libavcodec/twinvq.c:851: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `read_and_decode_spectrum`.

libavcodec/twinvq.c:851:5: Call
849.     ftype = wtype_to_ftype_table[window_type];
850. 
851.     read_and_decode_spectrum(tctx, &gb, tctx->spectrum, ftype);
         ^
852. 
853.     imdct_output(tctx, ftype, window_type, out);

libavcodec/twinvq.c:732:1: Parameter `tctx->mtab->n_lsp`
  730. }
  731. 
  732. static void read_and_decode_spectrum(TwinContext *tctx, GetBitContext *gb,
       ^
  733.                                      float *out, enum FrameType ftype)
  734. {

libavcodec/twinvq.c:783:19: Array declaration
  781.     for (i = 0; i < channels; i++) {
  782.         float *chunk = out + mtab->size * i;
  783.         float lsp[tctx->mtab->n_lsp];
                         ^
  784. 
  785.         for (j = 0; j < sub; j++) {

libavcodec/twinvq.c:808:9: Call
  806.                    tctx->lsp_hist[i]);
  807. 
  808.         dec_lpc_spectrum_inv(tctx, lsp, ftype, tctx->tmp_buf);
               ^
  809. 
  810.         for (j = 0; j < mtab->fmode[ftype].sub; j++) {

libavcodec/twinvq.c:589:1: Parameter `*lsp`
    587. }
    588. 
    589. static void dec_lpc_spectrum_inv(TwinContext *tctx, float *lsp,
         ^
    590.                                  enum FrameType ftype, float *lpc)
    591. {

libavcodec/twinvq.c:606:9: Call
    604.         break;
    605.     case FT_SHORT:
    606.         eval_lpcenv(tctx, lsp, lpc);
                 ^
    607.         break;
    608.     }

libavcodec/twinvq.c:255:1: Parameter `*cos_vals`
      253.  * Evaluates the LPC amplitude spectrum envelope from the line spectrum pairs.
      254.  */
      255. static void eval_lpcenv(TwinContext *tctx, const float *cos_vals, float *lpc)
           ^
      256. {
      257.     int i;

libavcodec/twinvq.c:263:27: Call
      261.     for (i = 0; i < size_s/2; i++) {
      262.         float cos_i = tctx->cos_tabs[0][i];
      263.         lpc[i]          = eval_lpc_spectrum(cos_vals,  cos_i, mtab->n_lsp);
                                     ^
      264.         lpc[size_s-i-1] = eval_lpc_spectrum(cos_vals, -cos_i, mtab->n_lsp);
      265.     }

libavcodec/twinvq.c:230:1: <Offset trace>
228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
229.  */
230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
     ^
231. {
232.     int j;

libavcodec/twinvq.c:230:1: Parameter `order`
        228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
        229.  */
        230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
             ^
        231. {
        232.     int j;

libavcodec/twinvq.c:230:1: <Length trace>
228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
229.  */
230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
     ^
231. {
232.     int j;

libavcodec/twinvq.c:230:1: Parameter `*lsp`
        228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
        229.  */
        230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
             ^
        231. {
        232.     int j;

libavcodec/twinvq.c:240:14: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `read_and_decode_spectrum` 
        238.         // Unroll the loop once since order is a multiple of four
        239.         q *= lsp[j  ] - two_cos_w;
        240.         p *= lsp[j+1] - two_cos_w;
                          ^
        241. 
        242.         q *= lsp[j+2] - two_cos_w;

