libavcodec/aacdec.c:2192: error: Buffer Overrun L1
  Offset: -1 Size: 7 by call to `output_configure`.

libavcodec/aacdec.c:2192:23: Call
2190.                        "Not evaluating a further program_config_element as this construct is dubious at best.\n");
2191.             else
2192.                 err = output_configure(ac, new_che_pos, 0, OC_TRIAL_PCE);
                            ^
2193.             break;
2194.         }

libavcodec/aacdec.c:224:1: <Offset trace>
222.  * @return  Returns error status. 0 - OK, !0 - error
223.  */
224. static av_cold int output_configure(AACContext *ac,
     ^
225.                                     enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],
226.                                     int channel_config, enum OCStatus oc_type)

libavcodec/aacdec.c:224:1: Parameter `channel_config`
  222.  * @return  Returns error status. 0 - OK, !0 - error
  223.  */
  224. static av_cold int output_configure(AACContext *ac,
       ^
  225.                                     enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],
  226.                                     int channel_config, enum OCStatus oc_type)

libavcodec/aacdectab.h:83:1: <Length trace>
81. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 0, 0, 0, 0, 0 };
82. 
83. static const uint8_t aac_channel_layout_map[7][5][2] = {
    ^
84.     { { TYPE_SCE, 0 }, },
85.     { { TYPE_CPE, 0 }, },

libavcodec/aacdectab.h:83:1: Array declaration
  81. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 0, 0, 0, 0, 0 };
  82. 
  83. static const uint8_t aac_channel_layout_map[7][5][2] = {
      ^
  84.     { { TYPE_SCE, 0 }, },
  85.     { { TYPE_CPE, 0 }, },

libavcodec/aacdec.c:236:22: Array access: Offset: -1 Size: 7 by call to `output_configure` 
  234.     if (channel_config) {
  235.         for (i = 0; i < tags_per_config[channel_config]; i++) {
  236.             int id = aac_channel_layout_map[channel_config - 1][i][1];
                            ^
  237.             type = aac_channel_layout_map[channel_config - 1][i][0];
  238.             if ((ret = che_configure(ac, ac->che_pos[type][id],

