libavcodec/mpegaudiodec.c:2093: error: Buffer Overrun L2
  Offset: [0, 8] Size: 2 by call to `mp_decode_frame`.

libavcodec/mpegaudiodec.c:2079:19: Call
2077.         assert(m != NULL);
2078. 
2079.         header = (AV_RB32(buf) & 0x000fffff) | s->syncword; // patch header
                        ^
2080. 
2081.         if (ff_mpa_check_header(header) < 0) // Bad header, discard block

libavutil/bswap.h:66:1: Parameter `x`
  64. 
  65. #ifndef av_bswap32
  66. static av_always_inline av_const uint32_t av_bswap32(uint32_t x)
      ^
  67. {
  68.     return AV_BSWAP32C(x);

libavutil/bswap.h:68:5: Assignment
  66. static av_always_inline av_const uint32_t av_bswap32(uint32_t x)
  67. {
  68.     return AV_BSWAP32C(x);
          ^
  69. }
  70. #endif

libavcodec/mpegaudiodec.c:2079:9: Assignment
2077.         assert(m != NULL);
2078. 
2079.         header = (AV_RB32(buf) & 0x000fffff) | s->syncword; // patch header
              ^
2080. 
2081.         if (ff_mpa_check_header(header) < 0) // Bad header, discard block

libavcodec/mpegaudiodec.c:2084:9: Call
2082.             break;
2083. 
2084.         avpriv_mpegaudio_decode_header((MPADecodeHeader *)m, header);
              ^
2085. 
2086.         if (ch + m->nb_channels > avctx->channels) {

libavcodec/mpegaudiodecheader.c:40:9: Assignment
  38.     if (header & (1<<20)) {
  39.         s->lsf = (header & (1<<19)) ? 0 : 1;
  40.         mpeg25 = 0;
              ^
  41.     } else {
  42.         s->lsf = 1;

libavcodec/mpegaudiodecheader.c:50:5: Assignment
  48.     sample_rate_index = (header >> 10) & 3;
  49.     sample_rate = avpriv_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);
  50.     sample_rate_index += 3 * (s->lsf + mpeg25);
          ^
  51.     s->sample_rate_index = sample_rate_index;
  52.     s->error_protection = ((header >> 16) & 1) ^ 1;

libavcodec/mpegaudiodecheader.c:51:5: Assignment
  49.     sample_rate = avpriv_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);
  50.     sample_rate_index += 3 * (s->lsf + mpeg25);
  51.     s->sample_rate_index = sample_rate_index;
          ^
  52.     s->error_protection = ((header >> 16) & 1) ^ 1;
  53.     s->sample_rate = sample_rate;

libavcodec/mpegaudiodec.c:2093:21: Call
2091.         ch += m->nb_channels;
2092. 
2093.         out_size += mp_decode_frame(m, outptr, buf, fsize);
                          ^
2094.         buf      += fsize;
2095.         len      -= fsize;

libavcodec/mpegaudiodec.c:1700:1: Parameter `s->nb_channels`
  1698. }
  1699. 
  1700. static int mp_decode_frame(MPADecodeContext *s, OUT_INT *samples,
        ^
  1701.                            const uint8_t *buf, int buf_size)
  1702. {

libavcodec/mpegaudiodec.c:1715:21: Call
  1713.     case 1:
  1714.         s->avctx->frame_size = 384;
  1715.         nb_frames = mp_decode_layer1(s);
                            ^
  1716.         break;
  1717.     case 2:

libavcodec/mpegaudiodec.c:649:1: <Offset trace>
647. 
648. /* return the number of decoded frames */
649. static int mp_decode_layer1(MPADecodeContext *s)
     ^
650. {
651.     int bound, i, v, n, ch, j, mant;

libavcodec/mpegaudiodec.c:649:1: Parameter `s->nb_channels`
    647. 
    648. /* return the number of decoded frames */
    649. static int mp_decode_layer1(MPADecodeContext *s)
         ^
    650. {
    651.     int bound, i, v, n, ch, j, mant;

libavcodec/mpegaudiodec.c:649:1: <Length trace>
647. 
648. /* return the number of decoded frames */
649. static int mp_decode_layer1(MPADecodeContext *s)
     ^
650. {
651.     int bound, i, v, n, ch, j, mant;

libavcodec/mpegaudiodec.c:649:1: Array declaration
    647. 
    648. /* return the number of decoded frames */
    649. static int mp_decode_layer1(MPADecodeContext *s)
         ^
    650. {
    651.     int bound, i, v, n, ch, j, mant;

