libavcodec/aacdec.c:2444: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload`.

libavcodec/aacdec.c:2363:13: Call
2361. 
2362.     if (show_bits(gb, 12) == 0xfff) {
2363.         if (parse_adts_frame_header(ac, gb) < 0) {
                  ^
2364.             av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\n");
2365.             err = -1;

libavcodec/aacdec.c:2332:17: Call
  2330.                     &layout_map_tags, hdr_info.chan_config))
  2331.                 return -7;
  2332.             if (output_configure(ac, layout_map, layout_map_tags,
                        ^
  2333.                                  FFMAX(ac->oc[1].status, OC_TRIAL_FRAME)))
  2334.                 return -7;

libavcodec/aacdec.c:2444:28: Call
2442.             }
2443.             while (elem_id > 0)
2444.                 elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);
                                 ^
2445.             err = 0; /* FIXME */
2446.             break;

libavcodec/aacdec.c:1919:1: Parameter `che->sbr.f_master[*]`
  1917.  * @return Returns number of bytes consumed
  1918.  */
  1919. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1920.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1921. {

libavcodec/aacdec.c:1947:15: Call
  1945.             ac->oc[1].m4ac.sbr = 1;
  1946.         }
  1947.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1948.         break;
  1949.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1063:1: Parameter `sbr->f_master[*]`
    1061.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1062.  */
    1063. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1064.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1065. {

libavcodec/aacsbr.c:1093:9: Call
    1091. 
    1092.     if (sbr->reset)
    1093.         sbr_reset(ac, sbr);
                  ^
    1094. 
    1095.     if (sbr->start)

libavcodec/aacsbr.c:1042:1: Parameter `sbr->f_master[*]`
      1040. }
      1041. 
      1042. static void sbr_reset(AACContext *ac, SpectralBandReplication *sbr)
            ^
      1043. {
      1044.     int err;

libavcodec/aacsbr.c:1045:11: Call
      1043. {
      1044.     int err;
      1045.     err = sbr_make_f_master(ac, sbr, &sbr->spectrum_params);
                      ^
      1046.     if (err >= 0)
      1047.         err = sbr_make_f_derived(ac, sbr);

libavcodec/aacsbr.c:323:1: <LHS trace>
321. 
322. /// Master Frequency Band Table (14496-3 sp04 p194)
323. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
     ^
324.                              SpectrumParameters *spectrum)
325. {

libavcodec/aacsbr.c:323:1: Parameter `sbr->f_master[*]`
        321. 
        322. /// Master Frequency Band Table (14496-3 sp04 p194)
        323. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
             ^
        324.                              SpectrumParameters *spectrum)
        325. {

libavcodec/aacsbr.c:413:13: Binary operation: ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload` 
        411.         k2diff = sbr->k[2] - sbr->k[0] - sbr->n_master * dk;
        412.         if (k2diff < 0) {
        413.             sbr->f_master[1]--;
                         ^
        414.             sbr->f_master[2]-= (k2diff < -1);
        415.         } else if (k2diff) {

static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
                             SpectrumParameters *spectrum)
{
    unsigned int temp, max_qmf_subbands;
    unsigned int start_min, stop_min;
    int k;
    const int8_t *sbr_offset_ptr;
    int16_t stop_dk[13];
