libavcodec/qdm2.c:1967: error: Buffer Overrun L1
  Offset: [16, +oo] Size: 4 by call to `qdm2_decode`.

libavcodec/qdm2.c:1967:13: Call
1965. 
1966.     for (i = 0; i < 16; i++) {
1967.         if (qdm2_decode(s, buf, out) < 0)
                  ^
1968.             return -1;
1969.         out += s->channels * s->frame_size;

libavcodec/qdm2.c:1911:13: Call
  1909.     if (!q->has_errors) {
  1910.         if (q->sub_packet == 2)
  1911.             qdm2_decode_fft_packets(q);
                    ^
  1912. 
  1913.         qdm2_fft_tone_synthesizer(q, q->sub_packet);

libavcodec/qdm2.c:1967:13: Call
1965. 
1966.     for (i = 0; i < 16; i++) {
1967.         if (qdm2_decode(s, buf, out) < 0)
                  ^
1968.             return -1;
1969.         out += s->channels * s->frame_size;

libavcodec/qdm2.c:1886:1: Parameter `q->fft_tones[*].duration`
  1884. 
  1885. 
  1886. static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
        ^
  1887. {
  1888.     int ch, i;

libavcodec/qdm2.c:1913:9: Call
  1911.             qdm2_decode_fft_packets(q);
  1912. 
  1913.         qdm2_fft_tone_synthesizer(q, q->sub_packet);
                ^
  1914.     }
  1915. 

libavcodec/qdm2.c:1513:1: Parameter `q->fft_tones[*].duration`
    1511. 
    1512. 
    1513. static void qdm2_fft_tone_synthesizer (QDM2Context *q, int sub_packet)
          ^
    1514. {
    1515.     int i, j, ch;

libavcodec/qdm2.c:1545:9: Call
    1543.     /* generate existing FFT tones */
    1544.     for (i = q->fft_tone_end; i != q->fft_tone_start; ) {
    1545.         qdm2_fft_generate_tone(q, &q->fft_tones[q->fft_tone_start]);
                  ^
    1546.         q->fft_tone_start = (q->fft_tone_start + 1) % 1000;
    1547.     }

libavcodec/qdm2.c:1468:1: <Offset trace>
1466. 
1467. 
1468. static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone)
      ^
1469. {
1470.    float level, f[6];

libavcodec/qdm2.c:1468:1: Parameter `tone->duration`
      1466. 
      1467. 
      1468. static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone)
            ^
      1469. {
      1470.    float level, f[6];

libavcodec/qdm2data.h:476:1: <Length trace>
474. } };
475. 
476. static const float fft_tone_envelope_table[4][31] = {
     ^
477.     { .009607375f, .038060248f, .084265202f, .146446645f, .222214907f, .308658302f,
478.       .402454883f, .500000060f, .597545207f, .691341758f, .777785182f, .853553414f,

libavcodec/qdm2data.h:476:1: Array declaration
      474. } };
      475. 
      476. static const float fft_tone_envelope_table[4][31] = {
           ^
      477.     { .009607375f, .038060248f, .084265202f, .146446645f, .222214907f, .308658302f,
      478.       .402454883f, .500000060f, .597545207f, .691341758f, .777785182f, .853553414f,

libavcodec/qdm2.c:1478:13: Array access: Offset: [16, +oo] Size: 4 by call to `qdm2_decode` 
      1476. 
      1477.     /* calculate current level (maximum amplitude) of tone */
      1478.     level = fft_tone_envelope_table[tone->duration][tone->time_index] * tone->level;
                        ^
      1479.     c.im = level * sin(tone->phase*iscale);
      1480.     c.re = level * cos(tone->phase*iscale);

