libavcodec/mpegaudiodec.c:2598: error: Buffer Overrun L1
  Offset: [417, +oo] (⇐ [33, +oo] + 384) Size: 2 by call to `mp_decode_frame`.

libavcodec/mpegaudiodec.c:2563:1: Parameter `*buf`
2561. 
2562. 
2563. static int decode_frame_mp3on4(AVCodecContext * avctx,
      ^
2564.                         void *data, int *data_size,
2565.                         const uint8_t * buf, int buf_size)

libavcodec/mpegaudiodec.c:2592:9: Assignment
2590.         assert (m != NULL);
2591. 
2592.         header = (AV_RB32(buf) & 0x000fffff) | s->syncword; // patch header
              ^
2593. 
2594.         if (ff_mpa_check_header(header) < 0) // Bad header, discard block

libavcodec/mpegaudiodec.c:2597:9: Call
2595.             break;
2596. 
2597.         ff_mpegaudio_decode_header(m, header);
              ^
2598.         out_size += mp_decode_frame(m, outptr, buf, fsize);
2599.         buf += fsize;

libavcodec/mpegaudiodecheader.c:39:9: Assignment
  37.     if (header & (1<<20)) {
  38.         s->lsf = (header & (1<<19)) ? 0 : 1;
  39.         mpeg25 = 0;
              ^
  40.     } else {
  41.         s->lsf = 1;

libavcodec/mpegaudiodecheader.c:49:5: Assignment
  47.     sample_rate_index = (header >> 10) & 3;
  48.     sample_rate = ff_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);
  49.     sample_rate_index += 3 * (s->lsf + mpeg25);
          ^
  50.     s->sample_rate_index = sample_rate_index;
  51.     s->error_protection = ((header >> 16) & 1) ^ 1;

libavcodec/mpegaudiodecheader.c:50:5: Assignment
  48.     sample_rate = ff_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);
  49.     sample_rate_index += 3 * (s->lsf + mpeg25);
  50.     s->sample_rate_index = sample_rate_index;
          ^
  51.     s->error_protection = ((header >> 16) & 1) ^ 1;
  52.     s->sample_rate = sample_rate;

libavcodec/mpegaudiodec.c:2598:21: Call
2596. 
2597.         ff_mpegaudio_decode_header(m, header);
2598.         out_size += mp_decode_frame(m, outptr, buf, fsize);
                          ^
2599.         buf += fsize;
2600.         len -= fsize;

libavcodec/mpegaudiodec.c:2280:1: Parameter `s->synth_buf[*]`
  2278. }
  2279. 
  2280. static int mp_decode_frame(MPADecodeContext *s,
        ^
  2281.                            OUT_INT *samples, const uint8_t *buf, int buf_size)
  2282. {

libavcodec/mpegaudiodec.c:2349:13: Call
  2347.         samples_ptr = samples + ch;
  2348.         for(i=0;i<nb_frames;i++) {
  2349.             ff_mpa_synth_filter(s->synth_buf[ch], &(s->synth_buf_offset[ch]),
                    ^
  2350.                          window, &s->dither_state,
  2351.                          samples_ptr, s->nb_channels,

libavcodec/mpegaudiodec.c:897:9: <Length trace>
895.     /* we calculate two samples at the same time to avoid one memory
896.        access per two sample */
897.     for(j=1;j<16;j++) {
             ^
898.         sum2 = 0;
899.         p = synth_buf + 16 + j;

libavcodec/mpegaudiodec.c:897:9: Assignment
    895.     /* we calculate two samples at the same time to avoid one memory
    896.        access per two sample */
    897.     for(j=1;j<16;j++) {
                 ^
    898.         sum2 = 0;
    899.         p = synth_buf + 16 + j;

libavcodec/mpegaudiodec.c:901:9: Assignment
    899.         p = synth_buf + 16 + j;
    900.         SUM8P2(sum, +=, sum2, -=, w, w2, p);
    901.         p = synth_buf + 48 - j;
                 ^
    902.         SUM8P2(sum, -=, sum2, -=, w + 32, w2 + 32, p);
    903. 