    if (sbr->sample_rate < 32000) {
        temp = 3000;
    } else if (sbr->sample_rate < 64000) {
        temp = 4000;
    } else
        temp = 5000;
    start_min = ((temp << 7) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
    stop_min  = ((temp << 8) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
    switch (sbr->sample_rate) {
    case 16000:
        sbr_offset_ptr = sbr_offset[0];
        break;
    case 22050:
        sbr_offset_ptr = sbr_offset[1];
        break;
    case 24000:
        sbr_offset_ptr = sbr_offset[2];
        break;
    case 32000:
        sbr_offset_ptr = sbr_offset[3];
        break;
    case 44100: case 48000: case 64000:
        sbr_offset_ptr = sbr_offset[4];
        break;
    case 88200: case 96000: case 128000: case 176400: case 192000:
        sbr_offset_ptr = sbr_offset[5];
        break;
    default:
        av_log(ac->avctx, AV_LOG_ERROR,
               "Unsupported sample rate for SBR: %d\n", sbr->sample_rate);
        return -1;
    }
    sbr->k[0] = start_min + sbr_offset_ptr[spectrum->bs_start_freq];
    if (spectrum->bs_stop_freq < 14) {
        sbr->k[2] = stop_min;
        make_bands(stop_dk, stop_min, 64, 13);
        qsort(stop_dk, 13, sizeof(stop_dk[0]), qsort_comparison_function_int16);
        for (k = 0; k < spectrum->bs_stop_freq; k++)
            sbr->k[2] += stop_dk[k];
    } else if (spectrum->bs_stop_freq == 14) {
        sbr->k[2] = 2*sbr->k[0];
    } else if (spectrum->bs_stop_freq == 15) {
        sbr->k[2] = 3*sbr->k[0];
    } else {
        av_log(ac->avctx, AV_LOG_ERROR,
               "Invalid bs_stop_freq: %d\n", spectrum->bs_stop_freq);
        return -1;
    }
    sbr->k[2] = FFMIN(64, sbr->k[2]);
    if (sbr->sample_rate <= 32000) {
        max_qmf_subbands = 48;
    } else if (sbr->sample_rate == 44100) {
        max_qmf_subbands = 35;
    } else if (sbr->sample_rate >= 48000)
        max_qmf_subbands = 32;
    if (sbr->k[2] - sbr->k[0] > max_qmf_subbands) {
        av_log(ac->avctx, AV_LOG_ERROR,
               "Invalid bitstream, too many QMF subbands: %d\n", sbr->k[2] - sbr->k[0]);
        return -1;
    }
    if (!spectrum->bs_freq_scale) {
        int dk, k2diff;
        dk = spectrum->bs_alter_scale + 1;
        sbr->n_master = ((sbr->k[2] - sbr->k[0] + (dk&2)) >> dk) << 1;
        if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))
            return -1;
        for (k = 1; k <= sbr->n_master; k++)
            sbr->f_master[k] = dk;
        k2diff = sbr->k[2] - sbr->k[0] - sbr->n_master * dk;
        if (k2diff < 0) {
            sbr->f_master[1]--;
            sbr->f_master[2]-= (k2diff < -1);
        } else if (k2diff) {
            sbr->f_master[sbr->n_master]++;
        }
        sbr->f_master[0] = sbr->k[0];
        for (k = 1; k <= sbr->n_master; k++)
            sbr->f_master[k] += sbr->f_master[k - 1];
    } else {
        int half_bands = 7 - spectrum->bs_freq_scale;
        int two_regions, num_bands_0;
        int vdk0_max, vdk1_min;
        int16_t vk0[49];
        if (49 * sbr->k[2] > 110 * sbr->k[0]) {
            two_regions = 1;
            sbr->k[1] = 2 * sbr->k[0];
        } else {
            two_regions = 0;
            sbr->k[1] = sbr->k[2];
        }
        num_bands_0 = lrintf(half_bands * log2f(sbr->k[1] / (float)sbr->k[0])) * 2;
        if (num_bands_0 <= 0) {
            av_log(ac->avctx, AV_LOG_ERROR, "Invalid num_bands_0: %d\n", num_bands_0);
            return -1;
        }
        vk0[0] = 0;
        make_bands(vk0+1, sbr->k[0], sbr->k[1], num_bands_0);