static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone)
{
   float level, f[6];
   int i;
   QDM2Complex c;
   const double iscale = 2.0*M_PI / 512.0;
    tone->phase += tone->phase_shift;
    level = fft_tone_envelope_table[tone->duration][tone->time_index] * tone->level;
    c.im = level * sin(tone->phase*iscale);
    c.re = level * cos(tone->phase*iscale);
    if (tone->duration >= 3 || tone->cutoff >= 3) {
        tone->complex[0].im += c.im;
        tone->complex[0].re += c.re;
        tone->complex[1].im -= c.im;
        tone->complex[1].re -= c.re;
    } else {
        f[1] = -tone->table[4];
        f[0] =  tone->table[3] - tone->table[0];
        f[2] =  1.0 - tone->table[2] - tone->table[3];
        f[3] =  tone->table[1] + tone->table[4] - 1.0;
        f[4] =  tone->table[0] - tone->table[1];
        f[5] =  tone->table[2];
        for (i = 0; i < 2; i++) {
            tone->complex[fft_cutoff_index_table[tone->cutoff][i]].re += c.re * f[i];
            tone->complex[fft_cutoff_index_table[tone->cutoff][i]].im += c.im *((tone->cutoff <= i) ? -f[i] : f[i]);
        }
        for (i = 0; i < 4; i++) {
            tone->complex[i].re += c.re * f[i+2];
            tone->complex[i].im += c.im * f[i+2];
        }
    }
    if (++tone->time_index < ((1 << (5 - tone->duration)) - 1)) {
      memcpy(&q->fft_tones[q->fft_tone_end], tone, sizeof(FFTTone));
      q->fft_tone_end = (q->fft_tone_end + 1) % 1000;
    }
}
['static int qdm2_decode_frame(AVCodecContext *avctx,\n            void *data, int *data_size,\n            AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    QDM2Context *s = avctx->priv_data;\n    int16_t *out = data;\n    int i;\n    if(!buf)\n        return 0;\n    if(buf_size < s->checksum_size)\n        return -1;\n    av_log(avctx, AV_LOG_DEBUG, "decode(%d): %p[%d] -> %p[%d]\\n",\n       buf_size, buf, s->checksum_size, data, *data_size);\n    for (i = 0; i < 16; i++) {\n        if (qdm2_decode(s, buf, out) < 0)\n            return -1;\n        out += s->channels * s->frame_size;\n    }\n    *data_size = (uint8_t*)out - (uint8_t*)data;\n    return buf_size;\n}', 'static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)\n{\n    int ch, i;\n    const int frame_size = (q->frame_size * q->channels);\n    q->compressed_data = in;\n    q->compressed_size = q->checksum_size;\n    memmove(q->output_buffer, &q->output_buffer[frame_size], frame_size * sizeof(float));\n    memset(&q->output_buffer[frame_size], 0, frame_size * sizeof(float));\n    if (q->sub_packet == 0) {\n        q->has_errors = 0;\n        av_log(NULL,AV_LOG_DEBUG,"Superblock follows\\n");\n        qdm2_decode_super_block(q);\n    }\n    if (!q->has_errors) {\n        if (q->sub_packet == 2)\n            qdm2_decode_fft_packets(q);\n        qdm2_fft_tone_synthesizer(q, q->sub_packet);\n    }\n    for (ch = 0; ch < q->channels; ch++) {\n        qdm2_calculate_fft(q, ch, q->sub_packet);\n        if (!q->has_errors && q->sub_packet_list_C[0].packet != NULL) {\n            SAMPLES_NEEDED_2("has errors, and C list is not empty")\n            return -1;\n        }\n    }\n    if (!q->has_errors && q->do_synth_filter)\n        qdm2_synthesis_filter(q, q->sub_packet);\n    q->sub_packet = (q->sub_packet + 1) % 16;\n    for (i = 0; i < frame_size; i++) {\n        int value = (int)q->output_buffer[i];\n        if (value > SOFTCLIP_THRESHOLD)\n            value = (value >  HARDCLIP_THRESHOLD) ?  32767 :  softclip_table[ value - SOFTCLIP_THRESHOLD];\n        else if (value < -SOFTCLIP_THRESHOLD)\n            value = (value < -HARDCLIP_THRESHOLD) ? -32767 : -softclip_table[-value - SOFTCLIP_THRESHOLD];\n        out[i] = value;\n    }\n    return 0;\n}', 'static void qdm2_fft_tone_synthesizer (QDM2Context *q, int sub_packet)\n{\n    int i, j, ch;\n    const double iscale = 0.25 * M_PI;\n    for (ch = 0; ch < q->channels; ch++) {\n        memset(q->fft.complex[ch], 0, q->fft_size * sizeof(QDM2Complex));\n    }\n    if (q->fft_coefs_min_index[4] >= 0)\n        for (i = q->fft_coefs_min_index[4]; i < q->fft_coefs_max_index[4]; i++) {\n            float level;\n            QDM2Complex c;\n            if (q->fft_coefs[i].sub_packet != sub_packet)\n                break;\n            ch = (q->channels == 1) ? 