libavcodec/qcelpdec.c:838: error: Buffer Overrun L3
  Offset added: 40 Size: [0, +oo].

libavcodec/qcelpdec.c:799:8: <Length trace>
797.     compute_svector(q, gain, outbuffer);
798. 
799.     if(decode_lspf(q, quantized_lspf) < 0)
            ^
800.     {
801.         warn_insufficient_frame_quality(avctx, "Badly received packets in frame.");

libavcodec/qcelpdec.c:799:8: Call
797.     compute_svector(q, gain, outbuffer);
798. 
799.     if(decode_lspf(q, quantized_lspf) < 0)
            ^
800.     {
801.         warn_insufficient_frame_quality(avctx, "Badly received packets in frame.");

libavcodec/qcelpdec.c:114:1: Parameter `q->predictor_lspf[*]`
  112.  * TIA/EIA/IS-733 2.4.3.2.6.2-2, 2.4.8.7.3
  113.  */
  114. static int decode_lspf(QCELPContext *q, float *lspf)
       ^
  115. {
  116.     int i;

libavcodec/qcelpdec.c:838:5: Array access: Offset added: 40 Size: [0, +oo]
836.                                 QCELP_CLIP_UPPER_BOUND);
837. 
838.     memcpy(q->prev_lspf, quantized_lspf, sizeof(q->prev_lspf));
         ^
839.     q->prev_bitrate = q->bitrate;
840. 