        qsort(vk0 + 1, num_bands_0, sizeof(vk0[1]), qsort_comparison_function_int16);
        vdk0_max = vk0[num_bands_0];
        vk0[0] = sbr->k[0];
        for (k = 1; k <= num_bands_0; k++) {
            if (vk0[k] <= 0) {
                av_log(ac->avctx, AV_LOG_ERROR, "Invalid vDk0[%d]: %d\n", k, vk0[k]);
                return -1;
            }
            vk0[k] += vk0[k-1];
        }
        if (two_regions) {
            int16_t vk1[49];
            float invwarp = spectrum->bs_alter_scale ? 0.76923076923076923077f
                                                     : 1.0f;
            int num_bands_1 = lrintf(half_bands * invwarp *
                                     log2f(sbr->k[2] / (float)sbr->k[1])) * 2;
            make_bands(vk1+1, sbr->k[1], sbr->k[2], num_bands_1);
            vdk1_min = array_min_int16(vk1 + 1, num_bands_1);
            if (vdk1_min < vdk0_max) {
                int change;
                qsort(vk1 + 1, num_bands_1, sizeof(vk1[1]), qsort_comparison_function_int16);
                change = FFMIN(vdk0_max - vk1[1], (vk1[num_bands_1] - vk1[1]) >> 1);
                vk1[1]           += change;
                vk1[num_bands_1] -= change;
            }
            qsort(vk1 + 1, num_bands_1, sizeof(vk1[1]), qsort_comparison_function_int16);
            vk1[0] = sbr->k[1];
            for (k = 1; k <= num_bands_1; k++) {
                if (vk1[k] <= 0) {
                    av_log(ac->avctx, AV_LOG_ERROR, "Invalid vDk1[%d]: %d\n", k, vk1[k]);
                    return -1;
                }
                vk1[k] += vk1[k-1];
            }
            sbr->n_master = num_bands_0 + num_bands_1;
            if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))
                return -1;
            memcpy(&sbr->f_master[0],               vk0,
                   (num_bands_0 + 1) * sizeof(sbr->f_master[0]));
            memcpy(&sbr->f_master[num_bands_0 + 1], vk1 + 1,
                    num_bands_1      * sizeof(sbr->f_master[0]));
        } else {
            sbr->n_master = num_bands_0;
            if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))
                return -1;
            memcpy(sbr->f_master, vk0, (num_bands_0 + 1) * sizeof(sbr->f_master[0]));
        }
    }
    return 0;
}
['static int aac_decode_frame_int(AVCodecContext *avctx, void *data,\n                                int *got_frame_ptr, GetBitContext *gb)\n{\n    AACContext *ac = avctx->priv_data;\n    ChannelElement *che = NULL, *che_prev = NULL;\n    enum RawDataBlockType elem_type, elem_type_prev = TYPE_END;\n    int err, elem_id;\n    int samples = 0, multiplier, audio_found = 0, pce_found = 0;\n    if (show_bits(gb, 12) == 0xfff) {\n        if (parse_adts_frame_header(ac, gb) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\\n");\n            err = -1;\n            goto fail;\n        }\n        if (ac->oc[1].m4ac.sampling_index > 12) {\n            av_log(ac->avctx, AV_LOG_ERROR, "invalid sampling rate index %d\\n", ac->oc[1].m4ac.sampling_index);\n            err = -1;\n            goto fail;\n        }\n    }\n    ac->tags_mapped = 0;\n    while ((elem_type = get_bits(gb, 3)) != TYPE_END) {\n        elem_id = get_bits(gb, 4);\n        if (elem_type < TYPE_DSE) {\n            if (!