libavcodec/aacsbr.c:1681: error: Integer Overflow L2
  ([0, +oo] - [min(32, `sbr->kx[*]`), max(32, `sbr->kx[*]`)]):unsigned32 by call to `sbr_mapping`.

libavcodec/aacsbr.c:1648:1: Parameter `sbr->kx[*]`
1646. }
1647. 
1648. void ff_sbr_apply(AACContext *ac, SpectralBandReplication *sbr, int id_aac,
      ^
1649.                   float* L, float* R)
1650. {

libavcodec/aacsbr.c:1681:19: Call
1679. 
1680.             // hf_adj
1681.             err = sbr_mapping(ac, sbr, &sbr->data[ch], sbr->data[ch].e_a);
                        ^
1682.             if (!err) {
1683.                 sbr_env_estimate(sbr->e_curr, sbr->X_high, sbr, &sbr->data[ch]);

libavcodec/aacsbr.c:1402:1: <LHS trace>
1400.  * (14496-3 sp04 p217)
1401.  */
1402. static int sbr_mapping(AACContext *ac, SpectralBandReplication *sbr,
      ^
1403.                         SBRData *ch_data, int e_a[2])
1404. {

libavcodec/aacsbr.c:1402:1: Parameter `sbr->f_tablehigh[*]`
  1400.  * (14496-3 sp04 p217)
  1401.  */
  1402. static int sbr_mapping(AACContext *ac, SpectralBandReplication *sbr,
        ^
  1403.                         SBRData *ch_data, int e_a[2])
  1404. {

libavcodec/aacsbr.c:1431:17: Assignment
  1429.         for (i = 0; i < sbr->n[1]; i++) {
  1430.             if (ch_data->bs_add_harmonic_flag) {
  1431.                 const unsigned int m_midpoint =
                        ^
  1432.                     (sbr->f_tablehigh[i] + sbr->f_tablehigh[i + 1]) >> 1;
  1433. 

libavcodec/aacsbr.c:1402:1: <RHS trace>
1400.  * (14496-3 sp04 p217)
1401.  */
1402. static int sbr_mapping(AACContext *ac, SpectralBandReplication *sbr,
      ^
1403.                         SBRData *ch_data, int e_a[2])
1404. {

libavcodec/aacsbr.c:1402:1: Parameter `sbr->kx[*]`
  1400.  * (14496-3 sp04 p217)
  1401.  */
  1402. static int sbr_mapping(AACContext *ac, SpectralBandReplication *sbr,
        ^
  1403.                         SBRData *ch_data, int e_a[2])
  1404. {

libavcodec/aacsbr.c:1434:17: Binary operation: ([0, +oo] - [min(32, sbr->kx[*]), max(32, sbr->kx[*])]):unsigned32 by call to `sbr_mapping` 
  1432.                     (sbr->f_tablehigh[i] + sbr->f_tablehigh[i + 1]) >> 1;
  1433. 
  1434.                 ch_data->s_indexmapped[e + 1][m_midpoint - sbr->kx[1]] = ch_data->bs_add_harmonic[i] *
                        ^
  1435.                     (e >= e_a[1] || (ch_data->s_indexmapped[0][m_midpoint - sbr->kx[1]] == 1));
  1436.             }

