libavcodec/aacdec.c:2479: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload`.

libavcodec/aacdec.c:2393:13: Call
2391. 
2392.     if (show_bits(gb, 12) == 0xfff) {
2393.         if (parse_adts_frame_header(ac, gb) < 0) {
                  ^
2394.             av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\n");
2395.             err = -1;

libavcodec/aacdec.c:2362:17: Call
  2360.                     &layout_map_tags, hdr_info.chan_config))
  2361.                 return -7;
  2362.             if (output_configure(ac, layout_map, layout_map_tags,
                        ^
  2363.                                  FFMAX(ac->oc[1].status, OC_TRIAL_FRAME), 0))
  2364.                 return -7;

libavcodec/aacdec.c:2479:28: Call
2477.             }
2478.             while (elem_id > 0)
2479.                 elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);
                                 ^
2480.             err = 0; /* FIXME */
2481.             break;

libavcodec/aacdec.c:1949:1: Parameter `che->sbr.n[*]`
  1947.  * @return Returns number of bytes consumed
  1948.  */
  1949. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1950.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1951. {

libavcodec/aacdec.c:1977:15: Call
  1975.             ac->oc[1].m4ac.sbr = 1;
  1976.         }
  1977.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1978.         break;
  1979.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1061:1: Parameter `sbr->n[*]`
    1059.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1060.  */
    1061. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1062.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1063. {

libavcodec/aacsbr.c:1088:25: Call
    1086.     num_sbr_bits++;
    1087.     if (get_bits1(gb)) // bs_header_flag
    1088.         num_sbr_bits += read_sbr_header(sbr, gb);
                                  ^
    1089. 
    1090.     if (sbr->reset)

libavcodec/aacsbr.c:224:1: Parameter `sbr->n[*]`
      222. }
      223. 
      224. static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext *gb)
           ^
      225. {
      226.     unsigned int cnt = get_bits_count(gb);

libavcodec/aacsbr.c:273:9: Call
      271. 
      272.     if (sbr->bs_limiter_bands != old_bs_limiter_bands && !sbr->reset)
      273.         sbr_make_f_tablelim(sbr);
                   ^
      274. 
      275.     return get_bits_count(gb) - cnt;

libavcodec/aacsbr.c:177:1: <LHS trace>
175. 
176. /// Limiter Frequency Band Table (14496-3 sp04 p198)
177. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
     ^
178. {
179.     int k;

libavcodec/aacsbr.c:177:1: Parameter `sbr->n[*]`
        175. 
        176. /// Limiter Frequency Band Table (14496-3 sp04 p198)
        177. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
             ^
        178. {
        179.     int k;

libavcodec/aacsbr.c:202:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload` 
        200.               qsort_comparison_function_int16);
        201. 
        202.         sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;
                     ^
        203.         while (out < sbr->f_tablelim + sbr->n_lim) {
        204.             if (*in >= *out * lim_bands_per_octave_warped) {