0 : q->fft_coefs[i].channel;\n            level = (q->fft_coefs[i].exp < 0) ? 0.0 : fft_tone_level_table[q->superblocktype_2_3 ? 0 : 1][q->fft_coefs[i].exp & 63];\n            c.re = level * cos(q->fft_coefs[i].phase * iscale);\n            c.im = level * sin(q->fft_coefs[i].phase * iscale);\n            q->fft.complex[ch][q->fft_coefs[i].offset + 0].re += c.re;\n            q->fft.complex[ch][q->fft_coefs[i].offset + 0].im += c.im;\n            q->fft.complex[ch][q->fft_coefs[i].offset + 1].re -= c.re;\n            q->fft.complex[ch][q->fft_coefs[i].offset + 1].im -= c.im;\n        }\n    for (i = q->fft_tone_end; i != q->fft_tone_start; ) {\n        qdm2_fft_generate_tone(q, &q->fft_tones[q->fft_tone_start]);\n        q->fft_tone_start = (q->fft_tone_start + 1) % 1000;\n    }\n    for (i = 0; i < 4; i++)\n        if (q->fft_coefs_min_index[i] >= 0) {\n            for (j = q->fft_coefs_min_index[i]; j < q->fft_coefs_max_index[i]; j++) {\n                int offset, four_i;\n                FFTTone tone;\n                if (q->fft_coefs[j].sub_packet != sub_packet)\n                    break;\n                four_i = (4 - i);\n                offset = q->fft_coefs[j].offset >> four_i;\n                ch = (q->channels == 1) ? 0 : q->fft_coefs[j].channel;\n                if (offset < q->frequency_range) {\n                    if (offset < 2)\n                        tone.cutoff = offset;\n                    else\n                        tone.cutoff = (offset >= 60) ? 3 : 2;\n                    tone.level = (q->fft_coefs[j].exp < 0) ? 0.0 : fft_tone_level_table[q->superblocktype_2_3 ? 0 : 1][q->fft_coefs[j].exp & 63];\n                    tone.complex = &q->fft.complex[ch][offset];\n                    tone.table = fft_tone_sample_table[i][q->fft_coefs[j].offset - (offset << four_i)];\n                    tone.phase = 64 * q->fft_coefs[j].phase - (offset << 8) - 128;\n                    tone.phase_shift = (2 * q->fft_coefs[j].offset + 1) << (7 - four_i);\n                    tone.duration = i;\n                    tone.time_index = 0;\n                    qdm2_fft_generate_tone(q, &tone);\n                }\n            }\n            q->fft_coefs_min_index[i] = j;\n        }\n}', 'static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone)\n{\n   float level, f[6];\n   int i;\n   QDM2Complex c;\n   const double iscale = 2.0*M_PI / 512.0;\n    tone->phase += tone->phase_shift;\n    level = fft_tone_envelope_table[tone->duration][tone->time_index] * tone->level;\n    c.im = level * sin(tone->phase*iscale);\n    c.re = level * cos(tone->phase*iscale);\n    if (tone->duration >= 3 || tone->cutoff >= 3) {\n        tone->complex[0].im += c.im;\n        tone->complex[0].re += c.re;\n        tone->complex[1].im -= c.im;\n        tone->complex[1].re -= c.re;\n    } else {\n        f[1] = -tone->table[4];\n        f[0] =  tone->table[3] - tone->table[0];\n        f[2] =  1.0 - tone->table[2] - tone->table[3];\n        f[3] =  tone->table[1] + tone->table[4] - 1.0;\n        f[4] =  tone->table[0] - tone->table[1];\n        f[5] =  tone->table[2];\n        for (i = 0; i < 2; i++) {\n            tone->complex[fft_cutoff_index_table[tone->cutoff][i]].re += c.re * f[i];\n            tone->complex[fft_cutoff_index_table[tone->cutoff][i]].im += c.im *((tone->cutoff <= i) ? -f[i] : f[i]);\n        }\n        for (i = 0; i < 4; i++) {\n            tone->complex[i].re += c.re * f[i+2];\n            tone->complex[i].im += c.im * f[i+2];\n        }\n    }\n    if (++tone->time_index < ((1 << (5 - tone->duration)) - 1)) {\n      memcpy(&q->fft_tones[q->fft_tone_end], tone, sizeof(FFTTone));\n      q->fft_tone_end = (q->fft_tone_end + 1) % 1000;\n    }\n}']