libavcodec/amrnbdec.c:1000: error: Buffer Overrun L2
  Offset: [-oo, 14] Size: 8.

libavcodec/amrnbdec.c:953:25: <Offset trace>
951.     buf_out = (float *)p->avframe.data[0];
952. 
953.     p->cur_frame_mode = unpack_bitstream(p, buf, buf_size);
                             ^
954.     if (p->cur_frame_mode == NO_DATA) {
955.         av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\n");

libavcodec/amrnbdec.c:953:25: Call
951.     buf_out = (float *)p->avframe.data[0];
952. 
953.     p->cur_frame_mode = unpack_bitstream(p, buf, buf_size);
                             ^
954.     if (p->cur_frame_mode == NO_DATA) {
955.         av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\n");

libavcodec/amrnbdec.c:204:9: Assignment
  202. 
  203.     if (mode >= N_MODES || buf_size < frame_sizes_nb[mode] + 1) {
  204.         return NO_DATA;
               ^
  205.     }
  206. 

libavcodec/amrnbdec.c:953:5: Assignment
951.     buf_out = (float *)p->avframe.data[0];
952. 
953.     p->cur_frame_mode = unpack_bitstream(p, buf, buf_size);
         ^
954.     if (p->cur_frame_mode == NO_DATA) {
955.         av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\n");

libavcodec/amrnbdec.c:974:9: Call
972.         const AMRNBSubframe *amr_subframe = &p->frame.subframe[subframe];
973. 
974.         decode_pitch_vector(p, amr_subframe, subframe);
             ^
975. 
976.         decode_fixed_sparse(&fixed_sparse, amr_subframe->pulses,

libavcodec/amrnbdec.c:377:1: Parameter `p->cur_frame_mode`
  375. }
  376. 
  377. static void decode_pitch_vector(AMRContext *p,
       ^
  378.                                 const AMRNBSubframe *amr_subframe,
  379.                                 const int subframe)

libavcodec/amrnbdata.h:1458:1: <Length trace>
1456. 
1457. /** desired mean innovation energy, indexed by active mode */
1458. static const float energy_mean[8] = {
      ^
1459.     33.0, 33.0, 33.0, 28.75, 30.0, 36.0, 33.0, 36.0
1460. };

libavcodec/amrnbdata.h:1458:1: Array declaration
1456. 
1457. /** desired mean innovation energy, indexed by active mode */
1458. static const float energy_mean[8] = {
      ^
1459.     33.0, 33.0, 33.0, 28.75, 30.0, 36.0, 33.0, 36.0
1460. };

libavcodec/amrnbdec.c:1000:24: Array access: Offset: [-oo, 14] Size: 8
 998.                                        AMR_SUBFRAME_SIZE)/AMR_SUBFRAME_SIZE,
 999.                        p->prediction_error,
1000.                        energy_mean[p->cur_frame_mode], energy_pred_fac);
                             ^
1001. 
1002.         // The excitation feedback is calculated without any processing such