(che=get_che(ac, elem_type, elem_id))) {\n                av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\\n",\n                       elem_type, elem_id);\n                err = -1;\n                goto fail;\n            }\n            samples = 1024;\n        }\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            audio_found = 1;\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, gb, che);\n            audio_found = 1;\n            break;\n        case TYPE_CCE:\n            err = decode_cce(ac, gb, che);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            audio_found = 1;\n            break;\n        case TYPE_DSE:\n            err = skip_data_stream_element(ac, gb);\n            break;\n        case TYPE_PCE: {\n            uint8_t layout_map[MAX_ELEM_ID*4][3];\n            int tags;\n            push_output_configuration(ac);\n            tags = decode_pce(avctx, &ac->oc[1].m4ac, layout_map, gb);\n            if (tags < 0) {\n                err = tags;\n                break;\n            }\n            if (pce_found) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Not evaluating a further program_config_element as this construct is dubious at best.\\n");\n                pop_output_configuration(ac);\n            } else {\n                err = output_configure(ac, layout_map, tags, OC_TRIAL_PCE);\n                pce_found = 1;\n            }\n            break;\n        }\n        case TYPE_FIL:\n            if (elem_id == 15)\n                elem_id += get_bits(gb, 8) - 1;\n            if (get_bits_left(gb) < 8 * elem_id) {\n                    av_log(avctx, AV_LOG_ERROR, overread_err);\n                    err = -1;\n                    goto fail;\n            }\n            while (elem_id > 0)\n                elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);\n            err = 0;\n            break;\n        default:\n            err = -1;\n            break;\n        }\n        che_prev       = che;\n        elem_type_prev = elem_type;\n        if (err)\n            goto fail;\n        if (get_bits_left(gb) < 3) {\n            av_log(avctx, AV_LOG_ERROR, overread_err);\n            err = -1;\n            goto fail;\n        }\n    }\n    spectral_to_sample(ac);\n    multiplier = (ac->oc[1].m4ac.sbr == 1) ? ac->oc[1].m4ac.ext_sample_rate > ac->oc[1].m4ac.sample_rate : 0;\n    samples <<= multiplier;\n    if (samples) {\n        ac->frame.nb_samples = samples;\n        if ((err = avctx->get_buffer(avctx, &ac->frame)) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n            err = -1;\n            goto fail;\n        }\n        if (avctx->sample_fmt == AV_SAMPLE_FMT_FLT)\n            ac->fmt_conv.float_interleave((float *)ac->frame.data[0],\n                                          (const float **)ac->output_data,\n                                          samples, avctx->channels);\n        else\n            ac->fmt_conv.float_to_int16_interleave((int16_t *)ac->frame.data[0],\n                                                   (const float **)ac->output_data,\n                                                   samples, avctx->channels);\n        *(AVFrame *)data = ac->frame;\n    }\n    *got_frame_ptr = !!samples;\n    if (ac->oc[1].status && audio_found) {\n        avctx->sample_rate = ac->oc[1].m4ac.sample_rate << multiplier;\n        avctx->frame_size = samples;\n        ac->oc[1].status = OC_LOCKED;\n    }\n    return 0;\nfail:\n    pop_output_configuration(ac);\n    return err;\n}', 'static int parse_adts_frame_header(AACContext *ac, GetBitContext *gb)\n{\n    int size;\n    AACADTSHeaderInfo hdr_info;\n    uint8_t layout_map[MAX_ELEM_ID*4][3];\n    int layout_map_tags;\n    size = avpriv_aac_parse_header(gb, &hdr_info);\n    if (size > 0) {\n        if (hdr_info.num_aac_frames != 1) {\n            av_log_missing_feature(ac->avctx, "More than one AAC RDB per ADTS frame", 