libavcodec/mpegaudiodec.c:1564: error: Buffer Overrun L3
  Offset added: 2304 Size: [0, +oo].

libavcodec/mpegaudiodec.c:1688:13: <Length trace>
1686. 
1687.         if (s->nb_channels == 2)
1688.             compute_stereo(s, &s->granules[0][gr], &s->granules[1][gr]);
                  ^
1689. 
1690.         for (ch = 0; ch < s->nb_channels; ch++) {

libavcodec/mpegaudiodec.c:1688:13: Call
1686. 
1687.         if (s->nb_channels == 2)
1688.             compute_stereo(s, &s->granules[0][gr], &s->granules[1][gr]);
                  ^
1689. 
1690.         for (ch = 0; ch < s->nb_channels; ch++) {

libavcodec/mpegaudiodec.c:1195:1: Parameter `g0->sb_hybrid[*]`
  1193. #define ISQRT2 FIXR(0.70710678118654752440)
  1194. 
  1195. static void compute_stereo(MPADecodeContext *s, GranuleDef *g0, GranuleDef *g1)
        ^
  1196. {
  1197.     int i, j, k, l;

libavcodec/mpegaudiodec.c:1564:17: Array access: Offset added: 2304 Size: [0, +oo]
1562.                        main_data_begin, s->last_buf_size, gr);
1563.                 skip_bits_long(&s->gb, g->part2_3_length);
1564.                 memset(g->sb_hybrid, 0, sizeof(g->sb_hybrid));
                      ^
1565.                 if (get_bits_count(&s->gb) >= s->gb.size_in_bits && s->in_gb.buffer) {
1566.                     skip_bits_long(&s->in_gb, get_bits_count(&s->gb) - s->gb.size_in_bits);

static int mp_decode_layer3(MPADecodeContext *s)
{
    int nb_granules, main_data_begin;
    int gr, ch, blocksplit_flag, i, j, k, n, bits_pos;
    GranuleDef *g;
    int16_t exponents[576];
    if (s->lsf) {
        main_data_begin = get_bits(&s->gb, 8);
        skip_bits(&s->gb, s->nb_channels);
        nb_granules = 1;
    } else {
        main_data_begin = get_bits(&s->gb, 9);
        if (s->nb_channels == 2)
            skip_bits(&s->gb, 3);
        else
            skip_bits(&s->gb, 5);
        nb_granules = 2;
        for (ch = 0; ch < s->nb_channels; ch++) {
            s->granules[ch][0].scfsi = 0;
            s->granules[ch][1].scfsi = get_bits(&s->gb, 4);
        }
    }
    for (gr = 0; gr < nb_granules; gr++) {
        for (ch = 0; ch < s->nb_channels; ch++) {
            av_dlog(s->avctx, "gr=%d ch=%d: side_info\n", gr, ch);
            g = &s->granules[ch][gr];
            g->part2_3_length = get_bits(&s->gb, 12);
            g->big_values     = get_bits(&s->gb,  9);
            if (g->big_values > 288) {
                av_log(s->avctx, AV_LOG_ERROR, "big_values too big\n");
                return AVERROR_INVALIDDATA;
            }
            g->global_gain = get_bits(&s->gb, 8);
            if ((s->mode_ext & (MODE_EXT_MS_STEREO | MODE_EXT_I_STEREO)) ==
                MODE_EXT_MS_STEREO)
                g->global_gain -= 2;
            if (s->lsf)
                g->scalefac_compress = get_bits(&s->gb, 9);
            else
                g->scalefac_compress = get_bits(&s->gb, 4);
            blocksplit_flag = get_bits1(&s->gb);
            if (blocksplit_flag) {
                g->block_type = get_bits(&s->gb, 2);
                if (g->block_type == 0) {
                    av_log(s->avctx, AV_LOG_ERROR, "invalid block type\n");
                    return AVERROR_INVALIDDATA;
                }
                g->switch_point = get_bits1(&s->gb);
                for (i = 0; i < 2; i++)
                    g->table_select[i] = get_bits(&s->gb, 5);
                for (i = 0; i < 3; i++)
                    g->subblock_gain[i] = get_bits(&s->gb, 3);
                ff_init_short_region(s, g);
            } else {
                int region_address1, region_address2;
                g->block_type = 0;
                g->switch_point = 0;
                for (i = 0; i < 3; i++)
                    g->table_select[i] = get_bits(&s->gb, 5);
                region_address1 = get_bits(&s->gb, 4);
                region_address2 = get_bits(&s->gb, 3);
                av_dlog(s->avctx, "region1=%d region2=%d\n",
