libavcodec/opus_celt.c:2117: error: Buffer Overrun L3
  Offset added: 84 Size: [0, +oo].

libavcodec/opus_celt.c:1975:1: <Length trace>
1973. }
1974. 
1975. int ff_celt_decode_frame(CeltContext *s, OpusRangeCoder *rc,
      ^
1976.                          float **output, int coded_channels, int frame_size,
1977.                          int startband,  int endband)

libavcodec/opus_celt.c:1975:1: Parameter `s->frame[*].energy[*]`
1973. }
1974. 
1975. int ff_celt_decode_frame(CeltContext *s, OpusRangeCoder *rc,
      ^
1976.                          float **output, int coded_channels, int frame_size,
1977.                          int startband,  int endband)

libavcodec/opus_celt.c:2117:9: Array access: Offset added: 84 Size: [0, +oo]
2115. 
2116.     if (coded_channels == 1)
2117.         memcpy(s->frame[1].energy, s->frame[0].energy, sizeof(s->frame[0].energy));
              ^
2118. 
2119.     for (i = 0; i < 2; i++ ) {

int ff_celt_decode_frame(CeltContext *s, OpusRangeCoder *rc,
                         float **output, int coded_channels, int frame_size,
                         int startband,  int endband)
{
    int i, j;
    int consumed;
    int silence = 0;
    int transient = 0;
    int anticollapse = 0;
    CeltIMDCTContext *imdct;
    float imdct_scale = 1.0;
    if (coded_channels != 1 && coded_channels != 2) {
        av_log(s->avctx, AV_LOG_ERROR, "Invalid number of coded channels: %d\n",
               coded_channels);
        return AVERROR_INVALIDDATA;
    }
    if (startband < 0 || startband > endband || endband > CELT_MAX_BANDS) {
        av_log(s->avctx, AV_LOG_ERROR, "Invalid start/end band: %d %d\n",
               startband, endband);
        return AVERROR_INVALIDDATA;
    }
    s->flushed        = 0;
    s->coded_channels = coded_channels;
    s->startband      = startband;
    s->endband        = endband;
    s->framebits      = rc->rb.bytes * 8;
    s->duration = av_log2(frame_size / CELT_SHORT_BLOCKSIZE);
    if (s->duration > CELT_MAX_LOG_BLOCKS ||
        frame_size != CELT_SHORT_BLOCKSIZE * (1 << s->duration)) {
        av_log(s->avctx, AV_LOG_ERROR, "Invalid CELT frame size: %d\n",
               frame_size);
        return AVERROR_INVALIDDATA;
    }
    if (!s->output_channels)
        s->output_channels = coded_channels;
    memset(s->frame[0].collapse_masks, 0, sizeof(s->frame[0].collapse_masks));
    memset(s->frame[1].collapse_masks, 0, sizeof(s->frame[1].collapse_masks));
    consumed = opus_rc_tell(rc);
    if (consumed >= s->framebits)
        silence = 1;
    else if (consumed == 1)
        silence = opus_rc_p2model(rc, 15);
    if (silence) {
        consumed = s->framebits;
        rc->total_read_bits += s->framebits - opus_rc_tell(rc);
    }
    consumed = parse_postfilter(s, rc, consumed);
    if (s->duration != 0 && consumed+3 <= s->framebits)
        transient = opus_rc_p2model(rc, 3);
    s->blocks    = transient ? 1 << s->duration : 1;
    s->blocksize = frame_size / s->blocks;
    imdct = s->imdct[transient ? 0 : s->duration];
    if (coded_channels == 1) {
        for (i = 0; i < CELT_MAX_BANDS; i++)
            s->frame[0].energy[i] = FFMAX(s->frame[0].energy[i], s->frame[1].energy[i]);
    }
    celt_decode_coarse_energy(s, rc);
    celt_decode_tf_changes   (s, rc, transient);
    celt_decode_allocation   (s, rc);
    celt_decode_fine_energy  (s, rc);
    celt_decode_bands        (s, rc);
    if (s->anticollapse_bit)
        anticollapse = opus_getrawbits(rc, 1);
    celt_decode_final_energy(s, rc, s->framebits - opus_rc_tell(rc));
    for (i = 0; i < s->coded_channels; i++) {
        CeltFrame *frame = &s->frame[i];
        if (anticollapse)
            process_anticollapse(s, frame, s->coeffs[i]);
        celt_denormalize(s, frame, s->coeffs[i]);
    }