static int amrnb_decode_frame(AVCodecContext *avctx, void *data,
                              int *got_frame_ptr, AVPacket *avpkt)
{
    AMRContext *p = avctx->priv_data;
    const uint8_t *buf = avpkt->data;
    int buf_size       = avpkt->size;
    float *buf_out;
    int i, subframe, ret;
    float fixed_gain_factor;
    AMRFixed fixed_sparse = {0};
    float spare_vector[AMR_SUBFRAME_SIZE];
    float synth_fixed_gain;
    const float *synth_fixed_vector;
    p->avframe.nb_samples = AMR_BLOCK_SIZE;
    if ((ret = avctx->get_buffer(avctx, &p->avframe)) < 0) {
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        return ret;
    }
    buf_out = (float *)p->avframe.data[0];
    p->cur_frame_mode = unpack_bitstream(p, buf, buf_size);
    if (p->cur_frame_mode == NO_DATA) {
        av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\n");
        return AVERROR_INVALIDDATA;
    }
    if (p->cur_frame_mode == MODE_DTX) {
        av_log_missing_feature(avctx, "dtx mode", 1);
        return -1;
    }
    if (p->cur_frame_mode == MODE_12k2) {
        lsf2lsp_5(p);
    } else
        lsf2lsp_3(p);
    for (i = 0; i < 4; i++)
        ff_acelp_lspd2lpc(p->lsp[i], p->lpc[i], 5);
    for (subframe = 0; subframe < 4; subframe++) {
        const AMRNBSubframe *amr_subframe = &p->frame.subframe[subframe];
        decode_pitch_vector(p, amr_subframe, subframe);
        decode_fixed_sparse(&fixed_sparse, amr_subframe->pulses,
                            p->cur_frame_mode, subframe);
        decode_gains(p, amr_subframe, p->cur_frame_mode, subframe,
                     &fixed_gain_factor);
        pitch_sharpening(p, subframe, p->cur_frame_mode, &fixed_sparse);
        if (fixed_sparse.pitch_lag == 0) {
            av_log(avctx, AV_LOG_ERROR, "The file is corrupted, pitch_lag = 0 is not allowed\n");
            return AVERROR_INVALIDDATA;
        }
        ff_set_fixed_vector(p->fixed_vector, &fixed_sparse, 1.0,
                            AMR_SUBFRAME_SIZE);
        p->fixed_gain[4] =
            ff_amr_set_fixed_gain(fixed_gain_factor,
                       ff_dot_productf(p->fixed_vector, p->fixed_vector,
                                       AMR_SUBFRAME_SIZE)/AMR_SUBFRAME_SIZE,
                       p->prediction_error,
                       energy_mean[p->cur_frame_mode], energy_pred_fac);
        for (i = 0; i < AMR_SUBFRAME_SIZE; i++)
            p->excitation[i] *= p->pitch_gain[4];
        ff_set_fixed_vector(p->excitation, &fixed_sparse, p->fixed_gain[4],
                            AMR_SUBFRAME_SIZE);
        for (i = 0; i < AMR_SUBFRAME_SIZE; i++)
            p->excitation[i] = truncf(p->excitation[i]);
        synth_fixed_gain = fixed_gain_smooth(p, p->lsf_q[subframe],
                                             p->lsf_avg, p->cur_frame_mode);
        synth_fixed_vector = anti_sparseness(p, &fixed_sparse, p->fixed_vector,
                                             synth_fixed_gain, spare_vector);
        if (synthesis(p, p->lpc[subframe], synth_fixed_gain,
                      synth_fixed_vector, &p->samples_in[LP_FILTER_ORDER], 0))
            synthesis(p, p->lpc[subframe], synth_fixed_gain,
                      synth_fixed_vector, &p->samples_in[LP_FILTER_ORDER], 1);
        postfilter(p, p->lpc[subframe], buf_out + subframe * AMR_SUBFRAME_SIZE);
        ff_clear_fixed_vector(p->fixed_vector, &fixed_sparse, AMR_SUBFRAME_SIZE);
        update_state(p);
    }
    ff_acelp_apply_order_2_transfer_function(buf_out, buf_out, highpass_zeros,
                                             highpass_poles,
                                             highpass_gain * AMR_SAMPLE_SCALE,
                                             p->high_pass_mem, AMR_BLOCK_SIZE);
    ff_weighted_vector_sumf(p->lsf_avg, p->lsf_avg, p->lsf_q[3],
                            0.84, 0.16, LP_FILTER_ORDER);
    *got_frame_ptr   = 1;
    *(AVFrame *)data = p->avframe;
    return frame_sizes_nb[p->cur_frame_mode] + 1;
}
['static int amrnb_decode_frame(AVCodecContext *avctx, void *data,\n                              int *got_frame_ptr, AVPacket *avpkt)\n{\n    AMRContext *p = avctx->priv_data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    float *buf_out;\n    int i, subframe, ret;\n    float fixed_gain_factor;\n    AMRFixed fixed_sparse = {0};\n    float spare_vector[AMR_SUBFRAME_SIZE];\n    float synth_fixed_gain;\n    const float *synth_fixed_vector;\n    p->avframe.nb_samples = AMR_BLOCK_SIZE;\n    if ((ret = avctx->get_buffer(avctx, &p->avframe)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    buf_out = (float *)p->avframe.data[0];\n    p->cur_frame_mode = unpack_bitstream(p, buf, buf_size);\n    if (p->cur_frame_mode == NO_DATA) {\n        av_log(avctx, AV_LOG_ERROR, "Corrupt bitstream\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (p->cur_frame_mode == MODE_DTX) {\n        av_log_missing_feature(avctx, "dtx mode", 1);\n        