                        region_address1, region_address2);
                ff_init_long_region(s, g, region_address1, region_address2);
            }
            ff_region_offset2size(g);
            ff_compute_band_indexes(s, g);
            g->preflag = 0;
            if (!s->lsf)
                g->preflag = get_bits1(&s->gb);
            g->scalefac_scale     = get_bits1(&s->gb);
            g->count1table_select = get_bits1(&s->gb);
            av_dlog(s->avctx, "block_type=%d switch_point=%d\n",
                    g->block_type, g->switch_point);
        }
    }
    if (!s->adu_mode) {
        const uint8_t *ptr = s->gb.buffer + (get_bits_count(&s->gb)>>3);
        assert((get_bits_count(&s->gb) & 7) == 0);
        av_dlog(s->avctx, "seekback: %d\n", main_data_begin);
        memcpy(s->last_buf + s->last_buf_size, ptr, EXTRABYTES);
        s->in_gb = s->gb;
        init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);
#if !UNCHECKED_BITSTREAM_READER
        s->gb.size_in_bits_plus8 += EXTRABYTES * 8;
#endif
        skip_bits_long(&s->gb, 8*(s->last_buf_size - main_data_begin));
    }
    for (gr = 0; gr < nb_granules; gr++) {
        for (ch = 0; ch < s->nb_channels; ch++) {
            g = &s->granules[ch][gr];
            if (get_bits_count(&s->gb) < 0) {
                av_log(s->avctx, AV_LOG_DEBUG, "mdb:%d, lastbuf:%d skipping granule %d\n",
                       main_data_begin, s->last_buf_size, gr);
                skip_bits_long(&s->gb, g->part2_3_length);
                memset(g->sb_hybrid, 0, sizeof(g->sb_hybrid));
                if (get_bits_count(&s->gb) >= s->gb.size_in_bits && s->in_gb.buffer) {
                    skip_bits_long(&s->in_gb, get_bits_count(&s->gb) - s->gb.size_in_bits);
                    s->gb           = s->in_gb;
                    s->in_gb.buffer = NULL;
                }
                continue;
            }
            bits_pos = get_bits_count(&s->gb);
            if (!s->lsf) {
                uint8_t *sc;
                int slen, slen1, slen2;
                slen1 = slen_table[0][g->scalefac_compress];
                slen2 = slen_table[1][g->scalefac_compress];
                av_dlog(s->avctx, "slen1=%d slen2=%d\n", slen1, slen2);
                if (g->block_type == 2) {
                    n = g->switch_point ? 17 : 18;
                    j = 0;
                    if (slen1) {
                        for (i = 0; i < n; i++)
                            g->scale_factors[j++] = get_bits(&s->gb, slen1);
                    } else {
                        for (i = 0; i < n; i++)
                            g->scale_factors[j++] = 0;
                    }
                    if (slen2) {
                        for (i = 0; i < 18; i++)
                            g->scale_factors[j++] = get_bits(&s->gb, slen2);
                        for (i = 0; i < 3; i++)
                            g->scale_factors[j++] = 0;
                    } else {
                        for (i = 0; i < 21; i++)
                            g->scale_factors[j++] = 0;
                    }
                } else {
                    sc = s->granules[ch][0].scale_factors;
                    j = 0;
                    for (k = 0; k < 4; k++) {
                        n = k == 0 ? 6 : 5;
                        if ((g->scfsi & (0x8 >> k)) == 0) {
                            slen = (k < 2) ? slen1 : slen2;
                            if (slen) {
                                for (i = 0; i < n; i++)
                                    g->scale_factors[j++] = get_bits(&s->gb, slen);
                            } else {
                                for (i = 0; i < n; i++)
                                    g->scale_factors[j++] = 0;
                            }
                        } else {
                            for (i = 0; i < n; i++) {
                                g->scale_factors[j] = sc[j];
