libavcodec/aacdec.c:1813: error: Buffer Overrun L3
  Offset added: 2048 Size: [0, +oo].

libavcodec/aacdec.c:1789:1: <Length trace>
1787.  * Update the LTP buffer for next frame
1788.  */
1789. static void update_ltp(AACContext *ac, SingleChannelElement *sce)
      ^
1790. {
1791.     IndividualChannelStream *ics = &sce->ics;

libavcodec/aacdec.c:1789:1: Parameter `sce->ltp_state[*]`
1787.  * Update the LTP buffer for next frame
1788.  */
1789. static void update_ltp(AACContext *ac, SingleChannelElement *sce)
      ^
1790. {
1791.     IndividualChannelStream *ics = &sce->ics;

libavcodec/aacdec.c:1813:5: Array access: Offset added: 2048 Size: [0, +oo]
1811.     }
1812. 
1813.     memcpy(sce->ltp_state, &sce->ltp_state[1024], 1024 * sizeof(int16_t));
          ^
1814.     ac->fmt_conv.float_to_int16(&(sce->ltp_state[1024]), sce->ret,  1024);
1815.     ac->fmt_conv.float_to_int16(&(sce->ltp_state[2048]), saved_ltp, 1024);

static void update_ltp(AACContext *ac, SingleChannelElement *sce)
{
    IndividualChannelStream *ics = &sce->ics;
    float *saved     = sce->saved;
    float *saved_ltp = sce->coeffs;
    const float *lwindow = ics->use_kb_window[0] ? ff_aac_kbd_long_1024 : ff_sine_1024;
    const float *swindow = ics->use_kb_window[0] ? ff_aac_kbd_short_128 : ff_sine_128;
    int i;
    for (i = 0; i < 512; i++)
        ac->buf_mdct[1535 - i] = ac->buf_mdct[512 + i];
    if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {
        memcpy(saved_ltp,       saved, 512 * sizeof(float));
        memset(saved_ltp + 576, 0,     448 * sizeof(float));
        ac->dsp.vector_fmul_reverse(saved_ltp + 448, ac->buf_mdct + 960,     swindow,     128);
    } else if (ics->window_sequence[0] == LONG_START_SEQUENCE) {
        memcpy(saved_ltp,       ac->buf_mdct + 512, 448 * sizeof(float));
        memset(saved_ltp + 576, 0,                  448 * sizeof(float));
        ac->dsp.vector_fmul_reverse(saved_ltp + 448, ac->buf_mdct + 960,     swindow,     128);
    } else {
        ac->dsp.vector_fmul_reverse(saved_ltp,       ac->buf_mdct + 512,     lwindow,     1024);
    }
    memcpy(sce->ltp_state, &sce->ltp_state[1024], 1024 * sizeof(int16_t));
    ac->fmt_conv.float_to_int16(&(sce->ltp_state[1024]), sce->ret,  1024);
    ac->fmt_conv.float_to_int16(&(sce->ltp_state[2048]), saved_ltp, 1024);
}
['static void update_ltp(AACContext *ac, SingleChannelElement *sce)\n{\n    IndividualChannelStream *ics = &sce->ics;\n    float *saved     = sce->saved;\n    float *saved_ltp = sce->coeffs;\n    const float *lwindow = ics->use_kb_window[0] ? ff_aac_kbd_long_1024 : ff_sine_1024;\n    const float *swindow = ics->use_kb_window[0] ? ff_aac_kbd_short_128 : ff_sine_128;\n    int i;\n    for (i = 0; i < 512; i++)\n        ac->buf_mdct[1535 - i] = ac->buf_mdct[512 + i];\n    if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {\n        memcpy(saved_ltp,       saved, 512 * sizeof(float));\n        memset(saved_ltp + 576, 0,     448 * sizeof(float));\n        ac->dsp.vector_fmul_reverse(saved_ltp + 448, ac->buf_mdct + 960,     swindow,     128);\n    } else if (ics->window_sequence[0] == LONG_START_SEQUENCE) {\n        memcpy(saved_ltp,       ac->buf_mdct + 512, 448 * sizeof(float));\n        memset(saved_ltp + 576, 0,                  448 * sizeof(float));\n        ac->dsp.vector_fmul_reverse(saved_ltp + 448, ac->buf_mdct + 960,     swindow,     128);\n    } else {\n        ac->dsp.vector_fmul_reverse(saved_ltp,       ac->buf_mdct + 512,     lwindow,     1024);\n    }\n    memcpy(sce->ltp_state, &sce->ltp_state[1024], 1024 * sizeof(int16_t));\n    ac->fmt_conv.float_to_int16(&(sce->ltp_state[1024]), sce->ret,  1024);\n    ac->fmt_conv.float_to_int16(&(sce->ltp_state[2048]), saved_ltp, 1024);\n}']