libavcodec/aacdec.c:2047: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload`.

libavcodec/aacdec.c:2023:19: Call
2021. 
2022.         case TYPE_DSE:
2023.             err = skip_data_stream_element(ac, &gb);
                        ^
2024.             break;
2025. 

libavcodec/aacdec.c:606:1: Parameter `*ac->avctx`
  604.  * Skip data_stream_element; reference: table 4.10.
  605.  */
  606. static int skip_data_stream_element(AACContext *ac, GetBitContext *gb)
       ^
  607. {
  608.     int byte_align = get_bits1(gb);

libavcodec/aacdec.c:2047:28: Call
2045.             }
2046.             while (elem_id > 0)
2047.                 elem_id -= decode_extension_payload(ac, &gb, elem_id, che_prev, elem_type_prev);
                                 ^
2048.             err = 0; /* FIXME */
2049.             break;

libavcodec/aacdec.c:1650:1: Parameter `che->sbr.n[*]`
  1648.  * @return Returns number of bytes consumed
  1649.  */
  1650. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1651.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1652. {

libavcodec/aacdec.c:1673:15: Call
  1671.             ac->m4ac.sbr = 1;
  1672.         }
  1673.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1674.         break;
  1675.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1037:1: Parameter `sbr->n[*]`
    1035.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1036.  */
    1037. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1038.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1039. {

libavcodec/aacsbr.c:1063:25: Call
    1061.     num_sbr_bits++;
    1062.     if (get_bits1(gb)) // bs_header_flag
    1063.         num_sbr_bits += read_sbr_header(sbr, gb);
                                  ^
    1064. 
    1065.     if (sbr->reset)

libavcodec/aacsbr.c:203:1: Parameter `sbr->n[*]`
      201. }
      202. 
      203. static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext *gb)
           ^
      204. {
      205.     unsigned int cnt = get_bits_count(gb);

libavcodec/aacsbr.c:252:9: Call
      250. 
      251.     if (sbr->bs_limiter_bands != old_bs_limiter_bands && !sbr->reset)
      252.         sbr_make_f_tablelim(sbr);
                   ^
      253. 
      254.     return get_bits_count(gb) - cnt;

libavcodec/aacsbr.c:156:1: <LHS trace>
154. 
155. /// Limiter Frequency Band Table (14496-3 sp04 p198)
156. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
     ^
157. {
158.     int k;

libavcodec/aacsbr.c:156:1: Parameter `sbr->n[*]`
        154. 
        155. /// Limiter Frequency Band Table (14496-3 sp04 p198)
        156. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
             ^
        157. {
        158.     int k;

libavcodec/aacsbr.c:181:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload` 
        179.               qsort_comparison_function_int16);
        180. 
        181.         sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;
                     ^
        182.         while (out < sbr->f_tablelim + sbr->n_lim) {
        183.             if (*in >= *out * lim_bands_per_octave_warped) {