                                j++;
                            }
                        }
                    }
                    g->scale_factors[j++] = 0;
                }
            } else {
                int tindex, tindex2, slen[4], sl, sf;
                if (g->block_type == 2)
                    tindex = g->switch_point ? 2 : 1;
                else
                    tindex = 0;
                sf = g->scalefac_compress;
                if ((s->mode_ext & MODE_EXT_I_STEREO) && ch == 1) {
                    sf >>= 1;
                    if (sf < 180) {
                        lsf_sf_expand(slen, sf, 6, 6, 0);
                        tindex2 = 3;
                    } else if (sf < 244) {
                        lsf_sf_expand(slen, sf - 180, 4, 4, 0);
                        tindex2 = 4;
                    } else {
                        lsf_sf_expand(slen, sf - 244, 3, 0, 0);
                        tindex2 = 5;
                    }
                } else {
                    if (sf < 400) {
                        lsf_sf_expand(slen, sf, 5, 4, 4);
                        tindex2 = 0;
                    } else if (sf < 500) {
                        lsf_sf_expand(slen, sf - 400, 5, 4, 0);
                        tindex2 = 1;
                    } else {
                        lsf_sf_expand(slen, sf - 500, 3, 0, 0);
                        tindex2 = 2;
                        g->preflag = 1;
                    }
                }
                j = 0;
                for (k = 0; k < 4; k++) {
                    n  = lsf_nsf_table[tindex2][tindex][k];
                    sl = slen[k];
                    if (sl) {
                        for (i = 0; i < n; i++)
                            g->scale_factors[j++] = get_bits(&s->gb, sl);
                    } else {
                        for (i = 0; i < n; i++)
                            g->scale_factors[j++] = 0;
                    }
                }
                for (; j < 40; j++)
                    g->scale_factors[j] = 0;
            }
            exponents_from_scale_factors(s, g, exponents);
            huffman_decode(s, g, exponents, bits_pos + g->part2_3_length);
        }
        if (s->nb_channels == 2)
            compute_stereo(s, &s->granules[0][gr], &s->granules[1][gr]);
        for (ch = 0; ch < s->nb_channels; ch++) {
            g = &s->granules[ch][gr];
            reorder_block(s, g);
            compute_antialias(s, g);
            compute_imdct(s, g, &s->sb_samples[ch][18 * gr][0], s->mdct_buf[ch]);
        }
    }
    if (get_bits_count(&s->gb) < 0)
        skip_bits_long(&s->gb, -get_bits_count(&s->gb));
    return nb_granules * 18;
}
['static int mp_decode_layer3(MPADecodeContext *s)\n{\n    int nb_granules, main_data_begin;\n    int gr, ch, blocksplit_flag, i, j, k, n, bits_pos;\n    GranuleDef *g;\n    int16_t exponents[576];\n    if (s->lsf) {\n        main_data_begin = get_bits(&s->gb, 8);\n        skip_bits(&s->gb, s->nb_channels);\n        nb_granules = 1;\n    } else {\n        main_data_begin = get_bits(&s->gb, 9);\n        if (s->nb_channels == 2)\n            skip_bits(&s->gb, 3);\n        else\n            skip_bits(&s->gb, 5);\n        nb_granules = 2;\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            s->granules[ch][0].scfsi = 0;\n            s->granules[ch][1].scfsi = get_bits(&s->gb, 4);\n        }\n    }\n    for (gr = 0; gr < nb_granules; gr++) {\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            av_dlog(s->avctx, "gr=%d ch=%d: side_info\\n", gr, ch);\n            g = &s->granules[ch][gr];\n            g->part2_3_length = get_bits(&s->gb, 12);\n            g->big_values     = get_bits(&s->gb,  9);\n            if (g->big_values > 288) {\n                av_log(s->avctx, AV_LOG_ERROR, "big_values too big\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            g->global_gain = get_bits(&s->gb, 8);\n            