0);\n            return AVERROR_PATCHWELCOME;\n        }\n        push_output_configuration(ac);\n        if (hdr_info.chan_config) {\n            ac->oc[1].m4ac.chan_config = hdr_info.chan_config;\n            if (set_default_channel_config(ac->avctx, layout_map,\n                    &layout_map_tags, hdr_info.chan_config))\n                return -7;\n            if (output_configure(ac, layout_map, layout_map_tags,\n                                 FFMAX(ac->oc[1].status, OC_TRIAL_FRAME)))\n                return -7;\n        } else {\n            ac->oc[1].m4ac.chan_config = 0;\n        }\n        ac->oc[1].m4ac.sample_rate     = hdr_info.sample_rate;\n        ac->oc[1].m4ac.sampling_index  = hdr_info.sampling_index;\n        ac->oc[1].m4ac.object_type     = hdr_info.object_type;\n        if (ac->oc[0].status != OC_LOCKED ||\n            ac->oc[0].m4ac.chan_config != hdr_info.chan_config ||\n            ac->oc[0].m4ac.sample_rate != hdr_info.sample_rate) {\n            ac->oc[1].m4ac.sbr = -1;\n            ac->oc[1].m4ac.ps  = -1;\n        }\n        if (!hdr_info.crc_absent)\n            skip_bits(gb, 16);\n    }\n    return size;\n}', 'static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,\n                                    ChannelElement *che, enum RawDataBlockType elem_type)\n{\n    int crc_flag = 0;\n    int res = cnt;\n    switch (get_bits(gb, 4)) {\n    case EXT_SBR_DATA_CRC:\n        crc_flag++;\n    case EXT_SBR_DATA:\n        if (!che) {\n            av_log(ac->avctx, AV_LOG_ERROR, "SBR was found before the first channel element.\\n");\n            return res;\n        } else if (!ac->oc[1].m4ac.sbr) {\n            av_log(ac->avctx, AV_LOG_ERROR, "SBR signaled to be not-present but was found in the bitstream.\\n");\n            skip_bits_long(gb, 8 * cnt - 4);\n            return res;\n        } else if (ac->oc[1].m4ac.sbr == -1 && ac->oc[1].status == OC_LOCKED) {\n            av_log(ac->avctx, AV_LOG_ERROR, "Implicit SBR was found with a first occurrence after the first frame.\\n");\n            skip_bits_long(gb, 8 * cnt - 4);\n            return res;\n        } else if (ac->oc[1].m4ac.ps == -1 && ac->oc[1].status < OC_LOCKED && ac->avctx->channels == 1) {\n            ac->oc[1].m4ac.sbr = 1;\n            ac->oc[1].m4ac.ps = 1;\n            output_configure(ac, ac->oc[1].layout_map, ac->oc[1].layout_map_tags,\n                             ac->oc[1].status);\n        } else {\n            ac->oc[1].m4ac.sbr = 1;\n        }\n        res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);\n        break;\n    case EXT_DYNAMIC_RANGE:\n        res = decode_dynamic_range(&ac->che_drc, gb);\n        break;\n    case EXT_FILL:\n    case EXT_FILL_DATA:\n    case EXT_DATA_ELEMENT:\n    default:\n        skip_bits_long(gb, 8 * cnt - 4);\n        break;\n    };\n    return res;\n}', 'int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,\n                            GetBitContext *gb_host, int crc, int cnt, int id_aac)\n{\n    unsigned int num_sbr_bits = 0, num_align_bits;\n    unsigned bytes_read;\n    GetBitContext gbc = *gb_host, *gb = &gbc;\n    skip_bits_long(gb_host, cnt*8 - 4);\n    sbr->reset = 0;\n    if (!sbr->sample_rate)\n        sbr->sample_rate = 2 * ac->oc[1].m4ac.sample_rate;\n    if (!ac->oc[1].m4ac.ext_sample_rate)\n        ac->oc[1].m4ac.ext_sample_rate = 2 * ac->oc[1].m4ac.sample_rate;\n    if (crc) {\n        skip_bits(gb, 10);\n        num_sbr_bits += 10;\n    }\n    sbr->kx[0] = sbr->kx[1];\n    sbr->m[0] = sbr->m[1];\n    sbr->kx_and_m_pushed = 1;\n    num_sbr_bits++;\n    if (get_bits1(gb))\n        num_sbr_bits += read_sbr_header(sbr, gb);\n    if (sbr->reset)\n        sbr_reset(ac, sbr);\n    if (sbr->start)\n        num_sbr_bits  += read_sbr_data(ac, sbr, gb, id_aac);\n    num_align_bits = ((cnt << 3) - 4 - num_sbr_bits) & 7;\n    bytes_read = ((num_sbr_bits + num_align_bits + 4) >> 3);\n    if (bytes_read > cnt) {\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "Expected to read %d SBR bytes actually read %d.