libavcodec/mpegaudiodec.c:902:9: Array access: Offset: [417, +oo] (⇐ [33, +oo] + 384) Size: 2 by call to `mp_decode_frame` 
    900.         SUM8P2(sum, +=, sum2, -=, w, w2, p);
    901.         p = synth_buf + 48 - j;
    902.         SUM8P2(sum, -=, sum2, -=, w + 32, w2 + 32, p);
                 ^
    903. 
    904.         *samples = round_sample(&sum);

void ff_mpa_synth_filter(MPA_INT *synth_buf_ptr, int *synth_buf_offset,
                         MPA_INT *window, int *dither_state,
                         OUT_INT *samples, int incr,
                         int32_t sb_samples[SBLIMIT])
{
    int32_t tmp[32];
    register MPA_INT *synth_buf;
    register const MPA_INT *w, *w2, *p;
    int j, offset, v;
    OUT_INT *samples2;
#if FRAC_BITS <= 15
    int sum, sum2;
#else
    int64_t sum, sum2;
#endif
    dct32(tmp, sb_samples);
    offset = *synth_buf_offset;
    synth_buf = synth_buf_ptr + offset;
    for(j=0;j<32;j++) {
        v = tmp[j];
#if FRAC_BITS <= 15
        v = av_clip_int16(v);
#endif
        synth_buf[j] = v;
    }
    memcpy(synth_buf + 512, synth_buf, 32 * sizeof(MPA_INT));
    samples2 = samples + 31 * incr;
    w = window;
    w2 = window + 31;
    sum = *dither_state;
    p = synth_buf + 16;
    SUM8(sum, +=, w, p);
    p = synth_buf + 48;
    SUM8(sum, -=, w + 32, p);
    *samples = round_sample(&sum);
    samples += incr;
    w++;
    for(j=1;j<16;j++) {
        sum2 = 0;
        p = synth_buf + 16 + j;
        SUM8P2(sum, +=, sum2, -=, w, w2, p);
        p = synth_buf + 48 - j;
        SUM8P2(sum, -=, sum2, -=, w + 32, w2 + 32, p);
        *samples = round_sample(&sum);
        samples += incr;
        sum += sum2;
        *samples2 = round_sample(&sum);
        samples2 -= incr;
        w++;
        w2--;
    }
    p = synth_buf + 32;
    SUM8(sum, -=, w + 32, p);
    *samples = round_sample(&sum);
    *dither_state= sum;
    offset = (offset - 32) & 511;
    *synth_buf_offset = offset;
}
['static int decode_frame_mp3on4(AVCodecContext * avctx,\n                        void *data, int *data_size,\n                        const uint8_t * buf, int buf_size)\n{\n    MP3On4DecodeContext *s = avctx->priv_data;\n    MPADecodeContext *m;\n    int fsize, len = buf_size, out_size = 0;\n    uint32_t header;\n    OUT_INT *out_samples = data;\n    OUT_INT decoded_buf[MPA_FRAME_SIZE * MPA_MAX_CHANNELS];\n    OUT_INT *outptr, *bp;\n    int fr, j, n;\n    *data_size = 0;\n    if (buf_size < HEADER_SIZE)\n        return -1;\n    outptr = s->frames == 1 ? out_samples : decoded_buf;\n    avctx->bit_rate = 0;\n    for (fr = 0; fr < s->frames; fr++) {\n        fsize = AV_RB16(buf) >> 4;\n        fsize = FFMIN3(fsize, len, MPA_MAX_CODED_FRAME_SIZE);\n        m = s->mp3decctx[fr];\n        assert (m != NULL);\n        header = (AV_RB32(buf) & 0x000fffff) | s->syncword;\n        if (ff_mpa_check_header(header) < 0)\n            break;\n        ff_mpegaudio_decode_header(m, header);\n        out_size += mp_decode_frame(m, outptr, buf, fsize);\n        buf += fsize;\n        len -= fsize;\n        if(s->frames > 1) {\n            n = m->avctx->frame_size*m->nb_channels;\n            bp = out_samples + s->coff[fr];\n            if(m->nb_channels == 1) {\n                for(j = 0; j < n; j++) {\n                    *bp = decoded_buf[j];\n                    bp += avctx->channels;\n                }\n            } else {\n                for(j = 0; j < n; j++) {\n                    bp[0] = decoded_buf[j++];\n                    bp[1] = decoded_buf[j];\n                    bp += avctx->channels;\n                }\n            }\n        }\n        avctx->bit_rate += m->bit_rate;\n    }\n    avctx->sample_rate = s->mp3decctx[0]->sample_rate;\n    *data_size = out_size;\n    return buf_size;\n}', 'int ff_mpegaudio_decode_header(MPADecodeContext *s, uint32_t header)\n{\n    int sample_rate, frame_size, mpeg25, padding;\n    int sample_rate_index, bitrate_index;\n    if (header & (1<<20)) {\n        s->lsf = (header & (1<<19)) ? 0 : 1;\n        mpeg25 = 0;\n    } else {\n        s->lsf = 1;\n        mpeg25 = 1;\n    }\n    s->layer = 4 - ((header >> 17) & 3);\n    sample_rate_index = (header >> 10) & 3;\n    sample_rate = ff_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);\n    sample_rate_index += 3 * (s->lsf + mpeg25);\n    s->sample_rate_index = sample_rate_index;\n    s->error_protection = ((header >> 16) & 1) ^ 1;\n    s->sample_rate = sample_rate;\n    bitrate_index = (header >> 12) & 0xf;\n    padding = (header >> 9) & 1;\n    s->mode = (header >> 6) & 3;\n    s->mode_ext = (header >> 4) & 3;\n    if (s->mode == MPA_MONO)\n        s->nb_channels = 1;\n    else\n        s->nb_channels = 2;\n    if (bitrate_index != 0) {\n        frame_size = ff_mpa_bitrate_tab[s->lsf][s->layer - 1][bitrate_index];\n        s->bit_rate = frame_size * 1000;\n        switch(s->layer) {\n        case 1:\n            frame_size = (frame_size * 12000) / sample_rate;\n            frame_size = (frame_size + padding) * 4;\n            break;\n        case 2:\n            frame_size = (frame_size * 144000) / sample_rate;\n            frame_size += padding;\n            break;\n        default:\n        case 3:\n            frame_size = (frame_size * 144000) / (sample_rate << s->lsf);\n            frame_size += padding;\n            break;\n        }\n        s->frame_size = frame_size;\n    } else {\n        return 1;\n    }\n#if defined(DEBUG)\n    dprintf(s->avctx, "layer%d, %d Hz, %d kbits/s, ",\n           s->layer, s->sample_rate, s->bit_rate);\n    if (s->nb_channels == 2) {\n        if (s->layer == 3) {\n            if (s->mode_ext & MODE_EXT_MS_STEREO)\n                dprintf(s->avctx, "ms-");\n            if (s->mode_ext & MODE_EXT_I_STEREO)\n                dprintf(s->avctx, "i-");\n        }\n        dprintf(s->avctx, "stereo");\n    } else {\n        dprintf(s->avctx, "mono");\n    }\n    dprintf(s->avctx, "\\n");\n#endif\n    return 0;\n}', 'static int mp_decode_frame(MPADecodeContext *s,\n                           OUT_INT *samples, const uint8_t *buf, int buf_size)\n{\n    int i, nb_frames, ch;\n    OUT_INT *samples_ptr;\n    init_get_bits(&s->gb, buf + HEADER_SIZE, (buf_size - HEADER_SIZE)*8);\n    if (s->error_protection)\n        skip_bits(&s->gb, 16);\n    dprintf(s->avctx, "frame %d:\\n", s->frame_count);\n    switch(s->layer) {\n    case 1:\n        s->avctx->frame_size = 384;\n        nb_frames = mp_decode_layer1(s);\n        break;\n    case 2:\n        s->avctx->frame_size = 1152;\n        nb_frames = mp_decode_layer2(s);\n        break;\n    case 3:\n        s->avctx->frame_size = s->lsf ? 