static int sbr_mapping(AACContext *ac, SpectralBandReplication *sbr,
                        SBRData *ch_data, int e_a[2])
{
    int e, i, m;
    memset(ch_data->s_indexmapped[1], 0, 7*sizeof(ch_data->s_indexmapped[1]));
    for (e = 0; e < ch_data->bs_num_env; e++) {
        const unsigned int ilim = sbr->n[ch_data->bs_freq_res[e + 1]];
        uint16_t *table = ch_data->bs_freq_res[e + 1] ? sbr->f_tablehigh : sbr->f_tablelow;
        int k;
        if (sbr->kx[1] != table[0]) {
            av_log(ac->avctx, AV_LOG_ERROR, "kx != f_table{high,low}[0]. "
                   "Derived frequency tables were not regenerated.\n");
            sbr_turnoff(sbr);
            return AVERROR_BUG;
        }
        for (i = 0; i < ilim; i++)
            for (m = table[i]; m < table[i + 1]; m++)
                sbr->e_origmapped[e][m - sbr->kx[1]] = ch_data->env_facs[e+1][i];
        k = (ch_data->bs_num_noise > 1) && (ch_data->t_env[e] >= ch_data->t_q[1]);
        for (i = 0; i < sbr->n_q; i++)
            for (m = sbr->f_tablenoise[i]; m < sbr->f_tablenoise[i + 1]; m++)
                sbr->q_mapped[e][m - sbr->kx[1]] = ch_data->noise_facs[k+1][i];
        for (i = 0; i < sbr->n[1]; i++) {
            if (ch_data->bs_add_harmonic_flag) {
                const unsigned int m_midpoint =
                    (sbr->f_tablehigh[i] + sbr->f_tablehigh[i + 1]) >> 1;
                ch_data->s_indexmapped[e + 1][m_midpoint - sbr->kx[1]] = ch_data->bs_add_harmonic[i] *
                    (e >= e_a[1] || (ch_data->s_indexmapped[0][m_midpoint - sbr->kx[1]] == 1));
            }
        }
        for (i = 0; i < ilim; i++) {
            int additional_sinusoid_present = 0;
            for (m = table[i]; m < table[i + 1]; m++) {
                if (ch_data->s_indexmapped[e + 1][m - sbr->kx[1]]) {
                    additional_sinusoid_present = 1;
                    break;
                }
            }
            memset(&sbr->s_mapped[e][table[i] - sbr->kx[1]], additional_sinusoid_present,
                   (table[i + 1] - table[i]) * sizeof(sbr->s_mapped[e][0]));
        }
    }
    memcpy(ch_data->s_indexmapped[0], ch_data->s_indexmapped[ch_data->bs_num_env], sizeof(ch_data->s_indexmapped[0]));
    return 0;
}
['void ff_sbr_apply(AACContext *ac, SpectralBandReplication *sbr, int id_aac,\n                  float* L, float* R)\n{\n    int downsampled = ac->m4ac.ext_sample_rate < sbr->sample_rate;\n    int ch;\n    int nch = (id_aac == TYPE_CPE) ? 2 : 1;\n    int err;\n    if (!sbr->kx_and_m_pushed) {\n        sbr->kx[0] = sbr->kx[1];\n        sbr->m[0] = sbr->m[1];\n    } else {\n        sbr->kx_and_m_pushed = 0;\n    }\n    if (sbr->start) {\n        sbr_dequant(sbr, id_aac);\n    }\n    for (ch = 0; ch < nch; ch++) {\n        sbr_qmf_analysis(&ac->dsp, &sbr->mdct_ana, &sbr->dsp, ch ? R : L, sbr->data[ch].analysis_filterbank_samples,\n                         (float*)sbr->qmf_filter_scratch,\n                         sbr->data[ch].W);\n        sbr_lf_gen(ac, sbr, sbr->X_low, sbr->data[ch].W);\n        sbr->data[ch].Ypos ^= 1;\n        if (sbr->start) {\n            sbr_hf_inverse_filter(&sbr->dsp, sbr->alpha0, sbr->alpha1, sbr->X_low, sbr->k[0]);\n            sbr_chirp(sbr, &sbr->data[ch]);\n            sbr_hf_gen(ac, sbr, sbr->X_high, sbr->X_low, sbr->alpha0, sbr->alpha1,\n                       sbr->data[ch].bw_array, sbr->data[ch].t_env,\n                       sbr->data[ch].bs_num_env);\n            err = sbr_mapping(ac, sbr, &sbr->data[ch], sbr->data[ch].e_a);\n            if (!err) {\n                sbr_env_estimate(sbr->e_curr, sbr->X_high, sbr, &sbr->data[ch]);\n                