libavcodec/aacdec.c:2766: error: Buffer Overrun L3
  Offset: [-1, 11] Size: 16.

libavcodec/aacdec.c:2743:5: <Offset trace>
2741.     int err, i;
2742.     int samples = m4ac->frame_length_short ? 960 : 1024;
2743.     int chan_config = m4ac->chan_config;
          ^
2744.     int aot = m4ac->object_type;
2745. 

libavcodec/aacdec.c:2743:5: Assignment
2741.     int err, i;
2742.     int samples = m4ac->frame_length_short ? 960 : 1024;
2743.     int chan_config = m4ac->chan_config;
          ^
2744.     int aot = m4ac->object_type;
2745. 

libavcodec/aacdectab.h:83:1: <Length trace>
81. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 4, 5, 0, 5, 0 };
82. 
83. static const uint8_t aac_channel_layout_map[16][5][3] = {
    ^
84.     { { TYPE_SCE, 0, AAC_CHANNEL_FRONT }, },
85.     { { TYPE_CPE, 0, AAC_CHANNEL_FRONT }, },

libavcodec/aacdectab.h:83:1: Array declaration
81. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 4, 5, 0, 5, 0 };
82. 
83. static const uint8_t aac_channel_layout_map[16][5][3] = {
    ^
84.     { { TYPE_SCE, 0, AAC_CHANNEL_FRONT }, },
85.     { { TYPE_CPE, 0, AAC_CHANNEL_FRONT }, },

libavcodec/aacdec.c:2766:31: Array access: Offset: [-1, 11] Size: 16
2764.     }
2765.     for (i = 0; i < tags_per_config[chan_config]; i++) {
2766.         const int elem_type = aac_channel_layout_map[chan_config-1][i][0];
                                    ^
2767.         const int elem_id   = aac_channel_layout_map[chan_config-1][i][1];
2768.         if (!(che=get_che(ac, elem_type, elem_id))) {

static int aac_decode_er_frame(AVCodecContext *avctx, void *data,
                               int *got_frame_ptr, GetBitContext *gb)
{
    AACContext *ac = avctx->priv_data;
    const MPEG4AudioConfig *const m4ac = &ac->oc[1].m4ac;
    ChannelElement *che;
    int err, i;
    int samples = m4ac->frame_length_short ? 960 : 1024;
    int chan_config = m4ac->chan_config;
    int aot = m4ac->object_type;
    if (aot == AOT_ER_AAC_LD || aot == AOT_ER_AAC_ELD)
        samples >>= 1;
    ac->frame = data;
    if ((err = frame_configure_elements(avctx)) < 0)
        return err;
    ac->avctx->profile = aot - 1;
    ac->tags_mapped = 0;
    if (chan_config < 0 || (chan_config >= 8 && chan_config < 11) || chan_config >= 13) {
        avpriv_request_sample(avctx, "Unknown ER channel configuration %d",
                              chan_config);
        return AVERROR_INVALIDDATA;
    }
    for (i = 0; i < tags_per_config[chan_config]; i++) {
        const int elem_type = aac_channel_layout_map[chan_config-1][i][0];
        const int elem_id   = aac_channel_layout_map[chan_config-1][i][1];
        if (!(che=get_che(ac, elem_type, elem_id))) {
            av_log(ac->avctx, AV_LOG_ERROR,
                   "channel element %d.%d is not allocated\n",
                   elem_type, elem_id);
            return AVERROR_INVALIDDATA;
        }
        if (aot != AOT_ER_AAC_ELD)
            skip_bits(gb, 4);
        switch (elem_type) {
        case TYPE_SCE:
            err = decode_ics(ac, &che->ch[0], gb, 0, 0);
            break;
        case TYPE_CPE:
            err = decode_cpe(ac, gb, che);
            break;
        case TYPE_LFE:
            err = decode_ics(ac, &che->ch[0], gb, 0, 0);
            break;
        }
        if (err < 0)
            return err;
    }
    spectral_to_sample(ac);
    ac->frame->nb_samples = samples;
    ac->frame->sample_rate = avctx->sample_rate;
    *got_frame_ptr = 1;
    skip_bits_long(gb, get_bits_left(gb));
    return 0;
}
['static int aac_decode_er_frame(AVCodecContext *avctx, void *data,\n                               int *got_frame_ptr, GetBitContext *gb)\n{\n    AACContext *ac = avctx->priv_data;\n    const MPEG4AudioConfig *const m4ac = &ac->oc[1].m4ac;\n    ChannelElement *che;\n    int err, i;\n    int samples = m4ac->frame_length_short ? 960 : 1024;\n    int chan_config = m4ac->chan_config;\n    int aot = m4ac->object_type;\n    if (aot == AOT_ER_AAC_LD || aot == AOT_ER_AAC_ELD)\n        samples >>= 1;\n    ac->frame = data;\n    if ((err = frame_configure_elements(avctx)) < 0)\n        return err;\n    ac->avctx->profile = aot - 1;\n    ac->tags_mapped = 0;\n    if (chan_config < 0 || (chan_config >= 8 && chan_config < 11) || chan_config >= 13) {\n        avpriv_request_sample(avctx, "Unknown ER channel configuration %d",\n                              chan_config);\n        return AVERROR_INVALIDDATA;\n    }\n    for (i = 0; i < tags_per_config[chan_config]; i++) {\n        const int elem_type = aac_channel_layout_map[chan_config-1][i][0];\n        const int elem_id   = aac_channel_layout_map[chan_config-1][i][1];\n        if (!(che=get_che(ac, elem_type, elem_id))) {\n            av_log(ac->avctx, AV_LOG_ERROR,\n                   "channel element %d.%d is not allocated\\n",\n                   elem_type, elem_id);\n            return AVERROR_INVALIDDATA;\n        }\n        if (aot != AOT_ER_AAC_ELD)\n            skip_bits(gb, 4);\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, gb, che);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            break;\n        }\n        if (err < 0)\n            return err;\n    }\n    spectral_to_sample(ac);\n    ac->frame->nb_samples = samples;\n    ac->frame->sample_rate = avctx->sample_rate;\n    *got_frame_ptr = 1;\n    skip_bits_long(gb, get_bits_left(gb));\n    return 0;\n}']