576 : 1152;\n    default:\n        nb_frames = mp_decode_layer3(s);\n        s->last_buf_size=0;\n        if(s->in_gb.buffer){\n            align_get_bits(&s->gb);\n            i= (s->gb.size_in_bits - get_bits_count(&s->gb))>>3;\n            if(i >= 0 && i <= BACKSTEP_SIZE){\n                memmove(s->last_buf, s->gb.buffer + (get_bits_count(&s->gb)>>3), i);\n                s->last_buf_size=i;\n            }else\n                av_log(NULL, AV_LOG_ERROR, "invalid old backstep %d\\n", i);\n            s->gb= s->in_gb;\n            s->in_gb.buffer= NULL;\n        }\n        align_get_bits(&s->gb);\n        assert((get_bits_count(&s->gb) & 7) == 0);\n        i= (s->gb.size_in_bits - get_bits_count(&s->gb))>>3;\n        if(i<0 || i > BACKSTEP_SIZE || nb_frames<0){\n            av_log(NULL, AV_LOG_ERROR, "invalid new backstep %d\\n", i);\n            i= FFMIN(BACKSTEP_SIZE, buf_size - HEADER_SIZE);\n        }\n        assert(i <= buf_size - HEADER_SIZE && i>= 0);\n        memcpy(s->last_buf + s->last_buf_size, s->gb.buffer + buf_size - HEADER_SIZE - i, i);\n        s->last_buf_size += i;\n        break;\n    }\n#if defined(DEBUG)\n    for(i=0;i<nb_frames;i++) {\n        for(ch=0;ch<s->nb_channels;ch++) {\n            int j;\n            dprintf(s->avctx, "%d-%d:", i, ch);\n            for(j=0;j<SBLIMIT;j++)\n                dprintf(s->avctx, " %0.6f", (double)s->sb_samples[ch][i][j] / FRAC_ONE);\n            dprintf(s->avctx, "\\n");\n        }\n    }\n#endif\n    for(ch=0;ch<s->nb_channels;ch++) {\n        samples_ptr = samples + ch;\n        for(i=0;i<nb_frames;i++) {\n            ff_mpa_synth_filter(s->synth_buf[ch], &(s->synth_buf_offset[ch]),\n                         window, &s->dither_state,\n                         samples_ptr, s->nb_channels,\n                         s->sb_samples[ch][i]);\n            samples_ptr += 32 * s->nb_channels;\n        }\n    }\n#ifdef DEBUG\n    s->frame_count++;\n#endif\n    return nb_frames * 32 * sizeof(OUT_INT) * s->nb_channels;\n}', 'void ff_mpa_synth_filter(MPA_INT *synth_buf_ptr, int *synth_buf_offset,\n                         MPA_INT *window, int *dither_state,\n                         OUT_INT *samples, int incr,\n                         int32_t sb_samples[SBLIMIT])\n{\n    int32_t tmp[32];\n    register MPA_INT *synth_buf;\n    register const MPA_INT *w, *w2, *p;\n    int j, offset, v;\n    OUT_INT *samples2;\n#if FRAC_BITS <= 15\n    int sum, sum2;\n#else\n    int64_t sum, sum2;\n#endif\n    dct32(tmp, sb_samples);\n    offset = *synth_buf_offset;\n    synth_buf = synth_buf_ptr + offset;\n    for(j=0;j<32;j++) {\n        v = tmp[j];\n#if FRAC_BITS <= 15\n        v = av_clip_int16(v);\n#endif\n        synth_buf[j] = v;\n    }\n    memcpy(synth_buf + 512, synth_buf, 32 * sizeof(MPA_INT));\n    samples2 = samples + 31 * incr;\n    w = window;\n    w2 = window + 31;\n    sum = *dither_state;\n    p = synth_buf + 16;\n    SUM8(sum, +=, w, p);\n    p = synth_buf + 48;\n    SUM8(sum, -=, w + 32, p);\n    *samples = round_sample(&sum);\n    samples += incr;\n    w++;\n    for(j=1;j<16;j++) {\n        sum2 = 0;\n        p = synth_buf + 16 + j;\n        SUM8P2(sum, +=, sum2, -=, w, w2, p);\n        p = synth_buf + 48 - j;\n        SUM8P2(sum, -=, sum2, -=, w + 32, w2 + 32, p);\n        *samples = round_sample(&sum);\n        samples += incr;\n        sum += sum2;\n        *samples2 = round_sample(&sum);\n        samples2 -= incr;\n        w++;\n        w2--;\n    }\n    p = synth_buf + 32;\n    SUM8(sum, -=, w + 32, p);\n    *samples = round_sample(&sum);\n    *dither_state= sum;\n    offset = (offset - 32) & 511;\n    *synth_buf_offset = offset;\n}']