static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
{
    int k;
    if (sbr->bs_limiter_bands > 0) {
        static const float bands_warped[3] = { 1.32715174233856803909f,
                                               1.18509277094158210129f,
                                               1.11987160404675912501f };
        const float lim_bands_per_octave_warped = bands_warped[sbr->bs_limiter_bands - 1];
        int16_t patch_borders[7];
        uint16_t *in = sbr->f_tablelim + 1, *out = sbr->f_tablelim;
        patch_borders[0] = sbr->kx[1];
        for (k = 1; k <= sbr->num_patches; k++)
            patch_borders[k] = patch_borders[k-1] + sbr->patch_num_subbands[k-1];
        memcpy(sbr->f_tablelim, sbr->f_tablelow,
               (sbr->n[0] + 1) * sizeof(sbr->f_tablelow[0]));
        if (sbr->num_patches > 1)
            memcpy(sbr->f_tablelim + sbr->n[0] + 1, patch_borders + 1,
                   (sbr->num_patches - 1) * sizeof(patch_borders[0]));
        qsort(sbr->f_tablelim, sbr->num_patches + sbr->n[0],
              sizeof(sbr->f_tablelim[0]),
              qsort_comparison_function_int16);
        sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;
        while (out < sbr->f_tablelim + sbr->n_lim) {
            if (*in >= *out * lim_bands_per_octave_warped) {
                *++out = *in++;
            } else if (*in == *out ||
                !in_table_int16(patch_borders, sbr->num_patches, *in)) {
                in++;
                sbr->n_lim--;
            } else if (!in_table_int16(patch_borders, sbr->num_patches, *out)) {
                *out = *in++;
                sbr->n_lim--;
            } else {
                *++out = *in++;
            }
        }
    } else {
        sbr->f_tablelim[0] = sbr->f_tablelow[0];
        sbr->f_tablelim[1] = sbr->f_tablelow[sbr->n[0]];
        sbr->n_lim = 1;
    }
}
['static int aac_decode_frame_int(AVCodecContext *avctx, void *data,\n                                int *got_frame_ptr, GetBitContext *gb)\n{\n    AACContext *ac = avctx->priv_data;\n    ChannelElement *che = NULL, *che_prev = NULL;\n    enum RawDataBlockType elem_type, elem_type_prev = TYPE_END;\n    int err, elem_id;\n    int samples = 0, multiplier, audio_found = 0, pce_found = 0;\n    if (show_bits(gb, 12) == 0xfff) {\n        if (parse_adts_frame_header(ac, gb) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\\n");\n            err = -1;\n            goto fail;\n        }\n        if (ac->oc[1].m4ac.sampling_index > 12) {\n            av_log(ac->avctx, AV_LOG_ERROR, "invalid sampling rate index %d\\n", ac->oc[1].m4ac.sampling_index);\n            err = -1;\n            goto fail;\n        }\n    }\n    if (frame_configure_elements(avctx) < 0) {\n        err = -1;\n        goto fail;\n    }\n    ac->tags_mapped = 0;\n    while ((elem_type = get_bits(gb, 3)) != TYPE_END) {\n        elem_id = get_bits(gb, 4);\n        if (elem_type < TYPE_DSE) {\n            if (!(che=get_che(ac, elem_type, elem_id))) {\n                av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\\n",\n                       elem_type, elem_id);\n                err = -1;\n                goto fail;\n            }\n            samples = 1024;\n        }\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            audio_found = 1;\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, gb, che);\n            audio_found = 1;\n            break;\n        case TYPE_CCE:\n            err = decode_cce(ac, gb, che);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            audio_found = 1;\n            break;\n        case TYPE_DSE:\n            err = skip_data_stream_element(ac, gb);\n            break;\n        case TYPE_PCE: {\n            uint8_t layout_map[MAX_ELEM_ID*4][3];\n            int tags;\n            push_output_configuration(ac);\n            tags = decode_pce(avctx, &ac->oc[1].m4ac, layout_map, gb);\n            if (tags < 0) {\n                err = tags;\n                break;\n            }\n            if (pce_found) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Not evaluating a further program_config_element as this construct is dubious at best.