libavcodec/aacsbr.c:705: error: Buffer Overrun L1
  Offset added: 6 Size: 2.

libavcodec/aacsbr.c:695:1: <Length trace>
693. }
694. 
695. static void copy_sbr_grid(SBRData *dst, const SBRData *src) {
     ^
696.     //These variables are saved from the previous frame rather than copied
697.     dst->bs_freq_res[0] = dst->bs_freq_res[dst->bs_num_env[1]];

libavcodec/aacsbr.c:695:1: Parameter `src->bs_num_rel[*]`
693. }
694. 
695. static void copy_sbr_grid(SBRData *dst, const SBRData *src) {
     ^
696.     //These variables are saved from the previous frame rather than copied
697.     dst->bs_freq_res[0] = dst->bs_freq_res[dst->bs_num_env[1]];

libavcodec/aacsbr.c:705:5: Array access: Offset added: 6 Size: 2
703.     memcpy(dst->bs_var_bord,   src->bs_var_bord,   sizeof(dst->bs_var_bord));
704.     memcpy(dst->bs_rel_bord,   src->bs_rel_bord,   sizeof(dst->bs_rel_bord));
705.     memcpy(dst->bs_num_rel,    src->bs_num_rel,    sizeof(dst->bs_rel_bord));
         ^
706.     dst->bs_amp_res     = src->bs_amp_res;
707.     dst->bs_num_noise   = src->bs_num_noise;

static void copy_sbr_grid(SBRData *dst, const SBRData *src) {
    dst->bs_freq_res[0] = dst->bs_freq_res[dst->bs_num_env[1]];
    dst->bs_num_env[0]  = dst->bs_num_env[1];
    memcpy(dst->bs_freq_res+1, src->bs_freq_res+1, sizeof(dst->bs_freq_res)-sizeof(*dst->bs_freq_res));
    memcpy(dst->bs_num_env+1,  src->bs_num_env+1,  sizeof(dst->bs_num_env)- sizeof(*dst->bs_num_env));
    memcpy(dst->bs_var_bord,   src->bs_var_bord,   sizeof(dst->bs_var_bord));
    memcpy(dst->bs_rel_bord,   src->bs_rel_bord,   sizeof(dst->bs_rel_bord));
    memcpy(dst->bs_num_rel,    src->bs_num_rel,    sizeof(dst->bs_rel_bord));
    dst->bs_amp_res     = src->bs_amp_res;
    dst->bs_num_noise   = src->bs_num_noise;
    dst->bs_pointer     = src->bs_pointer;
    dst->bs_frame_class = src->bs_frame_class;
}
['static void copy_sbr_grid(SBRData *dst, const SBRData *src) {\n    dst->bs_freq_res[0] = dst->bs_freq_res[dst->bs_num_env[1]];\n    dst->bs_num_env[0]  = dst->bs_num_env[1];\n    memcpy(dst->bs_freq_res+1, src->bs_freq_res+1, sizeof(dst->bs_freq_res)-sizeof(*dst->bs_freq_res));\n    memcpy(dst->bs_num_env+1,  src->bs_num_env+1,  sizeof(dst->bs_num_env)- sizeof(*dst->bs_num_env));\n    memcpy(dst->bs_var_bord,   src->bs_var_bord,   sizeof(dst->bs_var_bord));\n    memcpy(dst->bs_rel_bord,   src->bs_rel_bord,   sizeof(dst->bs_rel_bord));\n    memcpy(dst->bs_num_rel,    src->bs_num_rel,    sizeof(dst->bs_rel_bord));\n    dst->bs_amp_res     = src->bs_amp_res;\n    dst->bs_num_noise   = src->bs_num_noise;\n    dst->bs_pointer     = src->bs_pointer;\n    dst->bs_frame_class = src->bs_frame_class;\n}']