    if (s->output_channels < s->coded_channels) {
        s->dsp.vector_fmac_scalar(s->coeffs[0], s->coeffs[1], 1.0, FFALIGN(frame_size, 16));
        imdct_scale = 0.5;
    } else if (s->output_channels > s->coded_channels)
        memcpy(s->coeffs[1], s->coeffs[0], frame_size * sizeof(float));
    if (silence) {
        for (i = 0; i < 2; i++) {
            CeltFrame *frame = &s->frame[i];
            for (j = 0; j < FF_ARRAY_ELEMS(frame->energy); j++)
                frame->energy[j] = CELT_ENERGY_SILENCE;
        }
        memset(s->coeffs, 0, sizeof(s->coeffs));
    }
    for (i = 0; i < s->output_channels; i++) {
        CeltFrame *frame = &s->frame[i];
        float m = frame->deemph_coeff;
        for (j = 0; j < s->blocks; j++) {
            float *dst  = frame->buf + 1024 + j * s->blocksize;
            ff_celt_imdct_half(imdct, dst + CELT_OVERLAP / 2, s->coeffs[i] + j,
                               s->blocks, imdct_scale);
            s->dsp.vector_fmul_window(dst, dst, dst + CELT_OVERLAP / 2,
                                      celt_window, CELT_OVERLAP / 2);
        }
        celt_postfilter(s, frame);
        for (j = 0; j < frame_size; j++) {
            float tmp = frame->buf[1024 - frame_size + j] + m;
            m = tmp * CELT_DEEMPH_COEFF;
            output[i][j] = tmp / 32768.;
        }
        frame->deemph_coeff = m;
    }
    if (coded_channels == 1)
        memcpy(s->frame[1].energy, s->frame[0].energy, sizeof(s->frame[0].energy));
    for (i = 0; i < 2; i++ ) {
        CeltFrame *frame = &s->frame[i];
        if (!transient) {
            memcpy(frame->prev_energy[1], frame->prev_energy[0], sizeof(frame->prev_energy[0]));
            memcpy(frame->prev_energy[0], frame->energy,         sizeof(frame->prev_energy[0]));
        } else {
            for (j = 0; j < CELT_MAX_BANDS; j++)
                frame->prev_energy[0][j] = FFMIN(frame->prev_energy[0][j], frame->energy[j]);
        }
        for (j = 0; j < s->startband; j++) {
            frame->prev_energy[0][j] = CELT_ENERGY_SILENCE;
            frame->energy[j]         = 0.0;
        }
        for (j = s->endband; j < CELT_MAX_BANDS; j++) {
            frame->prev_energy[0][j] = CELT_ENERGY_SILENCE;
            frame->energy[j]         = 0.0;
        }
    }
    s->seed = rc->range;
    return 0;
}
['int ff_celt_decode_frame(CeltContext *s, OpusRangeCoder *rc,\n                         float **output, int coded_channels, int frame_size,\n                         int startband,  int endband)\n{\n    int i, j;\n    int consumed;\n    int silence = 0;\n    int transient = 0;\n    int anticollapse = 0;\n    CeltIMDCTContext *imdct;\n    float imdct_scale = 1.0;\n    if (coded_channels != 1 && coded_channels != 2) {\n        av_log(s->avctx, AV_LOG_ERROR, "Invalid number of coded channels: %d\\n",\n               coded_channels);\n        return AVERROR_INVALIDDATA;\n    }\n    if (startband < 0 || startband > endband || endband > CELT_MAX_BANDS) {\n        av_log(s->avctx, AV_LOG_ERROR, "Invalid start/end band: %d %d\\n",\n               startband, endband);\n        return AVERROR_INVALIDDATA;\n    }\n    s->flushed        = 0;\n    s->coded_channels = coded_channels;\n    s->startband      = startband;\n    s->endband        = endband;\n    s->framebits      = rc->rb.bytes * 8;\n    s->duration = av_log2(frame_size / CELT_SHORT_BLOCKSIZE);\n    if (s->duration > CELT_MAX_LOG_BLOCKS ||\n        frame_size != CELT_SHORT_BLOCKSIZE * (1 << s->duration)) {\n        av_log(s->avctx, AV_LOG_ERROR, "Invalid CELT frame size: %d\\n",\n               frame_size);\n        return AVERROR_INVALIDDATA;\n    }\n    if (!s->output_channels)\n        s->output_channels = coded_channels;\n    memset(s->frame[0].collapse_masks, 0, sizeof(s->frame[0].collapse_masks));\n    memset(s->frame[1].collapse_masks, 0, sizeof(s->frame[1].collapse_masks));\n    consumed = opus_rc_tell(rc);\n    if (consumed >= s->framebits)\n        silence = 1;\n    else if (consumed == 1)\n        silence = opus_rc_p2model(rc, 15);\n    if (silence) {\n        consumed = s->framebits;\n        rc->total_read_bits += s->framebits - opus_rc_tell(rc);\n    }\n    consumed = parse_postfilter(s, rc, consumed);\n    if (s->duration != 0 && consumed+3 <= s->framebits)\n        transient = opus_rc_p2model(rc, 3);\n    s->blocks    = transient ? 