static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
{
    int k;
    if (sbr->bs_limiter_bands > 0) {
        static const float bands_warped[3] = { 1.32715174233856803909f,
                                               1.18509277094158210129f,
                                               1.11987160404675912501f };
        const float lim_bands_per_octave_warped = bands_warped[sbr->bs_limiter_bands - 1];
        int16_t patch_borders[7];
        uint16_t *in = sbr->f_tablelim + 1, *out = sbr->f_tablelim;
        patch_borders[0] = sbr->kx[1];
        for (k = 1; k <= sbr->num_patches; k++)
            patch_borders[k] = patch_borders[k-1] + sbr->patch_num_subbands[k-1];
        memcpy(sbr->f_tablelim, sbr->f_tablelow,
               (sbr->n[0] + 1) * sizeof(sbr->f_tablelow[0]));
        if (sbr->num_patches > 1)
            memcpy(sbr->f_tablelim + sbr->n[0] + 1, patch_borders + 1,
                   (sbr->num_patches - 1) * sizeof(patch_borders[0]));
        qsort(sbr->f_tablelim, sbr->num_patches + sbr->n[0],
              sizeof(sbr->f_tablelim[0]),
              qsort_comparison_function_int16);
        sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;
        while (out < sbr->f_tablelim + sbr->n_lim) {
            if (*in >= *out * lim_bands_per_octave_warped) {
                *++out = *in++;
            } else if (*in == *out ||
                !in_table_int16(patch_borders, sbr->num_patches, *in)) {
                in++;
                sbr->n_lim--;
            } else if (!in_table_int16(patch_borders, sbr->num_patches, *out)) {
                *out = *in++;
                sbr->n_lim--;
            } else {
                *++out = *in++;
            }
        }
    } else {
        sbr->f_tablelim[0] = sbr->f_tablelow[0];
        sbr->f_tablelim[1] = sbr->f_tablelow[sbr->n[0]];
        sbr->n_lim = 1;
    }
}
['static int aac_decode_frame(AVCodecContext *avctx, void *data,\n                            int *data_size, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    AACContext *ac = avctx->priv_data;\n    ChannelElement *che = NULL, *che_prev = NULL;\n    GetBitContext gb;\n    enum RawDataBlockType elem_type, elem_type_prev = TYPE_END;\n    int err, elem_id, data_size_tmp;\n    int buf_consumed;\n    int samples = 1024, multiplier;\n    int buf_offset;\n    init_get_bits(&gb, buf, buf_size * 8);\n    if (show_bits(&gb, 12) == 0xfff) {\n        if (parse_adts_frame_header(ac, &gb) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\\n");\n            return -1;\n        }\n        if (ac->m4ac.sampling_index > 12) {\n            av_log(ac->avctx, AV_LOG_ERROR, "invalid sampling rate index %d\\n", ac->m4ac.sampling_index);\n            return -1;\n        }\n    }\n    memset(ac->tags_seen_this_frame, 0, sizeof(ac->tags_seen_this_frame));\n    while ((elem_type = get_bits(&gb, 3)) != TYPE_END) {\n        elem_id = get_bits(&gb, 4);\n        if (elem_type < TYPE_DSE && !(che=get_che(ac, elem_type, elem_id))) {\n            av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\\n", elem_type, elem_id);\n            return -1;\n        }\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &che->ch[0], &gb, 0, 0);\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, &gb, che);\n            break;\n        case TYPE_CCE:\n            err = decode_cce(ac, &gb, che);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &che->ch[0], &gb, 0, 0);\n            break;\n        case TYPE_DSE:\n            err = skip_data_stream_element(ac, &gb);\n            break;\n        case TYPE_PCE: {\n            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID];\n            memset(new_che_pos, 0, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n            if ((err = decode_pce(ac, new_che_pos, &gb)))\n                break;\n            if (ac->output_configured > OC_TRIAL_PCE)\n                av_log(avctx, AV_LOG_ERROR,\n                       "Not evaluating a further program_config_element as this construct is dubious at best.