libavcodec/mpegaudiodec.c:663:13: Array access: Offset: [0, 8] Size: 2 by call to `mp_decode_frame` 
    661.     for (i = 0; i < bound; i++) {
    662.         for (ch = 0; ch < s->nb_channels; ch++) {
    663.             allocation[ch][i] = get_bits(&s->gb, 4);
                     ^
    664.         }
    665.     }

static int mp_decode_layer1(MPADecodeContext *s)
{
    int bound, i, v, n, ch, j, mant;
    uint8_t allocation[MPA_MAX_CHANNELS][SBLIMIT];
    uint8_t scale_factors[MPA_MAX_CHANNELS][SBLIMIT];
    if (s->mode == MPA_JSTEREO)
        bound = (s->mode_ext + 1) * 4;
    else
        bound = SBLIMIT;
    for (i = 0; i < bound; i++) {
        for (ch = 0; ch < s->nb_channels; ch++) {
            allocation[ch][i] = get_bits(&s->gb, 4);
        }
    }
    for (i = bound; i < SBLIMIT; i++)
        allocation[0][i] = get_bits(&s->gb, 4);
    for (i = 0; i < bound; i++) {
        for (ch = 0; ch < s->nb_channels; ch++) {
            if (allocation[ch][i])
                scale_factors[ch][i] = get_bits(&s->gb, 6);
        }
    }
    for (i = bound; i < SBLIMIT; i++) {
        if (allocation[0][i]) {
            scale_factors[0][i] = get_bits(&s->gb, 6);
            scale_factors[1][i] = get_bits(&s->gb, 6);
        }
    }
    for (j = 0; j < 12; j++) {
        for (i = 0; i < bound; i++) {
            for (ch = 0; ch < s->nb_channels; ch++) {
                n = allocation[ch][i];
                if (n) {
                    mant = get_bits(&s->gb, n + 1);
                    v = l1_unscale(n, mant, scale_factors[ch][i]);
                } else {
                    v = 0;
                }
                s->sb_samples[ch][j][i] = v;
            }
        }
        for (i = bound; i < SBLIMIT; i++) {
            n = allocation[0][i];
            if (n) {
                mant = get_bits(&s->gb, n + 1);
                v = l1_unscale(n, mant, scale_factors[0][i]);
                s->sb_samples[0][j][i] = v;
                v = l1_unscale(n, mant, scale_factors[1][i]);
                s->sb_samples[1][j][i] = v;
            } else {
                s->sb_samples[0][j][i] = 0;
                s->sb_samples[1][j][i] = 0;
            }
        }
    }
    return 12;
}
['static int decode_frame_mp3on4(AVCodecContext *avctx, void *data,\n                               int *got_frame_ptr, AVPacket *avpkt)\n{\n    const uint8_t *buf     = avpkt->data;\n    int buf_size           = avpkt->size;\n    MP3On4DecodeContext *s = avctx->priv_data;\n    MPADecodeContext *m;\n    int fsize, len = buf_size, out_size = 0;\n    uint32_t header;\n    OUT_INT *out_samples;\n    OUT_INT *outptr, *bp;\n    int fr, j, n, ch, ret;\n    s->frame->nb_samples = MPA_FRAME_SIZE;\n    if ((ret = avctx->get_buffer(avctx, s->frame)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    out_samples = (OUT_INT *)s->frame->data[0];\n    if (buf_size < HEADER_SIZE)\n        return AVERROR_INVALIDDATA;\n    outptr = s->frames == 1 ? out_samples : s->decoded_buf;\n    avctx->bit_rate = 0;\n    ch = 0;\n    for (fr = 0; fr < s->frames; fr++) {\n        fsize = AV_RB16(buf) >> 4;\n        fsize = FFMIN3(fsize, len, MPA_MAX_CODED_FRAME_SIZE);\n        m     = s->mp3decctx[fr];\n        assert(m != NULL);\n        header = (AV_RB32(buf) & 0x000fffff) | s->syncword;\n        if (ff_mpa_check_header(header) < 0)\n            break;\n        avpriv_mpegaudio_decode_header((MPADecodeHeader *)m, header);\n        if (ch + m->nb_channels > avctx->channels) {\n            av_log(avctx, AV_LOG_ERROR, "frame channel count exceeds codec "\n                                        "channel count\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        ch += m->nb_channels;\n        out_size += mp_decode_frame(m, outptr, buf, fsize);\n        buf      += fsize;\n        len      -= fsize;\n        if (s->frames > 