libavcodec/aacsbr.c:534: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 6.

libavcodec/aacsbr.c:506:5: <Offset trace>
504.     int goal_sb = ((1000 << 11) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
505. 
506.     sbr->num_patches = 0;
         ^
507. 
508.     if (goal_sb < sbr->kx[1] + sbr->m[1]) {

libavcodec/aacsbr.c:506:5: Assignment
504.     int goal_sb = ((1000 << 11) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
505. 
506.     sbr->num_patches = 0;
         ^
507. 
508.     if (goal_sb < sbr->kx[1] + sbr->m[1]) {

libavcodec/aacsbr.c:499:1: <Length trace>
497. 
498. /// High Frequency Generation - Patch Construction (14496-3 sp04 p216 fig. 4.46)
499. static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
     ^
500. {
501.     int i, k, sb = 0;

libavcodec/aacsbr.c:499:1: Parameter `sbr->patch_num_subbands[*]`
497. 
498. /// High Frequency Generation - Patch Construction (14496-3 sp04 p216 fig. 4.46)
499. static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
     ^
500. {
501.     int i, k, sb = 0;

libavcodec/aacsbr.c:534:9: Array access: Offset: [-1, +oo] Size: 6
532.     } while (sb != sbr->kx[1] + sbr->m[1]);
533. 
534.     if (sbr->patch_num_subbands[sbr->num_patches-1] < 3 && sbr->num_patches > 1)
             ^
535.         sbr->num_patches--;
536. 

static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
{
    int i, k, sb = 0;
    int msb = sbr->k[0];
    int usb = sbr->kx[1];
    int goal_sb = ((1000 << 11) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
    sbr->num_patches = 0;
    if (goal_sb < sbr->kx[1] + sbr->m[1]) {
        for (k = 0; sbr->f_master[k] < goal_sb; k++) ;
    } else
        k = sbr->n_master;
    do {
        int odd = 0;
        for (i = k; i == k || sb > (sbr->k[0] - 1 + msb - odd); i--) {
            sb = sbr->f_master[i];
            odd = (sb + sbr->k[0]) & 1;
        }
        sbr->patch_num_subbands[sbr->num_patches]  = FFMAX(sb - usb, 0);
        sbr->patch_start_subband[sbr->num_patches] = sbr->k[0] - odd - sbr->patch_num_subbands[sbr->num_patches];
        if (sbr->patch_num_subbands[sbr->num_patches] > 0) {
            usb = sb;
            msb = sb;
            sbr->num_patches++;
        } else
            msb = sbr->kx[1];
        if (sbr->f_master[k] - sb < 3)
            k = sbr->n_master;
    } while (sb != sbr->kx[1] + sbr->m[1]);
    if (sbr->patch_num_subbands[sbr->num_patches-1] < 3 && sbr->num_patches > 1)
        sbr->num_patches--;
    if (sbr->num_patches > 6) {
        av_log(ac->avccontext, AV_LOG_ERROR, "Too many patches: %d\n", sbr->num_patches);
        return -1;
    }
    return 0;
}
['static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)\n{\n    int i, k, sb = 0;\n    int msb = sbr->k[0];\n    int usb = sbr->kx[1];\n    int goal_sb = ((1000 << 11) + (sbr->sample_rate >> 1)) / sbr->sample_rate;\n    sbr->num_patches = 0;\n    if (goal_sb < sbr->kx[1] + sbr->m[1]) {\n        for (k = 0; sbr->f_master[k] < goal_sb; k++) ;\n    } else\n        k = sbr->n_master;\n    do {\n        int odd = 0;\n        for (i = k; i == k || sb > (sbr->k[0] - 1 + msb - odd); i--) {\n            sb = sbr->f_master[i];\n            odd = (sb + sbr->k[0]) & 1;\n        }\n        sbr->patch_num_subbands[sbr->num_patches]  = FFMAX(sb - usb, 0);\n        sbr->patch_start_subband[sbr->num_patches] = sbr->k[0] - odd - sbr->patch_num_subbands[sbr->num_patches];\n        if (sbr->patch_num_subbands[sbr->num_patches] > 0) {\n            usb = sb;\n            msb = sb;\n            sbr->num_patches++;\n        } else\n            msb = sbr->kx[1];\n        if (sbr->f_master[k] - sb < 3)\n            k = sbr->n_master;\n    } while (sb != sbr->kx[1] + sbr->m[1]);\n    if (sbr->patch_num_subbands[sbr->num_patches-1] < 3 && sbr->num_patches > 1)\n        sbr->num_patches--;\n    if (sbr->num_patches > 6) {\n        av_log(ac->avccontext, AV_LOG_ERROR, "Too many patches: %d\\n", sbr->num_patches);\n        return -1;\n    }\n    return 0;\n}']