static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
{
    int j;
    float p = 0.5f;
    float q = 0.5f;
    float two_cos_w = 2.0f*cos_val;
    for (j = 0; j + 1 < order; j += 2*2) {
        q *= lsp[j  ] - two_cos_w;
        p *= lsp[j+1] - two_cos_w;
        q *= lsp[j+2] - two_cos_w;
        p *= lsp[j+3] - two_cos_w;
    }
    p *= p * (2.0f - two_cos_w);
    q *= q * (2.0f + two_cos_w);
    return 0.5 / (p + q);
}
['static int twin_decode_frame(AVCodecContext * avctx, void *data,\n                             int *data_size, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    TwinContext *tctx = avctx->priv_data;\n    GetBitContext gb;\n    const ModeTab *mtab = tctx->mtab;\n    float *out = data;\n    enum FrameType ftype;\n    int window_type;\n    static const enum FrameType wtype_to_ftype_table[] = {\n        FT_LONG,   FT_LONG, FT_SHORT, FT_LONG,\n        FT_MEDIUM, FT_LONG, FT_LONG,  FT_MEDIUM, FT_MEDIUM\n    };\n    if (buf_size*8 < avctx->bit_rate*mtab->size/avctx->sample_rate + 8) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Frame too small (%d bytes). Truncated file?\\n", buf_size);\n        *data_size = 0;\n        return buf_size;\n    }\n    init_get_bits(&gb, buf, buf_size * 8);\n    skip_bits(&gb, get_bits(&gb, 8));\n    window_type = get_bits(&gb, WINDOW_TYPE_BITS);\n    if (window_type > 8) {\n        av_log(avctx, AV_LOG_ERROR, "Invalid window type, broken sample?\\n");\n        return -1;\n    }\n    ftype = wtype_to_ftype_table[window_type];\n    read_and_decode_spectrum(tctx, &gb, tctx->spectrum, ftype);\n    imdct_output(tctx, ftype, window_type, out);\n    FFSWAP(float*, tctx->curr_frame, tctx->prev_frame);\n    if (tctx->avctx->frame_number < 2) {\n        *data_size=0;\n        return buf_size;\n    }\n    tctx->dsp.vector_clipf(out, out, -32700./(1<<15), 32700./(1<<15),\n                           avctx->channels * mtab->size);\n    *data_size = mtab->size*avctx->channels*4;\n    return buf_size;\n}', 'static void read_and_decode_spectrum(TwinContext *tctx, GetBitContext *gb,\n                                     float *out, enum FrameType ftype)\n{\n    const ModeTab *mtab = tctx->mtab;\n    int channels = tctx->avctx->channels;\n    int sub = mtab->fmode[ftype].sub;\n    int block_size = mtab->size / sub;\n    float gain[channels*sub];\n    float ppc_shape[mtab->ppc_shape_len * channels * 4];\n    uint8_t bark1[channels][sub][mtab->fmode[ftype].bark_n_coef];\n    uint8_t bark_use_hist[channels][sub];\n    uint8_t lpc_idx1[channels];\n    uint8_t lpc_idx2[channels][tctx->mtab->lsp_split];\n    uint8_t lpc_hist_idx[channels];\n    int i, j, k;\n    dequant(tctx, gb, out, ftype,\n            mtab->fmode[ftype].cb0, mtab->fmode[ftype].cb1,\n            mtab->fmode[ftype].cb_len_read);\n    for (i = 0; i < channels; i++)\n        for (j = 0; j < sub; j++)\n            for (k = 0; k < mtab->fmode[ftype].bark_n_coef; k++)\n                bark1[i][j][k] =\n                    get_bits(gb, mtab->fmode[ftype].bark_n_bit);\n    for (i = 0; i < channels; i++)\n        for (j = 0; j < sub; j++)\n            bark_use_hist[i][j] = get_bits1(gb);\n    dec_gain(tctx, gb, ftype, gain);\n    for (i = 0; i < channels; i++) {\n        