx)) < 0)\n            return ret;\n    }\n    return 0;\n}']