return -1;\n    }\n    if (p->cur_frame_mode == MODE_12k2) {\n        lsf2lsp_5(p);\n    } else\n        lsf2lsp_3(p);\n    for (i = 0; i < 4; i++)\n        ff_acelp_lspd2lpc(p->lsp[i], p->lpc[i], 5);\n    for (subframe = 0; subframe < 4; subframe++) {\n        const AMRNBSubframe *amr_subframe = &p->frame.subframe[subframe];\n        decode_pitch_vector(p, amr_subframe, subframe);\n        decode_fixed_sparse(&fixed_sparse, amr_subframe->pulses,\n                            p->cur_frame_mode, subframe);\n        decode_gains(p, amr_subframe, p->cur_frame_mode, subframe,\n                     &fixed_gain_factor);\n        pitch_sharpening(p, subframe, p->cur_frame_mode, &fixed_sparse);\n        if (fixed_sparse.pitch_lag == 0) {\n            av_log(avctx, AV_LOG_ERROR, "The file is corrupted, pitch_lag = 0 is not allowed\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        ff_set_fixed_vector(p->fixed_vector, &fixed_sparse, 1.0,\n                            AMR_SUBFRAME_SIZE);\n        p->fixed_gain[4] =\n            ff_amr_set_fixed_gain(fixed_gain_factor,\n                       ff_dot_productf(p->fixed_vector, p->fixed_vector,\n                                       AMR_SUBFRAME_SIZE)/AMR_SUBFRAME_SIZE,\n                       p->prediction_error,\n                       energy_mean[p->cur_frame_mode], energy_pred_fac);\n        for (i = 0; i < AMR_SUBFRAME_SIZE; i++)\n            p->excitation[i] *= p->pitch_gain[4];\n        ff_set_fixed_vector(p->excitation, &fixed_sparse, p->fixed_gain[4],\n                            AMR_SUBFRAME_SIZE);\n        for (i = 0; i < AMR_SUBFRAME_SIZE; i++)\n            p->excitation[i] = truncf(p->excitation[i]);\n        synth_fixed_gain = fixed_gain_smooth(p, p->lsf_q[subframe],\n                                             p->lsf_avg, p->cur_frame_mode);\n        synth_fixed_vector = anti_sparseness(p, &fixed_sparse, p->fixed_vector,\n                                             synth_fixed_gain, spare_vector);\n        if (synthesis(p, p->lpc[subframe], synth_fixed_gain,\n                      synth_fixed_vector, &p->samples_in[LP_FILTER_ORDER], 0))\n            synthesis(p, p->lpc[subframe], synth_fixed_gain,\n                      synth_fixed_vector, &p->samples_in[LP_FILTER_ORDER], 1);\n        postfilter(p, p->lpc[subframe], buf_out + subframe * AMR_SUBFRAME_SIZE);\n        ff_clear_fixed_vector(p->fixed_vector, &fixed_sparse, AMR_SUBFRAME_SIZE);\n        update_state(p);\n    }\n    ff_acelp_apply_order_2_transfer_function(buf_out, buf_out, highpass_zeros,\n                                             highpass_poles,\n                                             highpass_gain * AMR_SAMPLE_SCALE,\n                                             p->high_pass_mem, AMR_BLOCK_SIZE);\n    ff_weighted_vector_sumf(p->lsf_avg, p->lsf_avg, p->lsf_q[3],\n                            0.84, 0.16, LP_FILTER_ORDER);\n    *got_frame_ptr   = 1;\n    *(AVFrame *)data = p->avframe;\n    return frame_sizes_nb[p->cur_frame_mode] + 1;\n}', 'static enum Mode unpack_bitstream(AMRContext *p, const uint8_t *buf,\n                                  int buf_size)\n{\n    GetBitContext gb;\n    enum Mode mode;\n    init_get_bits(&gb, buf, buf_size * 8);\n    skip_bits(&gb, 1);\n    mode = get_bits(&gb, 4);\n    p->bad_frame_indicator = !get_bits1(&gb);\n    skip_bits(&gb, 2);\n    if (mode >= N_MODES || buf_size < frame_sizes_nb[mode] + 1) {\n        return NO_DATA;\n    }\n    if (mode < MODE_DTX)\n        ff_amr_bit_reorder((uint16_t *) &p->frame, sizeof(AMRNBFrame), buf + 1,\n                           amr_unpacking_bitmaps_per_mode[mode]);\n    return mode;\n}', 'static void decode_pitch_vector(AMRContext *p,\n                                const AMRNBSubframe *amr_subframe,\n                                const int subframe)\n{\n    int pitch_lag_int, pitch_lag_frac;\n    enum Mode mode = p->cur_frame_mode;\n    if (p->cur_frame_mode == MODE_12k2) {\n        decode_pitch_lag_1_6(&pitch_lag_int, &pitch_lag_frac,\n                             amr_subframe->p_lag, p->pitch_lag_int,\n                             subframe);\n    } else\n        ff_decode_pitch_lag(&pitch_lag_int, &pitch_lag_frac,\n                            amr_subframe->p_lag,\n                            p->pitch_lag_int, subframe,\n                            mode != MODE_4k75 && mode != MODE_5k15,\n                            mode <= MODE_6k7 ? 4 : (mode == MODE_7k95 ? 5 : 6));\n    p->pitch_lag_int = pitch_lag_int;\n    pitch_lag_frac <<= (p->cur_frame_mode != MODE_12k2);\n    pitch_lag_int += pitch_lag_frac > 0;\n    ff_acelp_interpolatef(p->excitation, p->excitation + 1 - pitch_lag_int,\n                          ff_b60_sinc, 6,\n                          pitch_lag_frac + 6 - 6*(pitch_lag_frac > 0),\n                          10, AMR_SUBFRAME_SIZE);\n    memcpy(p->pitch_vector, p->excitation, AMR_SUBFRAME_SIZE * sizeof(float));\n}']