\\n", cnt, bytes_read);\n    }\n    return cnt;\n}', 'static void sbr_reset(AACContext *ac, SpectralBandReplication *sbr)\n{\n    int err;\n    err = sbr_make_f_master(ac, sbr, &sbr->spectrum_params);\n    if (err >= 0)\n        err = sbr_make_f_derived(ac, sbr);\n    if (err < 0) {\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "SBR reset failed. Switching SBR to pure upsampling mode.\\n");\n        sbr_turnoff(sbr);\n    }\n}', 'static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,\n                             SpectrumParameters *spectrum)\n{\n    unsigned int temp, max_qmf_subbands;\n    unsigned int start_min, stop_min;\n    int k;\n    const int8_t *sbr_offset_ptr;\n    int16_t stop_dk[13];\n    if (sbr->sample_rate < 32000) {\n        temp = 3000;\n    } else if (sbr->sample_rate < 64000) {\n        temp = 4000;\n    } else\n        temp = 5000;\n    start_min = ((temp << 7) + (sbr->sample_rate >> 1)) / sbr->sample_rate;\n    stop_min  = ((temp << 8) + (sbr->sample_rate >> 1)) / sbr->sample_rate;\n    switch (sbr->sample_rate) {\n    case 16000:\n        sbr_offset_ptr = sbr_offset[0];\n        break;\n    case 22050:\n        sbr_offset_ptr = sbr_offset[1];\n        break;\n    case 24000:\n        sbr_offset_ptr = sbr_offset[2];\n        break;\n    case 32000:\n        sbr_offset_ptr = sbr_offset[3];\n        break;\n    case 44100: case 48000: case 64000:\n        sbr_offset_ptr = sbr_offset[4];\n        break;\n    case 88200: case 96000: case 128000: case 176400: case 192000:\n        sbr_offset_ptr = sbr_offset[5];\n        break;\n    default:\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "Unsupported sample rate for SBR: %d\\n", sbr->sample_rate);\n        return -1;\n    }\n    sbr->k[0] = start_min + sbr_offset_ptr[spectrum->bs_start_freq];\n    if (spectrum->bs_stop_freq < 14) {\n        sbr->k[2] = stop_min;\n        make_bands(stop_dk, stop_min, 64, 13);\n        qsort(stop_dk, 13, sizeof(stop_dk[0]), qsort_comparison_function_int16);\n        for (k = 0; k < spectrum->bs_stop_freq; k++)\n            sbr->k[2] += stop_dk[k];\n    } else if (spectrum->bs_stop_freq == 14) {\n        sbr->k[2] = 2*sbr->k[0];\n    } else if (spectrum->bs_stop_freq == 15) {\n        sbr->k[2] = 3*sbr->k[0];\n    } else {\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "Invalid bs_stop_freq: %d\\n", spectrum->bs_stop_freq);\n        return -1;\n    }\n    sbr->k[2] = FFMIN(64, sbr->k[2]);\n    if (sbr->sample_rate <= 32000) {\n        max_qmf_subbands = 48;\n    } else if (sbr->sample_rate == 44100) {\n        max_qmf_subbands = 35;\n    } else if (sbr->sample_rate >= 48000)\n        max_qmf_subbands = 32;\n    if (sbr->k[2] - sbr->k[0] > max_qmf_subbands) {\n        av_log(ac->avctx, AV_LOG_ERROR,\n               "Invalid bitstream, too many QMF subbands: %d\\n", sbr->k[2] - sbr->k[0]);\n        return -1;\n    }\n    if (!spectrum->bs_freq_scale) {\n        int dk, k2diff;\n        dk = spectrum->bs_alter_scale + 1;\n        sbr->n_master = ((sbr->k[2] - sbr->k[0] + (dk&2)) >> dk) << 1;\n        if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))\n            