if ((s->mode_ext & (MODE_EXT_MS_STEREO | MODE_EXT_I_STEREO)) ==\n                MODE_EXT_MS_STEREO)\n                g->global_gain -= 2;\n            if (s->lsf)\n                g->scalefac_compress = get_bits(&s->gb, 9);\n            else\n                g->scalefac_compress = get_bits(&s->gb, 4);\n            blocksplit_flag = get_bits1(&s->gb);\n            if (blocksplit_flag) {\n                g->block_type = get_bits(&s->gb, 2);\n                if (g->block_type == 0) {\n                    av_log(s->avctx, AV_LOG_ERROR, "invalid block type\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                g->switch_point = get_bits1(&s->gb);\n                for (i = 0; i < 2; i++)\n                    g->table_select[i] = get_bits(&s->gb, 5);\n                for (i = 0; i < 3; i++)\n                    g->subblock_gain[i] = get_bits(&s->gb, 3);\n                ff_init_short_region(s, g);\n            } else {\n                int region_address1, region_address2;\n                g->block_type = 0;\n                g->switch_point = 0;\n                for (i = 0; i < 3; i++)\n                    g->table_select[i] = get_bits(&s->gb, 5);\n                region_address1 = get_bits(&s->gb, 4);\n                region_address2 = get_bits(&s->gb, 3);\n                av_dlog(s->avctx, "region1=%d region2=%d\\n",\n                        region_address1, region_address2);\n                ff_init_long_region(s, g, region_address1, region_address2);\n            }\n            ff_region_offset2size(g);\n            ff_compute_band_indexes(s, g);\n            g->preflag = 0;\n            if (!s->lsf)\n                g->preflag = get_bits1(&s->gb);\n            g->scalefac_scale     = get_bits1(&s->gb);\n            g->count1table_select = get_bits1(&s->gb);\n            av_dlog(s->avctx, "block_type=%d switch_point=%d\\n",\n                    g->block_type, g->switch_point);\n        }\n    }\n    if (!s->adu_mode) {\n        const uint8_t *ptr = s->gb.buffer + (get_bits_count(&s->gb)>>3);\n        assert((get_bits_count(&s->gb) & 7) == 0);\n        av_dlog(s->avctx, "seekback: %d\\n", main_data_begin);\n        memcpy(s->last_buf + s->last_buf_size, ptr, EXTRABYTES);\n        s->in_gb = s->gb;\n        init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);\n#if !UNCHECKED_BITSTREAM_READER\n        s->gb.size_in_bits_plus8 += EXTRABYTES * 8;\n#endif\n        skip_bits_long(&s->gb, 8*(s->last_buf_size - main_data_begin));\n    }\n    for (gr = 0; gr < nb_granules; gr++) {\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            g = &s->granules[ch][gr];\n            if (get_bits_count(&s->gb) < 0) {\n                av_log(s->avctx, AV_LOG_DEBUG, "mdb:%d, lastbuf:%d skipping granule %d\\n",\n                       main_data_begin, s->last_buf_size, gr);\n                skip_bits_long(&s->gb, g->part2_3_length);\n                memset(g->sb_hybrid, 0, sizeof(g->sb_hybrid));\n                if (get_bits_count(&s->gb) >= s->gb.size_in_bits && s->in_gb.buffer) {\n                    skip_bits_long(&s->in_gb, get_bits_count(&s->gb) - s->gb.size_in_bits);\n                    s->gb           = s->in_gb;\n                    s->in_gb.buffer = NULL;\n                }\n                continue;\n            }\n            bits_pos = get_bits_count(&s->gb);\n            if (!s->lsf) {\n                uint8_t *sc;\n                int slen, slen1, slen2;\n                slen1 = slen_table[0][g->scalefac_compress];\n                slen2 = slen_table[1][g->scalefac_compress];\n                av_dlog(s->avctx, "slen1=%d slen2=%d\\n", slen1, slen2);\n                if (g->block_type == 2) {\n                    n = g->switch_point ? 