1 << s->duration : 1;\n    s->blocksize = frame_size / s->blocks;\n    imdct = s->imdct[transient ? 0 : s->duration];\n    if (coded_channels == 1) {\n        for (i = 0; i < CELT_MAX_BANDS; i++)\n            s->frame[0].energy[i] = FFMAX(s->frame[0].energy[i], s->frame[1].energy[i]);\n    }\n    celt_decode_coarse_energy(s, rc);\n    celt_decode_tf_changes   (s, rc, transient);\n    celt_decode_allocation   (s, rc);\n    celt_decode_fine_energy  (s, rc);\n    celt_decode_bands        (s, rc);\n    if (s->anticollapse_bit)\n        anticollapse = opus_getrawbits(rc, 1);\n    celt_decode_final_energy(s, rc, s->framebits - opus_rc_tell(rc));\n    for (i = 0; i < s->coded_channels; i++) {\n        CeltFrame *frame = &s->frame[i];\n        if (anticollapse)\n            process_anticollapse(s, frame, s->coeffs[i]);\n        celt_denormalize(s, frame, s->coeffs[i]);\n    }\n    if (s->output_channels < s->coded_channels) {\n        s->dsp.vector_fmac_scalar(s->coeffs[0], s->coeffs[1], 1.0, FFALIGN(frame_size, 16));\n        imdct_scale = 0.5;\n    } else if (s->output_channels > s->coded_channels)\n        memcpy(s->coeffs[1], s->coeffs[0], frame_size * sizeof(float));\n    if (silence) {\n        for (i = 0; i < 2; i++) {\n            CeltFrame *frame = &s->frame[i];\n            for (j = 0; j < FF_ARRAY_ELEMS(frame->energy); j++)\n                frame->energy[j] = CELT_ENERGY_SILENCE;\n        }\n        memset(s->coeffs, 0, sizeof(s->coeffs));\n    }\n    for (i = 0; i < s->output_channels; i++) {\n        CeltFrame *frame = &s->frame[i];\n        float m = frame->deemph_coeff;\n        for (j = 0; j < s->blocks; j++) {\n            float *dst  = frame->buf + 1024 + j * s->blocksize;\n            ff_celt_imdct_half(imdct, dst + CELT_OVERLAP / 2, s->coeffs[i] + j,\n                               s->blocks, imdct_scale);\n            s->dsp.vector_fmul_window(dst, dst, dst + CELT_OVERLAP / 2,\n                                      celt_window, CELT_OVERLAP / 2);\n        }\n        celt_postfilter(s, frame);\n        for (j = 0; j < frame_size; j++) {\n            float tmp = frame->buf[1024 - frame_size + j] + m;\n            m = tmp * CELT_DEEMPH_COEFF;\n            output[i][j] = tmp / 32768.;\n        }\n        frame->deemph_coeff = m;\n    }\n    if (coded_channels == 1)\n        memcpy(s->frame[1].energy, s->frame[0].energy, sizeof(s->frame[0].energy));\n    for (i = 0; i < 2; i++ ) {\n        CeltFrame *frame = &s->frame[i];\n        if (!transient) {\n            memcpy(frame->prev_energy[1], frame->prev_energy[0], sizeof(frame->prev_energy[0]));\n            memcpy(frame->prev_energy[0], frame->energy,         sizeof(frame->prev_energy[0]));\n        } else {\n            for (j = 0; j < CELT_MAX_BANDS; j++)\n                frame->prev_energy[0][j] = FFMIN(frame->prev_energy[0][j], frame->energy[j]);\n        }\n        for (j = 0; j < s->startband; j++) {\n            frame->prev_energy[0][j] = CELT_ENERGY_SILENCE;\n            frame->energy[j]         = 0.0;\n        }\n        for (j = s->endband; j < CELT_MAX_BANDS; j++) {\n            frame->prev_energy[0][j] = CELT_ENERGY_SILENCE;\n            frame->energy[j]         = 0.0;\n        }\n    }\n    s->seed = rc->range;\n    return 0;\n}']