libavcodec/twinvq.c:808: error: Buffer Overrun L2
  Offset: [3, `tctx->mtab->n_lsp` + 1] Size: `tctx->mtab->n_lsp` by call to `dec_lpc_spectrum_inv`.

libavcodec/twinvq.c:732:1: Parameter `tctx->mtab->n_lsp`
730. }
731. 
732. static void read_and_decode_spectrum(TwinContext *tctx, GetBitContext *gb,
     ^
733.                                      float *out, enum FrameType ftype)
734. {

libavcodec/twinvq.c:783:19: Array declaration
781.     for (i = 0; i < channels; i++) {
782.         float *chunk = out + mtab->size * i;
783.         float lsp[tctx->mtab->n_lsp];
                       ^
784. 
785.         for (j = 0; j < sub; j++) {

libavcodec/twinvq.c:808:9: Call
806.                    tctx->lsp_hist[i]);
807. 
808.         dec_lpc_spectrum_inv(tctx, lsp, ftype, tctx->tmp_buf);
             ^
809. 
810.         for (j = 0; j < mtab->fmode[ftype].sub; j++) {

libavcodec/twinvq.c:589:1: Parameter `*lsp`
  587. }
  588. 
  589. static void dec_lpc_spectrum_inv(TwinContext *tctx, float *lsp,
       ^
  590.                                  enum FrameType ftype, float *lpc)
  591. {

libavcodec/twinvq.c:606:9: Call
  604.         break;
  605.     case FT_SHORT:
  606.         eval_lpcenv(tctx, lsp, lpc);
               ^
  607.         break;
  608.     }

libavcodec/twinvq.c:255:1: Parameter `*cos_vals`
    253.  * Evaluates the LPC amplitude spectrum envelope from the line spectrum pairs.
    254.  */
    255. static void eval_lpcenv(TwinContext *tctx, const float *cos_vals, float *lpc)
         ^
    256. {
    257.     int i;

libavcodec/twinvq.c:263:27: Call
    261.     for (i = 0; i < size_s/2; i++) {
    262.         float cos_i = tctx->cos_tabs[0][i];
    263.         lpc[i]          = eval_lpc_spectrum(cos_vals,  cos_i, mtab->n_lsp);
                                   ^
    264.         lpc[size_s-i-1] = eval_lpc_spectrum(cos_vals, -cos_i, mtab->n_lsp);
    265.     }

libavcodec/twinvq.c:230:1: <Offset trace>
228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
229.  */
230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
     ^
231. {
232.     int j;

libavcodec/twinvq.c:230:1: Parameter `order`
      228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
      229.  */
      230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
           ^
      231. {
      232.     int j;

libavcodec/twinvq.c:230:1: <Length trace>
228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
229.  */
230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
     ^
231. {
232.     int j;

libavcodec/twinvq.c:230:1: Parameter `*lsp`
      228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
      229.  */
      230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
           ^
      231. {
      232.     int j;

libavcodec/twinvq.c:243:14: Array access: Offset: [3, tctx->mtab->n_lsp + 1] Size: tctx->mtab->n_lsp by call to `dec_lpc_spectrum_inv` 
      241. 
      242.         q *= lsp[j+2] - two_cos_w;
      243.         p *= lsp[j+3] - two_cos_w;
                        ^
      244.     }
      245. 