\\n");\n            else\n                err = output_configure(ac, ac->che_pos, new_che_pos, 0, OC_TRIAL_PCE);\n            break;\n        }\n        case TYPE_FIL:\n            if (elem_id == 15)\n                elem_id += get_bits(&gb, 8) - 1;\n            if (get_bits_left(&gb) < 8 * elem_id) {\n                    av_log(avctx, AV_LOG_ERROR, overread_err);\n                    return -1;\n            }\n            while (elem_id > 0)\n                elem_id -= decode_extension_payload(ac, &gb, elem_id, che_prev, elem_type_prev);\n            err = 0;\n            break;\n        default:\n            err = -1;\n            break;\n        }\n        che_prev       = che;\n        elem_type_prev = elem_type;\n        if (err)\n            return err;\n        if (get_bits_left(&gb) < 3) {\n            av_log(avctx, AV_LOG_ERROR, overread_err);\n            return -1;\n        }\n    }\n    spectral_to_sample(ac);\n    multiplier = (ac->m4ac.sbr == 1) ? ac->m4ac.ext_sample_rate > ac->m4ac.sample_rate : 0;\n    samples <<= multiplier;\n    if (ac->output_configured < OC_LOCKED) {\n        avctx->sample_rate = ac->m4ac.sample_rate << multiplier;\n        avctx->frame_size = samples;\n    }\n    data_size_tmp = samples * avctx->channels * sizeof(int16_t);\n    if (*data_size < data_size_tmp) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Output buffer too small (%d) or trying to output too many samples (%d) for this frame.\\n",\n               *data_size, data_size_tmp);\n        return -1;\n    }\n    *data_size = data_size_tmp;\n    ac->dsp.float_to_int16_interleave(data, (const float **)ac->output_data, samples, avctx->channels);\n    if (ac->output_configured)\n        ac->output_configured = OC_LOCKED;\n    buf_consumed = (get_bits_count(&gb) + 7) >> 3;\n    for (buf_offset = buf_consumed; buf_offset < buf_size; buf_offset++)\n        if (buf[buf_offset])\n            break;\n    return buf_size > buf_offset ? buf_consumed : buf_size;\n}', 'static int skip_data_stream_element(AACContext *ac, GetBitContext *gb)\n{\n    int byte_align = get_bits1(gb);\n    int count = get_bits(gb, 8);\n    if (count == 255)\n        count += get_bits(gb, 8);\n    if (byte_align)\n        align_get_bits(gb);\n    if (get_bits_left(gb) < 8 * count) {\n        av_log(ac->avctx, AV_LOG_ERROR, overread_err);\n        return -1;\n    }\n    skip_bits_long(gb, 8 * count);\n    return 0;\n}', 'static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,\n                                    ChannelElement *che, enum RawDataBlockType elem_type)\n{\n    int crc_flag = 0;\n    int res = cnt;\n    switch (get_bits(gb, 4)) {\n    case EXT_SBR_DATA_CRC:\n        crc_flag++;\n    case EXT_SBR_DATA:\n        if (!che) {\n            av_log(ac->avctx, AV_LOG_ERROR, "SBR was found before the first channel element.\\n");\n            return res;\n        } else if (!ac->m4ac.sbr) {\n            av_log(ac->avctx, AV_LOG_ERROR, "SBR signaled to be not-present but was found in the bitstream.\\n");\n            skip_bits_long(gb, 8 * cnt - 4);\n            return res;\n        } else if (ac->m4ac.sbr == -1 && ac->output_configured == OC_LOCKED) {\n            av_log(ac->avctx, AV_LOG_ERROR, "Implicit SBR was found with a first occurrence after the first frame.\\n");\n            skip_bits_long(gb, 8 * cnt - 4);\n            return res;\n        } else {\n            ac->m4ac.sbr = 1;\n        }\n        res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);\n        break;\n    case EXT_DYNAMIC_RANGE:\n        res = decode_dynamic_range(&ac->che_drc, gb, cnt);\n        break;\n    case EXT_FILL:\n    case EXT_FILL_DATA:\n    case EXT_DATA_ELEMENT:\n    default:\n        skip_bits_long(gb, 8 * cnt - 4);\n        break;\n    };\n    return res;\n}', 'int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,\n                            GetBitContext *gb_host, int crc, int cnt, int id_aac)\n{\n    unsigned int num_sbr_bits = 0, num_align_bits;\n    unsigned bytes_read;\n    GetBitContext gbc = *gb_host, *gb = &gbc;\n    skip_bits_long(gb_host, cnt*8 - 4);\n    sbr->reset = 0;\n    if (!sbr->sample_rate)\n        sbr->sample_rate = 2 * ac->m4ac.sample_rate;\n    if (!ac->m4ac.ext_sample_rate)\n        ac->m4ac.ext_sample_rate = 2 * ac->m4ac.sample_rate;\n    if (crc) {\n        skip_bits(gb, 10);\n        num_sbr_bits += 10;\n    }\n    sbr->kx[0] = sbr->kx[1];\n    sbr->m[0] = sbr->m[1];\n    num_sbr_bits++;\n    if (get_bits1(gb))\n        num_sbr_bits += read_sbr_header(sbr, gb);\n    if (sbr->reset)\n        sbr_reset(ac, sbr);\n    if (sbr->start)\n        num_sbr_bits  += read_sbr_data(ac, sbr, gb, id_aac);\n    num_align_bits = ((cnt << 3) - 4 - num_sbr_bits) & 7;\n    bytes_read = ((num_sbr_bits + num_align_bits + 4) >> 3);\n    if (bytes_read > cnt) {\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "Expected to read %d SBR bytes actually read %d.