libavcodec/lsp.c:125: error: Buffer Overrun L3
  Offset: 1 Size: [0, +oo] by call to `ff_acelp_lsp2lpc`.

libavcodec/lsp.c:112:1: Parameter `lp_order`
110. }
111. 
112. void ff_acelp_lp_decode(int16_t* lp_1st, int16_t* lp_2nd, const int16_t* lsp_2nd, const int16_t* lsp_prev, int lp_order)
     ^
113. {
114.     int16_t lsp_1st[lp_order]; // (0.15)

libavcodec/lsp.c:125:5: Call
123. #endif
124. 
125.     ff_acelp_lsp2lpc(lp_1st, lsp_1st, lp_order >> 1);
         ^
126. 
127.     /* LSP values for second subframe (3.2.5 of G.729)*/

libavcodec/lsp.c:90:1: Parameter `lp_half_order`
  88. }
  89. 
  90. void ff_acelp_lsp2lpc(int16_t* lp, const int16_t* lsp, int lp_half_order)
      ^
  91. {
  92.     int i;

libavcodec/lsp.c:93:12: Array declaration
  91. {
  92.     int i;
  93.     int f1[lp_half_order+1]; // (3.22)
                 ^
  94.     int f2[lp_half_order+1]; // (3.22)
  95. 

libavcodec/lsp.c:96:5: Call
  94.     int f2[lp_half_order+1]; // (3.22)
  95. 
  96.     lsp2poly(f1, lsp  , lp_half_order);
          ^
  97.     lsp2poly(f2, lsp+1, lp_half_order);
  98. 

libavcodec/lsp.c:73:1: <Length trace>
71.  * \param lsp LSP coefficients (-0x8000 <= (0.15) <= 0x7fff)
72.  */
73. static void lsp2poly(int* f, const int16_t* lsp, int lp_half_order)
    ^
74. {
75.     int i, j;

libavcodec/lsp.c:73:1: Parameter `*f`
    71.  * \param lsp LSP coefficients (-0x8000 <= (0.15) <= 0x7fff)
    72.  */
    73. static void lsp2poly(int* f, const int16_t* lsp, int lp_half_order)
        ^
    74. {
    75.     int i, j;

libavcodec/lsp.c:78:5: Array access: Offset: 1 Size: [0, +oo] by call to `ff_acelp_lsp2lpc` 
    76. 
    77.     f[0] = 0x400000;          // 1.0 in (3.22)
    78.     f[1] = -lsp[0] << 8;      // *2 and (0.15) -> (3.22)
            ^
    79. 
    80.     for(i=2; i<=lp_half_order; i++)

static void lsp2poly(int* f, const int16_t* lsp, int lp_half_order)
{
    int i, j;
    f[0] = 0x400000;
    f[1] = -lsp[0] << 8;
    for(i=2; i<=lp_half_order; i++)
    {
        f[i] = f[i-2];
        for(j=i; j>1; j--)
            f[j] -= MULL(f[j-1], lsp[2*i-2], FRAC_BITS) - f[j-2];
        f[1] -= lsp[2*i-2] << 8;
    }
}
['void ff_acelp_lp_decode(int16_t* lp_1st, int16_t* lp_2nd, const int16_t* lsp_2nd, const int16_t* lsp_prev, int lp_order)\n{\n    int16_t lsp_1st[lp_order];\n    int i;\n    for(i=0; i<lp_order; i++)\n#ifdef G729_BITEXACT\n        lsp_1st[i] = (lsp_2nd[i] >> 1) + (lsp_prev[i] >> 1);\n#else\n        lsp_1st[i] = (lsp_2nd[i] + lsp_prev[i]) >> 1;\n#endif\n    ff_acelp_lsp2lpc(lp_1st, lsp_1st, lp_order >> 1);\n    ff_acelp_lsp2lpc(lp_2nd, lsp_2nd, lp_order >> 1);\n}', 'void ff_acelp_lsp2lpc(int16_t* lp, const int16_t* lsp, int lp_half_order)\n{\n    int i;\n    int f1[lp_half_order+1];\n    int f2[lp_half_order+1];\n    lsp2poly(f1, lsp  , lp_half_order);\n    lsp2poly(f2, lsp+1, lp_half_order);\n    lp[0] = 4096;\n    for(i=1; i<lp_half_order+1; i++)\n    {\n        int ff1 = f1[i] + f1[i-1];\n        int ff2 = f2[i] - f2[i-1];\n        ff1 += 1 << 10;\n        lp[i]    = (ff1 + ff2) >> 11;\n        lp[(lp_half_order << 1) + 1 - i] = (ff1 - ff2) >> 11;\n    }\n}', 'static void lsp2poly(int* f, const int16_t* lsp, int lp_half_order)\n{\n    int i, j;\n    f[0] = 0x400000;\n    f[1] = -lsp[0] << 8;\n    for(i=2; i<=lp_half_order; i++)\n    {\n        f[i] = f[i-2];\n        for(j=i; j>1; j--)\n            f[j] -= MULL(f[j-1], lsp[2*i-2], FRAC_BITS) - f[j-2];\n        f[1] -= lsp[2*i-2] << 8;\n    }\n}']