static av_cold int output_configure(AACContext *ac,
                                    enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],
                                    int channel_config, enum OCStatus oc_type)
{
    AVCodecContext *avctx = ac->avctx;
    int i, type, channels = 0, ret;
    if (new_che_pos)
        memcpy(ac->che_pos, new_che_pos, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));
    if (channel_config) {
        for (i = 0; i < tags_per_config[channel_config]; i++) {
            int id = aac_channel_layout_map[channel_config - 1][i][1];
            type = aac_channel_layout_map[channel_config - 1][i][0];
            if ((ret = che_configure(ac, ac->che_pos[type][id],
                                     type, id, &channels)))
                return ret;
        }
        memset(ac->tag_che_map, 0, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));
        avctx->channel_layout = aac_channel_layout[channel_config - 1];
    } else {
        for (i = 0; i < MAX_ELEM_ID; i++) {
            for (type = 0; type < 4; type++) {
                if ((ret = che_configure(ac, ac->che_pos[type][i],
                                         type, i, &channels)))
                    return ret;
            }
        }
        memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));
        avctx->channel_layout = 0;
    }
    avctx->channels = channels;
    ac->output_configured = oc_type;
    return 0;
}
['static int aac_decode_frame_int(AVCodecContext *avctx, void *data,\n                                int *got_frame_ptr, GetBitContext *gb)\n{\n    AACContext *ac = avctx->priv_data;\n    ChannelElement *che = NULL, *che_prev = NULL;\n    enum RawDataBlockType elem_type, elem_type_prev = TYPE_END;\n    int err, elem_id;\n    int samples = 0, multiplier, audio_found = 0;\n    if (show_bits(gb, 12) == 0xfff) {\n        if (parse_adts_frame_header(ac, gb) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\\n");\n            return -1;\n        }\n        if (ac->m4ac.sampling_index > 12) {\n            av_log(ac->avctx, AV_LOG_ERROR, "invalid sampling rate index %d\\n", ac->m4ac.sampling_index);\n            return -1;\n        }\n    }\n    ac->tags_mapped = 0;\n    while ((elem_type = get_bits(gb, 3)) != TYPE_END) {\n        elem_id = get_bits(gb, 4);\n        if (elem_type < TYPE_DSE) {\n            if (!(che=get_che(ac, elem_type, elem_id))) {\n                av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\\n",\n                       elem_type, elem_id);\n                return -1;\n            }\n            samples = 1024;\n        }\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            audio_found = 1;\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, gb, che);\n            audio_found = 1;\n            break;\n        case TYPE_CCE:\n            err = decode_cce(ac, gb, che);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            audio_found = 1;\n            break;\n        case TYPE_DSE:\n            err = skip_data_stream_element(ac, gb);\n            break;\n        case TYPE_PCE: {\n            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID];\n            memset(new_che_pos, 0, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n            if ((err = decode_pce(avctx, &ac->m4ac, new_che_pos, gb)))\n                break;\n            if (ac->output_configured > OC_TRIAL_PCE)\n                av_log(avctx, AV_LOG_ERROR,\n                       "Not evaluating a further program_config_element as this construct is dubious at best.\\n");\n            else\n                err = output_configure(ac, new_che_pos, 0, OC_TRIAL_PCE);\n            break;\n        }\n        case TYPE_FIL:\n            if (elem_id == 15)\n                elem_id += get_bits(gb, 8) - 1;\n            if (get_bits_left(gb) < 8 * elem_id) {\n                    av_log(avctx, AV_LOG_ERROR, overread_err);\n                    return -1;\n            }\n            while (elem_id > 0)\n                elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);\n            err = 0;\n            break;\n        default:\n            err = -1;\n            break;\n        }\n        che_prev       = che;\n        elem_type_prev = elem_type;\n        if (err)\n            return err;\n        if (get_bits_left(gb) < 3) {\n            av_log(avctx, AV_LOG_ERROR, overread_err);\n            return -1;\n        }\n    }\n    spectral_to_sample(ac);\n    multiplier = (ac->m4ac.sbr == 1) ? ac->m4ac.ext_sample_rate > ac->m4ac.sample_rate : 0;\n    samples <<= multiplier;\n    if (ac->output_configured < OC_LOCKED) {\n        avctx->sample_rate = ac->m4ac.sample_rate << multiplier;\n        avctx->frame_size = samples;\n    }\n    if (samples) {\n        ac->frame.nb_samples = samples;\n        if ((err = avctx->get_buffer(avctx, &ac->frame)) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n            return err;\n        }\n        if (avctx->sample_fmt == AV_SAMPLE_FMT_FLT)\n            ac->fmt_conv.float_interleave((float *)ac->frame.data[0],\n                                          (const float **)ac->output_data,\n                                          samples, avctx->channels);\n        else\n            ac->fmt_conv.float_to_int16_interleave((int16_t *)ac->frame.data[0],\n                                                   (const float **)ac->output_data,\n                                                   samples, avctx->channels);\n        *(AVFrame *)data = ac->frame;\n    }\n    *got_frame_ptr = !!samples;\n    if (ac->output_configured && audio_found)\n        ac->output_configured = OC_LOCKED;\n    return 0;\n}', 'static av_cold int output_configure(AACContext *ac,\n                                    enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],\n                                    int channel_config, enum OCStatus oc_type)\n{\n    AVCodecContext *avctx = ac->avctx;\n    int i, type, channels = 0, ret;\n    if (new_che_pos)\n        memcpy(ac->che_pos, new_che_pos, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n    if (channel_config) {\n        for (i = 0; i < tags_per_config[channel_config]; i++) {\n            int id = aac_channel_layout_map[channel_config - 1][i][1];\n            type = aac_channel_layout_map[channel_config - 1][i][0];\n            if ((ret = che_configure(ac, ac->che_pos[type][id],\n                                     type, id, &channels)))\n                return ret;\n        }\n        memset(ac->tag_che_map, 0, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));\n        avctx->channel_layout = aac_channel_layout[channel_config - 1];\n    } else {\n        for (i = 0; i < MAX_ELEM_ID; i++) {\n            for (type = 0; type < 4; type++) {\n                if ((ret = che_configure(ac, ac->che_pos[type][i],\n                                         type, i, &channels)))\n                    return ret;\n            }\n        }\n        memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));\n        avctx->channel_layout = 0;\n    }\n    avctx->channels = channels;\n    ac->output_configured = oc_type;\n    return 0;\n}']