\\n", cnt, bytes_read);\n    }\n    return cnt;\n}', 'static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext *gb)\n{\n    unsigned int cnt = get_bits_count(gb);\n    uint8_t bs_header_extra_1;\n    uint8_t bs_header_extra_2;\n    int old_bs_limiter_bands = sbr->bs_limiter_bands;\n    SpectrumParameters old_spectrum_params;\n    sbr->start = 1;\n    memcpy(&old_spectrum_params, &sbr->spectrum_params, sizeof(SpectrumParameters));\n    sbr->bs_amp_res_header              = get_bits1(gb);\n    sbr->spectrum_params.bs_start_freq  = get_bits(gb, 4);\n    sbr->spectrum_params.bs_stop_freq   = get_bits(gb, 4);\n    sbr->spectrum_params.bs_xover_band  = get_bits(gb, 3);\n                                          skip_bits(gb, 2);\n    bs_header_extra_1 = get_bits1(gb);\n    bs_header_extra_2 = get_bits1(gb);\n    if (bs_header_extra_1) {\n        sbr->spectrum_params.bs_freq_scale  = get_bits(gb, 2);\n        sbr->spectrum_params.bs_alter_scale = get_bits1(gb);\n        sbr->spectrum_params.bs_noise_bands = get_bits(gb, 2);\n    } else {\n        sbr->spectrum_params.bs_freq_scale  = 2;\n        sbr->spectrum_params.bs_alter_scale = 1;\n        sbr->spectrum_params.bs_noise_bands = 2;\n    }\n    if (memcmp(&old_spectrum_params, &sbr->spectrum_params, sizeof(SpectrumParameters)))\n        sbr->reset = 1;\n    if (bs_header_extra_2) {\n        sbr->bs_limiter_bands  = get_bits(gb, 2);\n        sbr->bs_limiter_gains  = get_bits(gb, 2);\n        sbr->bs_interpol_freq  = get_bits1(gb);\n        sbr->bs_smoothing_mode = get_bits1(gb);\n    } else {\n        sbr->bs_limiter_bands  = 2;\n        sbr->bs_limiter_gains  = 2;\n        sbr->bs_interpol_freq  = 1;\n        sbr->bs_smoothing_mode = 1;\n    }\n    if (sbr->bs_limiter_bands != old_bs_limiter_bands && !sbr->reset)\n        sbr_make_f_tablelim(sbr);\n    return get_bits_count(gb) - cnt;\n}', 'static void sbr_make_f_tablelim(SpectralBandReplication *sbr)\n{\n    int k;\n    if (sbr->bs_limiter_bands > 0) {\n        static const float bands_warped[3] = { 1.32715174233856803909f,\n                                               1.18509277094158210129f,\n                                               1.11987160404675912501f };\n        const float lim_bands_per_octave_warped = bands_warped[sbr->bs_limiter_bands - 1];\n        int16_t patch_borders[7];\n        uint16_t *in = sbr->f_tablelim + 1, *out = sbr->f_tablelim;\n        patch_borders[0] = sbr->kx[1];\n        for (k = 1; k <= sbr->num_patches; k++)\n            patch_borders[k] = patch_borders[k-1] + sbr->patch_num_subbands[k-1];\n        memcpy(sbr->f_tablelim, sbr->f_tablelow,\n               (sbr->n[0] + 1) * sizeof(sbr->f_tablelow[0]));\n        if (sbr->num_patches > 1)\n            memcpy(sbr->f_tablelim + sbr->n[0] + 1, patch_borders + 1,\n                   (sbr->num_patches - 1) * sizeof(patch_borders[0]));\n        qsort(sbr->f_tablelim, sbr->num_patches + sbr->n[0],\n              sizeof(sbr->f_tablelim[0]),\n              qsort_comparison_function_int16);\n        sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;\n        while (out < sbr->f_tablelim + sbr->n_lim) {\n            if (*in >= *out * lim_bands_per_octave_warped) {\n                *++out = *in++;\n            } else if (*in == *out ||\n                !in_table_int16(patch_borders, sbr->num_patches, *in)) {\n                in++;\n                sbr->n_lim--;\n            } else if (!in_table_int16(patch_borders, sbr->num_patches, *out)) {\n                *out = *in++;\n                sbr->n_lim--;\n            } else {\n                *++out = *in++;\n            }\n        }\n    } else {\n        sbr->f_tablelim[0] = sbr->f_tablelow[0];\n        sbr->f_tablelim[1] = sbr->f_tablelow[sbr->n[0]];\n        sbr->n_lim = 1;\n    }\n}']