return -1;\n        for (k = 1; k <= sbr->n_master; k++)\n            sbr->f_master[k] = dk;\n        k2diff = sbr->k[2] - sbr->k[0] - sbr->n_master * dk;\n        if (k2diff < 0) {\n            sbr->f_master[1]--;\n            sbr->f_master[2]-= (k2diff < -1);\n        } else if (k2diff) {\n            sbr->f_master[sbr->n_master]++;\n        }\n        sbr->f_master[0] = sbr->k[0];\n        for (k = 1; k <= sbr->n_master; k++)\n            sbr->f_master[k] += sbr->f_master[k - 1];\n    } else {\n        int half_bands = 7 - spectrum->bs_freq_scale;\n        int two_regions, num_bands_0;\n        int vdk0_max, vdk1_min;\n        int16_t vk0[49];\n        if (49 * sbr->k[2] > 110 * sbr->k[0]) {\n            two_regions = 1;\n            sbr->k[1] = 2 * sbr->k[0];\n        } else {\n            two_regions = 0;\n            sbr->k[1] = sbr->k[2];\n        }\n        num_bands_0 = lrintf(half_bands * log2f(sbr->k[1] / (float)sbr->k[0])) * 2;\n        if (num_bands_0 <= 0) {\n            av_log(ac->avctx, AV_LOG_ERROR, "Invalid num_bands_0: %d\\n", num_bands_0);\n            return -1;\n        }\n        vk0[0] = 0;\n        make_bands(vk0+1, sbr->k[0], sbr->k[1], num_bands_0);\n        qsort(vk0 + 1, num_bands_0, sizeof(vk0[1]), qsort_comparison_function_int16);\n        vdk0_max = vk0[num_bands_0];\n        vk0[0] = sbr->k[0];\n        for (k = 1; k <= num_bands_0; k++) {\n            if (vk0[k] <= 0) {\n                av_log(ac->avctx, AV_LOG_ERROR, "Invalid vDk0[%d]: %d\\n", k, vk0[k]);\n                return -1;\n            }\n            vk0[k] += vk0[k-1];\n        }\n        if (two_regions) {\n            int16_t vk1[49];\n            float invwarp = spectrum->bs_alter_scale ? 0.76923076923076923077f\n                                                     : 1.0f;\n            int num_bands_1 = lrintf(half_bands * invwarp *\n                                     log2f(sbr->k[2] / (float)sbr->k[1])) * 2;\n            make_bands(vk1+1, sbr->k[1], sbr->k[2], num_bands_1);\n            vdk1_min = array_min_int16(vk1 + 1, num_bands_1);\n            if (vdk1_min < vdk0_max) {\n                int change;\n                qsort(vk1 + 1, num_bands_1, sizeof(vk1[1]), qsort_comparison_function_int16);\n                change = FFMIN(vdk0_max - vk1[1], (vk1[num_bands_1] - vk1[1]) >> 1);\n                vk1[1]           += change;\n                vk1[num_bands_1] -= change;\n            }\n            qsort(vk1 + 1, num_bands_1, sizeof(vk1[1]), qsort_comparison_function_int16);\n            vk1[0] = sbr->k[1];\n            for (k = 1; k <= num_bands_1; k++) {\n                if (vk1[k] <= 0) {\n                    av_log(ac->avctx, AV_LOG_ERROR, "Invalid vDk1[%d]: %d\\n", k, vk1[k]);\n                    return -1;\n                }\n                vk1[k] += vk1[k-1];\n            }\n            sbr->n_master = num_bands_0 + num_bands_1;\n            if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))\n                return -1;\n            memcpy(&sbr->f_master[0],               vk0,\n                   (num_bands_0 + 1) * sizeof(sbr->f_master[0]));\n            memcpy(&sbr->f_master[num_bands_0 + 1], vk1 + 1,\n                    num_bands_1      * sizeof(sbr->f_master[0]));\n        } else {\n            sbr->n_master = num_bands_0;\n            if (check_n_master(ac->avctx, sbr->n_master, sbr->spectrum_params.bs_xover_band))\n                return -1;\n            memcpy(sbr->f_master, vk0, (num_bands_0 + 1) * sizeof(sbr->f_master[0]));\n        }\n    }\n    return 0;\n}']