1) {\n            n = m->avctx->frame_size*m->nb_channels;\n            bp = out_samples + s->coff[fr];\n            if (m->nb_channels == 1) {\n                for (j = 0; j < n; j++) {\n                    *bp = s->decoded_buf[j];\n                    bp += avctx->channels;\n                }\n            } else {\n                for (j = 0; j < n; j++) {\n                    bp[0] = s->decoded_buf[j++];\n                    bp[1] = s->decoded_buf[j];\n                    bp   += avctx->channels;\n                }\n            }\n        }\n        avctx->bit_rate += m->bit_rate;\n    }\n    avctx->sample_rate = s->mp3decctx[0]->sample_rate;\n    s->frame->nb_samples = out_size / (avctx->channels * sizeof(OUT_INT));\n    *got_frame_ptr   = 1;\n    *(AVFrame *)data = *s->frame;\n    return buf_size;\n}', 'static av_always_inline av_const uint32_t av_bswap32(uint32_t x)\n{\n    return AV_BSWAP32C(x);\n}', 'int avpriv_mpegaudio_decode_header(MPADecodeHeader *s, uint32_t header)\n{\n    int sample_rate, frame_size, mpeg25, padding;\n    int sample_rate_index, bitrate_index;\n    if (header & (1<<20)) {\n        s->lsf = (header & (1<<19)) ? 0 : 1;\n        mpeg25 = 0;\n    } else {\n        s->lsf = 1;\n        mpeg25 = 1;\n    }\n    s->layer = 4 - ((header >> 17) & 3);\n    sample_rate_index = (header >> 10) & 3;\n    sample_rate = avpriv_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);\n    sample_rate_index += 3 * (s->lsf + mpeg25);\n    s->sample_rate_index = sample_rate_index;\n    s->error_protection = ((header >> 16) & 1) ^ 1;\n    s->sample_rate = sample_rate;\n    bitrate_index = (header >> 12) & 0xf;\n    padding = (header >> 9) & 1;\n    s->mode = (header >> 6) & 3;\n    s->mode_ext = (header >> 4) & 3;\n    if (s->mode == MPA_MONO)\n        s->nb_channels = 1;\n    else\n        s->nb_channels = 2;\n    if (bitrate_index != 0) {\n        frame_size = avpriv_mpa_bitrate_tab[s->lsf][s->layer - 1][bitrate_index];\n        s->bit_rate = frame_size * 1000;\n        switch(s->layer) {\n        case 1:\n            frame_size = (frame_size * 12000) / sample_rate;\n            frame_size = (frame_size + padding) * 4;\n            break;\n        case 2:\n            frame_size = (frame_size * 144000) / sample_rate;\n            frame_size += padding;\n            break;\n        default:\n        case 3:\n            frame_size = (frame_size * 144000) / (sample_rate << s->lsf);\n            frame_size += padding;\n            break;\n        }\n        s->frame_size = frame_size;\n    } else {\n        return 1;\n    }\n#if defined(DEBUG)\n    av_dlog(NULL, "layer%d, %d Hz, %d kbits/s, ",\n           s->layer, s->sample_rate, s->bit_rate);\n    if (s->nb_channels == 2) {\n        if (s->layer == 3) {\n            if (s->mode_ext & MODE_EXT_MS_STEREO)\n                av_dlog(NULL, "ms-");\n            if (s->mode_ext & MODE_EXT_I_STEREO)\n                av_dlog(NULL, "i-");\n        }\n        av_dlog(NULL, "stereo");\n    } else {\n        av_dlog(NULL, "mono");\n    }\n    av_dlog(NULL, "\\n");\n#endif\n    return 0;\n}', 'static int mp_decode_frame(MPADecodeContext *s, OUT_INT *samples,\n                           const uint8_t *buf, int buf_size)\n{\n    int i, nb_frames, ch, ret;\n    OUT_INT *samples_ptr;\n    init_get_bits(&s->gb, buf + HEADER_SIZE, (buf_size - HEADER_SIZE) * 8);\n    if (s->error_protection)\n        skip_bits(&s->gb, 16);\n    switch(s->layer) {\n    case 1:\n        s->avctx->frame_size = 384;\n        nb_frames = mp_decode_layer1(s);\n        break;\n    case 2:\n        s->avctx->frame_size = 1152;\n        nb_frames = mp_decode_layer2(s);\n        break;\n    case 3:\n        s->avctx->frame_size = s->lsf ? 