\\n");\n                pop_output_configuration(ac);\n            } else {\n                err = output_configure(ac, layout_map, tags, OC_TRIAL_PCE, 1);\n                pce_found = 1;\n            }\n            break;\n        }\n        case TYPE_FIL:\n            if (elem_id == 15)\n                elem_id += get_bits(gb, 8) - 1;\n            if (get_bits_left(gb) < 8 * elem_id) {\n                    av_log(avctx, AV_LOG_ERROR, overread_err);\n                    err = -1;\n                    goto fail;\n            }\n            while (elem_id > 0)\n                elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);\n            err = 0;\n            break;\n        default:\n            err = -1;\n            break;\n        }\n        che_prev       = che;\n        elem_type_prev = elem_type;\n        if (err)\n            goto fail;\n        if (get_bits_left(gb) < 3) {\n            av_log(avctx, AV_LOG_ERROR, overread_err);\n            err = -1;\n            goto fail;\n        }\n    }\n    spectral_to_sample(ac);\n    multiplier = (ac->oc[1].m4ac.sbr == 1) ? ac->oc[1].m4ac.ext_sample_rate > ac->oc[1].m4ac.sample_rate : 0;\n    samples <<= multiplier;\n    if (samples) {\n        ac->frame.nb_samples = samples;\n        *(AVFrame *)data = ac->frame;\n    }\n    *got_frame_ptr = !!samples;\n    if (ac->oc[1].status && audio_found) {\n        avctx->sample_rate = ac->oc[1].m4ac.sample_rate << multiplier;\n        avctx->frame_size = samples;\n        ac->oc[1].status = OC_LOCKED;\n    }\n    return 0;\nfail:\n    pop_output_configuration(ac);\n    return err;\n}', 'static int parse_adts_frame_header(AACContext *ac, GetBitContext *gb)\n{\n    int size;\n    AACADTSHeaderInfo hdr_info;\n    uint8_t layout_map[MAX_ELEM_ID*4][3];\n    int layout_map_tags;\n    size = avpriv_aac_parse_header(gb, &hdr_info);\n    if (size > 0) {\n        if (hdr_info.num_aac_frames != 1) {\n            av_log_missing_feature(ac->avctx, "More than one AAC RDB per ADTS frame", 0);\n            return AVERROR_PATCHWELCOME;\n        }\n        push_output_configuration(ac);\n        if (hdr_info.chan_config) {\n            ac->oc[1].m4ac.chan_config = hdr_info.chan_config;\n            if (set_default_channel_config(ac->avctx, layout_map,\n                    &layout_map_tags, hdr_info.chan_config))\n                return -7;\n            if (output_configure(ac, layout_map, layout_map_tags,\n                                 FFMAX(ac->oc[1].status, OC_TRIAL_FRAME), 0))\n                return -7;\n        } else {\n            ac->oc[1].m4ac.chan_config = 0;\n        }\n        ac->oc[1].m4ac.sample_rate     = hdr_info.sample_rate;\n        ac->oc[1].m4ac.sampling_index  = hdr_info.sampling_index;\n        ac->oc[1].m4ac.object_type     = hdr_info.object_type;\n        if (ac->oc[0].status != OC_LOCKED ||\n            ac->oc[0].m4ac.chan_config != hdr_info.chan_config ||\n            ac->oc[0].m4ac.sample_rate != hdr_info.sample_rate) {\n            ac->oc[1].m4ac.sbr = -1;\n            ac->oc[1].m4ac.ps  = -1;\n        }\n        if (!hdr_info.crc_absent)\n            skip_bits(gb, 16);\n    }\n    return size;\n}', 'static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,\n                                    ChannelElement *che, enum RawDataBlockType elem_type)\n{\n    int crc_flag = 0;\n    int res = cnt;\n    switch (get_bits(gb, 4)) {\n    case EXT_SBR_DATA_CRC:\n        crc_flag++;\n    case EXT_SBR_DATA:\n        if (!che) {\n            av_log(ac->avctx, AV_LOG_ERROR, "SBR was found before the first channel element.\\n");\n            return res;\n        } else if (!ac->oc[1].m4ac.sbr) {\n            av_log(ac->avctx, AV_LOG_ERROR, "SBR signaled to be not-present but was found in the bitstream.\\n");\n            skip_bits_long(gb, 8 * cnt - 4);\n            return res;\n        } else if (ac->oc[1].m4ac.sbr == -1 && ac->oc[1].status == OC_LOCKED) {\n            av_log(ac->avctx, AV_LOG_ERROR, "Implicit SBR was found with a first occurrence after the first frame.\\n");\n            skip_bits_long(gb, 8 * cnt - 4);\n            return res;\n        } else if (ac->oc[1].m4ac.ps == -1 && ac->oc[1].status < OC_LOCKED && ac->avctx->channels == 1) {\n            ac->oc[1].m4ac.sbr = 1;\n            ac->oc[1].m4ac.ps = 1;\n            output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags,\n                             ac->oc[1].status, 1);\n        } else {\n            ac->oc[1].m4ac.sbr = 1;\n        }\n        res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);\n        break;\n    case EXT_DYNAMIC_RANGE:\n        res = decode_dynamic_range(&ac->che_drc, gb);\n        break;\n    case EXT_FILL:\n    case EXT_FILL_DATA:\n    case EXT_DATA_ELEMENT:\n    default:\n        skip_bits_long(gb, 8 * cnt - 4);\n        break;\n    };\n    return res;\n}', 'int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,\n                            GetBitContext *gb_host, int crc, int cnt, int id_aac)\n{\n    unsigned int num_sbr_bits = 0, num_align_bits;\n    unsigned bytes_read;\n    GetBitContext gbc = *gb_host, *gb = &gbc;\n    skip_bits_long(gb_host, cnt*8 - 4);\n    sbr->reset = 0;\n    if (!sbr->sample_rate)\n        sbr->sample_rate = 2 * ac->oc[1].m4ac.sample_rate;\n    if (!ac->oc[1].m4ac.ext_sample_rate)\n        ac->oc[1].m4ac.ext_sample_rate = 2 * ac->oc[1].m4ac.sample_rate;\n    if (crc) {\n        skip_bits(gb, 10);\n        num_sbr_bits += 10;\n    }\n    sbr->kx[0] = sbr->kx[1];\n    sbr->m[0] = sbr->m[1];\n    sbr->kx_and_m_pushed = 1;\n    num_sbr_bits++;\n    if (get_bits1(gb))\n        num_sbr_bits += read_sbr_header(sbr, gb);\n    if (sbr->reset)\n        sbr_reset(ac, sbr);\n    if (sbr->start)\n        num_sbr_bits  += read_sbr_data(ac, sbr, gb, id_aac);\n    num_align_bits = ((cnt << 3) - 4 - num_sbr_bits) & 7;\n    bytes_read = ((num_sbr_bits + num_align_bits + 4) >> 3);\n    if (bytes_read > cnt) {\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "Expected to read %d SBR bytes actually read %d.\\n", cnt, bytes_read);\n    }\n    return cnt;\n}', 'static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext *gb)\n{\n    unsigned int cnt = get_bits_count(gb);\n    uint8_t bs_header_extra_1;\n    uint8_t bs_header_extra_2;\n    int old_bs_limiter_bands = sbr->bs_limiter_bands;\n    SpectrumParameters old_spectrum_params;\n    sbr->start = 1;\n    memcpy(&old_spectrum_params, &sbr->spectrum_params, sizeof(SpectrumParameters));\n    sbr->bs_amp_res_header              = get_bits1(gb);\n    sbr->spectrum_params.bs_start_freq  = get_bits(gb, 4);\n    sbr->spectrum_params.bs_stop_freq   = get_bits(gb, 4);\n    sbr->spectrum_params.bs_xover_band  = get_bits(gb, 3);\n                                          skip_bits(gb, 2);\n    bs_header_extra_1 = get_bits1(gb);\n    bs_header_extra_2 = get_bits1(gb);\n    if (bs_header_extra_1) {\n        sbr->spectrum_params.bs_freq_scale  = get_bits(gb, 2);\n        sbr->spectrum_params.bs_alter_scale = get_bits1(gb);\n        sbr->spectrum_params.bs_noise_bands = get_bits(gb, 2);\n    } else {\n        sbr->spectrum_params.bs_freq_scale  = 2;\n        sbr->spectrum_params.bs_alter_scale = 1;\n        sbr->spectrum_params.bs_noise_bands = 2;\n    }\n    if (memcmp(&old_spectrum_params, &sbr->spectrum_params, sizeof(SpectrumParameters)))\n        sbr->reset = 1;\n    if (bs_header_extra_2) {\n        sbr->bs_limiter_bands  = get_bits(gb, 2);\n        sbr->bs_limiter_gains  = get_bits(gb, 2);\n        sbr->bs_interpol_freq  = get_bits1(gb);\n        sbr->bs_smoothing_mode = get_bits1(gb);\n    } else {\n        sbr->bs_limiter_bands  = 2;\n        sbr->bs_limiter_gains  = 2;\n        sbr->bs_interpol_freq  = 1;\n        sbr->bs_smoothing_mode = 1;\n    }\n    if (sbr->bs_limiter_bands != old_bs_limiter_bands && !sbr->reset)\n        sbr_make_f_tablelim(sbr);\n    return get_bits_count(gb) - cnt;\n}', 'static void sbr_make_f_tablelim(SpectralBandReplication *sbr)\n{\n    int k;\n    if (sbr->bs_limiter_bands > 0) {\n        static const float bands_warped[3] = { 1.32715174233856803909f,\n                                               1.18509277094158210129f,\n                                               1.11987160404675912501f };\n        const float lim_bands_per_octave_warped = bands_warped[sbr->bs_limiter_bands - 1];\n        int16_t patch_borders[7];\n        uint16_t *in = sbr->f_tablelim + 1, *out = sbr->f_tablelim;\n        patch_borders[0] = sbr->kx[1];\n        for (k = 1; k <= sbr->num_patches; k++)\n            patch_borders[k] = patch_borders[k-1] + sbr->patch_num_subbands[k-1];\n        memcpy(sbr->f_tablelim, sbr->f_tablelow,\n               (sbr->n[0] + 1) * sizeof(sbr->f_tablelow[0]));\n        if (sbr->num_patches > 1)\n            memcpy(sbr->f_tablelim + sbr->n[0] + 1, patch_borders + 1,\n                   (sbr->num_patches - 1) * sizeof(patch_borders[0]));\n        qsort(sbr->f_tablelim, sbr->num_patches + sbr->n[0],\n              sizeof(sbr->f_tablelim[0]),\n              qsort_comparison_function_int16);\n        sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;\n        while (out < sbr->f_tablelim + sbr->n_lim) {\n            if (*in >= *out * lim_bands_per_octave_warped) {\n                *++out = *in++;\n            } else if (*in == *out ||\n                !in_table_int16(patch_borders, sbr->num_patches, *in)) {\n                in++;\n                sbr->n_lim--;\n            } else if (!in_table_int16(patch_borders, sbr->num_patches, *out)) {\n                *out = *in++;\n                sbr->n_lim--;\n            } else {\n                *++out = *in++;\n            }\n        }\n    } else {\n        sbr->f_tablelim[0] = sbr->f_tablelow[0];\n        sbr->f_tablelim[1] = sbr->f_tablelow[sbr->n[0]];\n        sbr->n_lim = 1;\n    }\n}']