static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
{
    int j;
    float p = 0.5f;
    float q = 0.5f;
    float two_cos_w = 2.0f*cos_val;
    for (j = 0; j + 1 < order; j += 2*2) {
        q *= lsp[j  ] - two_cos_w;
        p *= lsp[j+1] - two_cos_w;
        q *= lsp[j+2] - two_cos_w;
        p *= lsp[j+3] - two_cos_w;
    }
    p *= p * (2.0f - two_cos_w);
    q *= q * (2.0f + two_cos_w);
    return 0.5 / (p + q);
}
['static void read_and_decode_spectrum(TwinContext *tctx, GetBitContext *gb,\n                                     float *out, enum FrameType ftype)\n{\n    const ModeTab *mtab = tctx->mtab;\n    int channels = tctx->avctx->channels;\n    int sub = mtab->fmode[ftype].sub;\n    int block_size = mtab->size / sub;\n    float gain[channels*sub];\n    float ppc_shape[mtab->ppc_shape_len * channels * 4];\n    uint8_t bark1[channels][sub][mtab->fmode[ftype].bark_n_coef];\n    uint8_t bark_use_hist[channels][sub];\n    uint8_t lpc_idx1[channels];\n    uint8_t lpc_idx2[channels][tctx->mtab->lsp_split];\n    uint8_t lpc_hist_idx[channels];\n    int i, j, k;\n    dequant(tctx, gb, out, ftype,\n            mtab->fmode[ftype].cb0, mtab->fmode[ftype].cb1,\n            mtab->fmode[ftype].cb_len_read);\n    for (i = 0; i < channels; i++)\n        for (j = 0; j < sub; j++)\n            for (k = 0; k < mtab->fmode[ftype].bark_n_coef; k++)\n                bark1[i][j][k] =\n                    get_bits(gb, mtab->fmode[ftype].bark_n_bit);\n    for (i = 0; i < channels; i++)\n        for (j = 0; j < sub; j++)\n            bark_use_hist[i][j] = get_bits1(gb);\n    dec_gain(tctx, gb, ftype, gain);\n    for (i = 0; i < channels; i++) {\n        lpc_hist_idx[i] = get_bits(gb, tctx->mtab->lsp_bit0);\n        lpc_idx1    [i] = get_bits(gb, tctx->mtab->lsp_bit1);\n        for (j = 0; j < tctx->mtab->lsp_split; j++)\n            lpc_idx2[i][j] = get_bits(gb, tctx->mtab->lsp_bit2);\n    }\n    if (ftype == FT_LONG) {\n        int cb_len_p = (tctx->n_div[3] + mtab->ppc_shape_len*channels - 1)/\n            tctx->n_div[3];\n        dequant(tctx, gb, ppc_shape, FT_PPC, mtab->ppc_shape_cb,\n                mtab->ppc_shape_cb + cb_len_p*PPC_SHAPE_CB_SIZE, cb_len_p);\n    }\n    for (i = 0; i < channels; i++) {\n        float *chunk = out + mtab->size * i;\n        float lsp[tctx->mtab->n_lsp];\n        for (j = 0; j < sub; j++) {\n            dec_bark_env(tctx, bark1[i][j], bark_use_hist[i][j], i,\n                         tctx->tmp_buf, gain[sub*i+j], ftype);\n            tctx->dsp.vector_fmul(chunk + block_size*j, tctx->tmp_buf,\n                                  block_size);\n        }\n        if (ftype == FT_LONG) {\n            float pgain_step = 25000. / ((1 << mtab->pgain_bit) - 1);\n            int p_coef = get_bits(gb, tctx->mtab->ppc_period_bit);\n            int g_coef = get_bits(gb, tctx->mtab->pgain_bit);\n            float v = 1./8192*\n                mulawinv(pgain_step*g_coef+ pgain_step/2, 25000., PGAIN_MU);\n            decode_ppc(tctx, p_coef, ppc_shape + i*mtab->ppc_shape_len, v,\n                       chunk);\n        }\n        decode_lsp(tctx, lpc_idx1[i], lpc_idx2[i], lpc_hist_idx[i], lsp,\n                   tctx->lsp_hist[i]);\n        dec_lpc_spectrum_inv(tctx, lsp, ftype, tctx->tmp_buf);\n        for (j = 0; j < mtab->fmode[ftype].sub; j++) {\n            tctx->dsp.vector_fmul(chunk, tctx->tmp_buf, block_size);\n            chunk += block_size;\n        }\n    }\n}', 'static void dec_lpc_spectrum_inv(TwinContext *tctx, float *lsp,\n                                 enum FrameType ftype, float *lpc)\n{\n    int i;\n    int size = tctx->mtab->size / tctx->mtab->fmode[ftype].sub;\n    for (i = 0; i < tctx->mtab->n_lsp; i++)\n        lsp[i] =  2*cos(lsp[i]);\n    switch (ftype) {\n    case FT_LONG:\n        eval_lpcenv_2parts(tctx, ftype, lsp, lpc, size, 8);\n        break;\n    case FT_MEDIUM:\n        eval_lpcenv_2parts(tctx, ftype, lsp, lpc, size, 2);\n        break;\n    case FT_SHORT:\n        eval_lpcenv(tctx, lsp, lpc);\n        break;\n    }\n}', 'static void eval_lpcenv(TwinContext *tctx, const float *cos_vals, float *lpc)\n{\n    int i;\n    const ModeTab *mtab = tctx->mtab;\n    int size_s = mtab->size / mtab->fmode[FT_SHORT].sub;\n    for (i = 0; i < size_s/2; i++) {\n        float cos_i = tctx->cos_tabs[0][i];\n        lpc[i]          = eval_lpc_spectrum(cos_vals,  cos_i, mtab->n_lsp);\n        lpc[size_s-i-1] = eval_lpc_spectrum(cos_vals, -cos_i, mtab->n_lsp);\n    }\n}', 'static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)\n{\n    int j;\n    float p = 0.5f;\n    float q = 0.5f;\n    float two_cos_w = 2.0f*cos_val;\n    for (j = 0; j + 1 < order; j += 2*2) {\n        q *= lsp[j  ] - two_cos_w;\n        p *= lsp[j+1] - two_cos_w;\n        q *= lsp[j+2] - two_cos_w;\n        p *= lsp[j+3] - two_cos_w;\n    }\n    p *= p * (2.0f - two_cos_w);\n    q *= q * (2.0f + two_cos_w);\n    return 0.5 / (p + q);\n}']