static int qcelp_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
                              AVPacket *avpkt)
{
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    QCELPContext *q = avctx->priv_data;
    float *outbuffer = data;
    int   i;
    float quantized_lspf[10], lpc[10];
    float gain[16];
    float *formant_mem;
    if((q->bitrate = determine_bitrate(avctx, buf_size, &buf)) == I_F_Q)
    {
        warn_insufficient_frame_quality(avctx, "bitrate cannot be determined.");
        goto erasure;
    }
    if(q->bitrate == RATE_OCTAVE &&
       (q->first16bits = AV_RB16(buf)) == 0xFFFF)
    {
        warn_insufficient_frame_quality(avctx, "Bitrate is 1/8 and first 16 bits are on.");
        goto erasure;
    }
    if(q->bitrate > SILENCE)
    {
        const QCELPBitmap *bitmaps     = qcelp_unpacking_bitmaps_per_rate[q->bitrate];
        const QCELPBitmap *bitmaps_end = qcelp_unpacking_bitmaps_per_rate[q->bitrate]
                                       + qcelp_unpacking_bitmaps_lengths[q->bitrate];
        uint8_t           *unpacked_data = (uint8_t *)&q->frame;
        init_get_bits(&q->gb, buf, 8*buf_size);
        memset(&q->frame, 0, sizeof(QCELPFrame));
        for(; bitmaps < bitmaps_end; bitmaps++)
            unpacked_data[bitmaps->index] |= get_bits(&q->gb, bitmaps->bitlen) << bitmaps->bitpos;
        if(q->frame.reserved)
        {
            warn_insufficient_frame_quality(avctx, "Wrong data in reserved frame area.");
            goto erasure;
        }
        if(q->bitrate == RATE_QUARTER &&
           codebook_sanity_check_for_rate_quarter(q->frame.cbgain))
        {
            warn_insufficient_frame_quality(avctx, "Codebook gain sanity check failed.");
            goto erasure;
        }
        if(q->bitrate >= RATE_HALF)
        {
            for(i=0; i<4; i++)
            {
                if(q->frame.pfrac[i] && q->frame.plag[i] >= 124)
                {
                    warn_insufficient_frame_quality(avctx, "Cannot initialize pitch filter.");
                    goto erasure;
                }
            }
        }
    }
    decode_gain_and_index(q, gain);
    compute_svector(q, gain, outbuffer);
    if(decode_lspf(q, quantized_lspf) < 0)
    {
        warn_insufficient_frame_quality(avctx, "Badly received packets in frame.");
        goto erasure;
    }
    apply_pitch_filters(q, outbuffer);
    if(q->bitrate == I_F_Q)
    {
erasure:
        q->bitrate = I_F_Q;
        q->erasure_count++;
        decode_gain_and_index(q, gain);
        compute_svector(q, gain, outbuffer);
        decode_lspf(q, quantized_lspf);
        apply_pitch_filters(q, outbuffer);
    }else
        q->erasure_count = 0;
    formant_mem = q->formant_mem + 10;
    for(i=0; i<4; i++)
    {
        interpolate_lpc(q, quantized_lspf, lpc, i);
        ff_celp_lp_synthesis_filterf(formant_mem, lpc, outbuffer + i * 40, 40,
                                     10);
        formant_mem += 40;
    }
    memcpy(q->formant_mem, q->formant_mem + 160, 10 * sizeof(float));
    formant_mem = q->formant_mem + 10;
    for(i=0; i<160; i++)
        *outbuffer++ = av_clipf(*formant_mem++, QCELP_CLIP_LOWER_BOUND,
                                QCELP_CLIP_UPPER_BOUND);
    memcpy(q->prev_lspf, quantized_lspf, sizeof(q->prev_lspf));
    q->prev_bitrate = q->bitrate;
    *data_size = 160 * sizeof(*outbuffer);
    return *data_size;
}
['static int qcelp_decode_frame(AVCodecContext *avctx, void *data, int *data_size,\n                              AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    QCELPContext *q = avctx->priv_data;\n    float *outbuffer = data;\n    int   i;\n    float quantized_lspf[10], lpc[10];\n    float gain[16];\n    float *formant_mem;\n    if((q->bitrate = determine_bitrate(avctx, buf_size, &buf)) == I_F_Q)\n    {\n        warn_insufficient_frame_quality(avctx, "bitrate cannot be determined.");\n        goto erasure;\n    }\n    if(q->bitrate == RATE_OCTAVE &&\n       (q->first16bits = AV_RB16(buf)) == 0xFFFF)\n    {\n        warn_insufficient_frame_quality(avctx, "Bitrate is 1/8 and first 16 bits are on.");\n        goto erasure;\n    }\n    if(q->bitrate > SILENCE)\n    {\n        const QCELPBitmap *bitmaps     = qcelp_unpacking_bitmaps_per_rate[q->bitrate];\n        const QCELPBitmap *bitmaps_end = qcelp_unpacking_bitmaps_per_rate[q->bitrate]\n                                       + qcelp_unpacking_bitmaps_lengths[q->bitrate];\n        uint8_t           *unpacked_data = (uint8_t *)&q->frame;\n        init_get_bits(&q->gb, buf, 8*buf_size);\n        memset(&q->frame, 0, sizeof(QCELPFrame));\n        for(; bitmaps < bitmaps_end; bitmaps++)\n            unpacked_data[bitmaps->index] |= get_bits(&q->gb, bitmaps->bitlen) << bitmaps->bitpos;\n        if(q->frame.reserved)\n        {\n            warn_insufficient_frame_quality(avctx, "Wrong data in reserved frame area.");\n            goto erasure;\n        }\n        if(q->bitrate == RATE_QUARTER &&\n           codebook_sanity_check_for_rate_quarter(q->frame.cbgain))\n        {\n            warn_insufficient_frame_quality(avctx, "Codebook gain sanity check failed.");\n            goto erasure;\n        }\n        if(q->bitrate >= RATE_HALF)\n        {\n            for(i=0; i<4; i++)\n            {\n                if(q->frame.pfrac[i] && q->frame.plag[i] >= 124)\n                {\n                    warn_insufficient_frame_quality(avctx, "Cannot initialize pitch filter.");\n                    goto erasure;\n                }\n            }\n        }\n    }\n    decode_gain_and_index(q, gain);\n    compute_svector(q, gain, outbuffer);\n    if(decode_lspf(q, quantized_lspf) < 0)\n    {\n        warn_insufficient_frame_quality(avctx, "Badly received packets in frame.");\n        goto erasure;\n    }\n    apply_pitch_filters(q, outbuffer);\n    if(q->bitrate == I_F_Q)\n    {\nerasure:\n        q->bitrate = I_F_Q;\n        q->erasure_count++;\n        decode_gain_and_index(q, gain);\n        compute_svector(q, gain, outbuffer);\n        decode_lspf(q, quantized_lspf);\n        apply_pitch_filters(q, outbuffer);\n    }else\n        q->erasure_count = 0;\n    formant_mem = q->formant_mem + 10;\n    for(i=0; i<4; i++)\n    {\n        interpolate_lpc(q, quantized_lspf, lpc, i);\n        ff_celp_lp_synthesis_filterf(formant_mem, lpc, outbuffer + i * 40, 40,\n                                     10);\n        formant_mem += 40;\n    }\n    memcpy(q->formant_mem, q->formant_mem + 160, 10 * sizeof(float));\n    formant_mem = q->formant_mem + 10;\n    for(i=0; i<160; i++)\n        *outbuffer++ = av_clipf(*formant_mem++, QCELP_CLIP_LOWER_BOUND,\n                                QCELP_CLIP_UPPER_BOUND);\n    memcpy(q->prev_lspf, quantized_lspf, sizeof(q->prev_lspf));\n    q->prev_bitrate = q->bitrate;\n    *data_size = 160 * sizeof(*outbuffer);\n    return *data_size;\n}', 'static int decode_lspf(QCELPContext *q, float *lspf)\n{\n    int i;\n    float tmp_lspf, smooth, erasure_coeff;\n    const float *predictors;\n    if(q->bitrate == RATE_OCTAVE || q->bitrate == I_F_Q)\n    {\n        predictors = (q->prev_bitrate != RATE_OCTAVE &&\n                       q->prev_bitrate != I_F_Q ?\n                       q->prev_lspf : q->predictor_lspf);\n        if(q->bitrate == RATE_OCTAVE)\n        {\n            q->octave_count++;\n            for(i=0; i<10; i++)\n            {\n                q->predictor_lspf[i] =\n                             lspf[i] = (q->frame.lspv[i] ?  QCELP_LSP_SPREAD_FACTOR\n                                                         : -QCELP_LSP_SPREAD_FACTOR)\n                                     + predictors[i] * QCELP_LSP_OCTAVE_PREDICTOR\n                                     + (i + 1) * ((1 - QCELP_LSP_OCTAVE_PREDICTOR)/11);\n            }\n            smooth = (q->octave_count < 10 ? .875 : 0.1);\n        }else\n        {\n            erasure_coeff = QCELP_LSP_OCTAVE_PREDICTOR;\n            assert(q->bitrate == I_F_Q);\n            if(q->erasure_count > 1)\n                erasure_coeff *= (q->erasure_count < 4 ? 0.9 : 0.7);\n            for(i=0; i<10; i++)\n            {\n                q->predictor_lspf[i] =\n                             lspf[i] = (i + 1) * ( 1 - erasure_coeff)/11\n                                     + erasure_coeff * predictors[i];\n            }\n            smooth = 0.125;\n        }\n        lspf[0] = FFMAX(lspf[0], QCELP_LSP_SPREAD_FACTOR);\n        for(i=1; i<10; i++)\n            lspf[i] = FFMAX(lspf[i], (lspf[i-1] + QCELP_LSP_SPREAD_FACTOR));\n        lspf[9] = FFMIN(lspf[9], (1.0 - QCELP_LSP_SPREAD_FACTOR));\n        for(i=9; i>0; i--)\n            lspf[i-1] = FFMIN(lspf[i-1], (lspf[i] - QCELP_LSP_SPREAD_FACTOR));\n        ff_weighted_vector_sumf(lspf, lspf, q->prev_lspf, smooth, 1.0-smooth, 10);\n    }else\n    {\n        q->octave_count = 0;\n        tmp_lspf = 0.;\n        for(i=0; i<5 ; i++)\n        {\n            lspf[2*i+0] = tmp_lspf += qcelp_lspvq[i][q->frame.lspv[i]][0] * 0.0001;\n            lspf[2*i+1] = tmp_lspf += qcelp_lspvq[i][q->frame.lspv[i]][1] * 0.0001;\n        }\n        if(q->bitrate == RATE_QUARTER)\n        {\n            if(lspf[9] <= .70 || lspf[9] >=  .97)\n                return -1;\n            for(i=3; i<10; i++)\n                if(fabs(lspf[i] - lspf[i-2]) < .08)\n                    return -1;\n        }else\n        {\n            if(lspf[9] <= .66 || lspf[9] >= .985)\n                return -1;\n            for(i=4; i<10; i++)\n                if (fabs(lspf[i] - lspf[i-4]) < .0931)\n                    return -1;\n        }\n    }\n    return 0;\n}']