lpc_hist_idx[i] = get_bits(gb, tctx->mtab->lsp_bit0);\n        lpc_idx1    [i] = get_bits(gb, tctx->mtab->lsp_bit1);\n        for (j = 0; j < tctx->mtab->lsp_split; j++)\n            lpc_idx2[i][j] = get_bits(gb, tctx->mtab->lsp_bit2);\n    }\n    if (ftype == FT_LONG) {\n        int cb_len_p = (tctx->n_div[3] + mtab->ppc_shape_len*channels - 1)/\n            tctx->n_div[3];\n        dequant(tctx, gb, ppc_shape, FT_PPC, mtab->ppc_shape_cb,\n                mtab->ppc_shape_cb + cb_len_p*PPC_SHAPE_CB_SIZE, cb_len_p);\n    }\n    for (i = 0; i < channels; i++) {\n        float *chunk = out + mtab->size * i;\n        float lsp[tctx->mtab->n_lsp];\n        for (j = 0; j < sub; j++) {\n            dec_bark_env(tctx, bark1[i][j], bark_use_hist[i][j], i,\n                         tctx->tmp_buf, gain[sub*i+j], ftype);\n            tctx->dsp.vector_fmul(chunk + block_size*j, tctx->tmp_buf,\n                                  block_size);\n        }\n        if (ftype == FT_LONG) {\n            float pgain_step = 25000. / ((1 << mtab->pgain_bit) - 1);\n            int p_coef = get_bits(gb, tctx->mtab->ppc_period_bit);\n            int g_coef = get_bits(gb, tctx->mtab->pgain_bit);\n            float v = 1./8192*\n                mulawinv(pgain_step*g_coef+ pgain_step/2, 25000., PGAIN_MU);\n            decode_ppc(tctx, p_coef, ppc_shape + i*mtab->ppc_shape_len, v,\n                       chunk);\n        }\n        decode_lsp(tctx, lpc_idx1[i], lpc_idx2[i], lpc_hist_idx[i], lsp,\n                   tctx->lsp_hist[i]);\n        dec_lpc_spectrum_inv(tctx, lsp, ftype, tctx->tmp_buf);\n        for (j = 0; j < mtab->fmode[ftype].sub; j++) {\n            tctx->dsp.vector_fmul(chunk, tctx->tmp_buf, block_size);\n            chunk += block_size;\n        }\n    }\n}', 'static void dec_lpc_spectrum_inv(TwinContext *tctx, float *lsp,\n                                 enum FrameType ftype, float *lpc)\n{\n    int i;\n    int size = tctx->mtab->size / tctx->mtab->fmode[ftype].sub;\n    for (i = 0; i < tctx->mtab->n_lsp; i++)\n        lsp[i] =  2*cos(lsp[i]);\n    switch (ftype) {\n    case FT_LONG:\n        eval_lpcenv_2parts(tctx, ftype, lsp, lpc, size, 8);\n        break;\n    case FT_MEDIUM:\n        eval_lpcenv_2parts(tctx, ftype, lsp, lpc, size, 2);\n        break;\n    case FT_SHORT:\n        eval_lpcenv(tctx, lsp, lpc);\n        break;\n    }\n}', 'static void eval_lpcenv(TwinContext *tctx, const float *cos_vals, float *lpc)\n{\n    int i;\n    const ModeTab *mtab = tctx->mtab;\n    int size_s = mtab->size / mtab->fmode[FT_SHORT].sub;\n    for (i = 0; i < size_s/2; i++) {\n        float cos_i = tctx->cos_tabs[0][i];\n        lpc[i]          = eval_lpc_spectrum(cos_vals,  cos_i, mtab->n_lsp);\n        lpc[size_s-i-1] = eval_lpc_spectrum(cos_vals, -cos_i, mtab->n_lsp);\n    }\n}', 'static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)\n{\n    int j;\n    float p = 0.5f;\n    float q = 0.5f;\n    float two_cos_w = 2.0f*cos_val;\n    for (j = 0; j + 1 < order; j += 2*2) {\n        q *= lsp[j  ] - two_cos_w;\n        p *= lsp[j+1] - two_cos_w;\n        q *= lsp[j+2] - two_cos_w;\n        p *= lsp[j+3] - two_cos_w;\n    }\n    p *= p * (2.0f - two_cos_w);\n    q *= q * (2.0f + two_cos_w);\n    return 0.5 / (p + q);\n}']