17 : 18;\n                    j = 0;\n                    if (slen1) {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, slen1);\n                    } else {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                    if (slen2) {\n                        for (i = 0; i < 18; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, slen2);\n                        for (i = 0; i < 3; i++)\n                            g->scale_factors[j++] = 0;\n                    } else {\n                        for (i = 0; i < 21; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                } else {\n                    sc = s->granules[ch][0].scale_factors;\n                    j = 0;\n                    for (k = 0; k < 4; k++) {\n                        n = k == 0 ? 6 : 5;\n                        if ((g->scfsi & (0x8 >> k)) == 0) {\n                            slen = (k < 2) ? slen1 : slen2;\n                            if (slen) {\n                                for (i = 0; i < n; i++)\n                                    g->scale_factors[j++] = get_bits(&s->gb, slen);\n                            } else {\n                                for (i = 0; i < n; i++)\n                                    g->scale_factors[j++] = 0;\n                            }\n                        } else {\n                            for (i = 0; i < n; i++) {\n                                g->scale_factors[j] = sc[j];\n                                j++;\n                            }\n                        }\n                    }\n                    g->scale_factors[j++] = 0;\n                }\n            } else {\n                int tindex, tindex2, slen[4], sl, sf;\n                if (g->block_type == 2)\n                    tindex = g->switch_point ? 2 : 1;\n                else\n                    tindex = 0;\n                sf = g->scalefac_compress;\n                if ((s->mode_ext & MODE_EXT_I_STEREO) && ch == 1) {\n                    sf >>= 1;\n                    if (sf < 180) {\n                        lsf_sf_expand(slen, sf, 6, 6, 0);\n                        tindex2 = 3;\n                    } else if (sf < 244) {\n                        lsf_sf_expand(slen, sf - 180, 4, 4, 0);\n                        tindex2 = 4;\n                    } else {\n                        lsf_sf_expand(slen, sf - 244, 3, 0, 0);\n                        tindex2 = 5;\n                    }\n                } else {\n                    if (sf < 400) {\n                        lsf_sf_expand(slen, sf, 5, 4, 4);\n                        tindex2 = 0;\n                    } else if (sf < 500) {\n                        lsf_sf_expand(slen, sf - 400, 5, 4, 0);\n                        tindex2 = 1;\n                    } else {\n                        lsf_sf_expand(slen, sf - 500, 3, 0, 0);\n                        tindex2 = 2;\n                        g->preflag = 1;\n                    }\n                }\n                j = 0;\n                for (k = 0; k < 4; k++) {\n                    n  = lsf_nsf_table[tindex2][tindex][k];\n                    sl = slen[k];\n                    if (sl) {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, sl);\n                    } else {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                }\n                for (; j < 40; j++)\n                    g->scale_factors[j] = 0;\n            }\n            exponents_from_scale_factors(s, g, exponents);\n            huffman_decode(s, g, exponents, bits_pos + g->part2_3_length);\n        }\n        if (s->nb_channels == 2)\n            compute_stereo(s, &s->granules[0][gr], &s->granules[1][gr]);\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            g = &s->granules[ch][gr];\n            reorder_block(s, g);\n            compute_antialias(s, g);\n            compute_imdct(s, g, &s->sb_samples[ch][18 * gr][0], s->mdct_buf[ch]);\n        }\n    }\n    if (get_bits_count(&s->gb) < 0)\n        skip_bits_long(&s->gb, -get_bits_count(&s->gb));\n    return nb_granules * 18;\n}', 'static void compute_stereo(MPADecodeContext *s, GranuleDef *g0, GranuleDef *g1)\n{\n    int i, j, k, l;\n    int sf_max, sf, len, non_zero_found;\n    INTFLOAT (*is_tab)[16], *tab0, *tab1, tmp0, tmp1, v1, v2;\n    int non_zero_found_short[3];\n    if (s->mode_ext & MODE_EXT_I_STEREO) {\n        if (!s->lsf) {\n            is_tab = is_table;\n            sf_max = 7;\n        } else {\n            is_tab = is_table_lsf[g1->scalefac_compress & 1];\n            sf_max = 16;\n        }\n        tab0 = g0->sb_hybrid + 576;\n        tab1 = g1->sb_hybrid + 576;\n        non_zero_found_short[0] = 0;\n        non_zero_found_short[1] = 0;\n        non_zero_found_short[2] = 0;\n        k = (13 - g1->short_start) * 3 + g1->long_end - 3;\n        for (i = 12; i >= g1->short_start; i--) {\n            if (i != 11)\n                k -= 3;\n            len = band_size_short[s->sample_rate_index][i];\n            for (l = 2; l >= 0; l--) {\n                tab0 -= len;\n                tab1 -= len;\n                if (!non_zero_found_short[l]) {\n                    for (j = 0; j < len; j++) {\n                        if (tab1[j] != 0) {\n                            non_zero_found_short[l] = 1;\n                            goto found1;\n                        }\n                    }\n                    sf = g1->scale_factors[k + l];\n                    if (sf >= sf_max)\n                        goto found1;\n                    v1 = is_tab[0][sf];\n                    v2 = is_tab[1][sf];\n                    for (j = 0; j < len; j++) {\n                        tmp0    = tab0[j];\n                        tab0[j] = MULLx(tmp0, v1, FRAC_BITS);\n                        tab1[j] = MULLx(tmp0, v2, FRAC_BITS);\n                    }\n                } else {\nfound1:\n                    if (s->mode_ext & MODE_EXT_MS_STEREO) {\n                        for (j = 0; j < len; j++) {\n                            tmp0    = tab0[j];\n                            tmp1    = tab1[j];\n                            tab0[j] = MULLx(tmp0 + tmp1, ISQRT2, FRAC_BITS);\n                            tab1[j] = MULLx(tmp0 - tmp1, ISQRT2, FRAC_BITS);\n                        }\n                    }\n                }\n            }\n        }\n        non_zero_found = non_zero_found_short[0] |\n                         non_zero_found_short[1] |\n                         non_zero_found_short[2];\n        for (i = g1->long_end - 1;i >= 0;i--) {\n            len   = band_size_long[s->sample_rate_index][i];\n            tab0 -= len;\n            tab1 -= len;\n            if (!non_zero_found) {\n                for (j = 0; j < len; j++) {\n                    if (tab1[j] != 0) {\n                        non_zero_found = 1;\n                        goto found2;\n                    }\n                }\n                k  = (i == 21) ? 20 : i;\n                sf = g1->scale_factors[k];\n                if (sf >= sf_max)\n                    goto found2;\n                v1 = is_tab[0][sf];\n                v2 = is_tab[1][sf];\n                for (j = 0; j < len; j++) {\n                    tmp0    = tab0[j];\n                    tab0[j] = MULLx(tmp0, v1, FRAC_BITS);\n                    tab1[j] = MULLx(tmp0, v2, FRAC_BITS);\n                }\n            } else {\nfound2:\n                if (s->mode_ext & MODE_EXT_MS_STEREO) {\n                    for (j = 0; j < len; j++) {\n                        tmp0    = tab0[j];\n                        tmp1    = tab1[j];\n                        tab0[j] = MULLx(tmp0 + tmp1, ISQRT2, FRAC_BITS);\n                        tab1[j] = MULLx(tmp0 - tmp1, ISQRT2, FRAC_BITS);\n                    }\n                }\n            }\n        }\n    } else if (s->mode_ext & MODE_EXT_MS_STEREO) {\n        tab0 = g0->sb_hybrid;\n        tab1 = g1->sb_hybrid;\n        for (i = 0; i < 576; i++) {\n            tmp0    = tab0[i];\n            tmp1    = tab1[i];\n            tab0[i] = tmp0 + tmp1;\n            tab1[i] = tmp0 - tmp1;\n        }\n    }\n}']