sbr_gain_calc(ac, sbr, &sbr->data[ch], sbr->data[ch].e_a);\n                sbr_hf_assemble(sbr->data[ch].Y[sbr->data[ch].Ypos],\n                                sbr->X_high, sbr, &sbr->data[ch],\n                                sbr->data[ch].e_a);\n            }\n        }\n        sbr_x_gen(sbr, sbr->X[ch],\n                  sbr->data[ch].Y[1-sbr->data[ch].Ypos],\n                  sbr->data[ch].Y[  sbr->data[ch].Ypos],\n                  sbr->X_low, ch);\n    }\n    if (ac->m4ac.ps == 1) {\n        if (sbr->ps.start) {\n            ff_ps_apply(ac->avctx, &sbr->ps, sbr->X[0], sbr->X[1], sbr->kx[1] + sbr->m[1]);\n        } else {\n            memcpy(sbr->X[1], sbr->X[0], sizeof(sbr->X[0]));\n        }\n        nch = 2;\n    }\n    sbr_qmf_synthesis(&ac->dsp, &sbr->mdct, &sbr->dsp, L, sbr->X[0], sbr->qmf_filter_scratch,\n                      sbr->data[0].synthesis_filterbank_samples,\n                      &sbr->data[0].synthesis_filterbank_samples_offset,\n                      downsampled);\n    if (nch == 2)\n        sbr_qmf_synthesis(&ac->dsp, &sbr->mdct, &sbr->dsp, R, sbr->X[1], sbr->qmf_filter_scratch,\n                          sbr->data[1].synthesis_filterbank_samples,\n                          &sbr->data[1].synthesis_filterbank_samples_offset,\n                          downsampled);\n}', 'static int sbr_mapping(AACContext *ac, SpectralBandReplication *sbr,\n                        SBRData *ch_data, int e_a[2])\n{\n    int e, i, m;\n    memset(ch_data->s_indexmapped[1], 0, 7*sizeof(ch_data->s_indexmapped[1]));\n    for (e = 0; e < ch_data->bs_num_env; e++) {\n        const unsigned int ilim = sbr->n[ch_data->bs_freq_res[e + 1]];\n        uint16_t *table = ch_data->bs_freq_res[e + 1] ? sbr->f_tablehigh : sbr->f_tablelow;\n        int k;\n        if (sbr->kx[1] != table[0]) {\n            av_log(ac->avctx, AV_LOG_ERROR, "kx != f_table{high,low}[0]. "\n                   "Derived frequency tables were not regenerated.\\n");\n            sbr_turnoff(sbr);\n            return AVERROR_BUG;\n        }\n        for (i = 0; i < ilim; i++)\n            for (m = table[i]; m < table[i + 1]; m++)\n                sbr->e_origmapped[e][m - sbr->kx[1]] = ch_data->env_facs[e+1][i];\n        k = (ch_data->bs_num_noise > 1) && (ch_data->t_env[e] >= ch_data->t_q[1]);\n        for (i = 0; i < sbr->n_q; i++)\n            for (m = sbr->f_tablenoise[i]; m < sbr->f_tablenoise[i + 1]; m++)\n                sbr->q_mapped[e][m - sbr->kx[1]] = ch_data->noise_facs[k+1][i];\n        for (i = 0; i < sbr->n[1]; i++) {\n            if (ch_data->bs_add_harmonic_flag) {\n                const unsigned int m_midpoint =\n                    (sbr->f_tablehigh[i] + sbr->f_tablehigh[i + 1]) >> 1;\n                ch_data->s_indexmapped[e + 1][m_midpoint - sbr->kx[1]] = ch_data->bs_add_harmonic[i] *\n                    (e >= e_a[1] || (ch_data->s_indexmapped[0][m_midpoint - sbr->kx[1]] == 1));\n            }\n        }\n        for (i = 0; i < ilim; i++) {\n            int additional_sinusoid_present = 0;\n            for (m = table[i]; m < table[i + 1]; m++) {\n                if (ch_data->s_indexmapped[e + 1][m - sbr->kx[1]]) {\n                    additional_sinusoid_present = 1;\n                    break;\n                }\n            }\n            memset(&sbr->s_mapped[e][table[i] - sbr->kx[1]], additional_sinusoid_present,\n                   (table[i + 1] - table[i]) * sizeof(sbr->s_mapped[e][0]));\n        }\n    }\n    memcpy(ch_data->s_indexmapped[0], ch_data->s_indexmapped[ch_data->bs_num_env], sizeof(ch_data->s_indexmapped[0]));\n    return 0;\n}']