576 : 1152;\n    default:\n        nb_frames = mp_decode_layer3(s);\n        s->last_buf_size=0;\n        if (s->in_gb.buffer) {\n            align_get_bits(&s->gb);\n            i = get_bits_left(&s->gb)>>3;\n            if (i >= 0 && i <= BACKSTEP_SIZE) {\n                memmove(s->last_buf, s->gb.buffer + (get_bits_count(&s->gb)>>3), i);\n                s->last_buf_size=i;\n            } else\n                av_log(s->avctx, AV_LOG_ERROR, "invalid old backstep %d\\n", i);\n            s->gb           = s->in_gb;\n            s->in_gb.buffer = NULL;\n        }\n        align_get_bits(&s->gb);\n        assert((get_bits_count(&s->gb) & 7) == 0);\n        i = get_bits_left(&s->gb) >> 3;\n        if (i < 0 || i > BACKSTEP_SIZE || nb_frames < 0) {\n            if (i < 0)\n                av_log(s->avctx, AV_LOG_ERROR, "invalid new backstep %d\\n", i);\n            i = FFMIN(BACKSTEP_SIZE, buf_size - HEADER_SIZE);\n        }\n        assert(i <= buf_size - HEADER_SIZE && i >= 0);\n        memcpy(s->last_buf + s->last_buf_size, s->gb.buffer + buf_size - HEADER_SIZE - i, i);\n        s->last_buf_size += i;\n    }\n    if (!samples) {\n        s->frame.nb_samples = s->avctx->frame_size;\n        if ((ret = s->avctx->get_buffer(s->avctx, &s->frame)) < 0) {\n            av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n            return ret;\n        }\n        samples = (OUT_INT *)s->frame.data[0];\n    }\n    for (ch = 0; ch < s->nb_channels; ch++) {\n        samples_ptr = samples + ch;\n        for (i = 0; i < nb_frames; i++) {\n            RENAME(ff_mpa_synth_filter)(\n                         &s->mpadsp,\n                         s->synth_buf[ch], &(s->synth_buf_offset[ch]),\n                         RENAME(ff_mpa_synth_window), &s->dither_state,\n                         samples_ptr, s->nb_channels,\n                         s->sb_samples[ch][i]);\n            samples_ptr += 32 * s->nb_channels;\n        }\n    }\n    return nb_frames * 32 * sizeof(OUT_INT) * s->nb_channels;\n}', 'static int mp_decode_layer1(MPADecodeContext *s)\n{\n    int bound, i, v, n, ch, j, mant;\n    uint8_t allocation[MPA_MAX_CHANNELS][SBLIMIT];\n    uint8_t scale_factors[MPA_MAX_CHANNELS][SBLIMIT];\n    if (s->mode == MPA_JSTEREO)\n        bound = (s->mode_ext + 1) * 4;\n    else\n        bound = SBLIMIT;\n    for (i = 0; i < bound; i++) {\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            allocation[ch][i] = get_bits(&s->gb, 4);\n        }\n    }\n    for (i = bound; i < SBLIMIT; i++)\n        allocation[0][i] = get_bits(&s->gb, 4);\n    for (i = 0; i < bound; i++) {\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            if (allocation[ch][i])\n                scale_factors[ch][i] = get_bits(&s->gb, 6);\n        }\n    }\n    for (i = bound; i < SBLIMIT; i++) {\n        if (allocation[0][i]) {\n            scale_factors[0][i] = get_bits(&s->gb, 6);\n            scale_factors[1][i] = get_bits(&s->gb, 6);\n        }\n    }\n    for (j = 0; j < 12; j++) {\n        for (i = 0; i < bound; i++) {\n            for (ch = 0; ch < s->nb_channels; ch++) {\n                n = allocation[ch][i];\n                if (n) {\n                    mant = get_bits(&s->gb, n + 1);\n                    v = l1_unscale(n, mant, scale_factors[ch][i]);\n                } else {\n                    v = 0;\n                }\n                s->sb_samples[ch][j][i] = v;\n            }\n        }\n        for (i = bound; i < SBLIMIT; i++) {\n            n = allocation[0][i];\n            if (n) {\n                mant = get_bits(&s->gb, n + 1);\n                v = l1_unscale(n, mant, scale_factors[0][i]);\n                s->sb_samples[0][j][i] = v;\n                v = l1_unscale(n, mant, scale_factors[1][i]);\n                s->sb_samples[1][j][i] = v;\n            } else {\n                s->sb_samples[0][j][i] = 0;\n                s->sb_samples[1][j][i] = 0;\n            }\n        }\n    }\n    return 12;\n}']