libavcodec/aacdec.c:121: error: Buffer Overrun L2
  Offset: [`elem_id`, max(16, `elem_id`)] Size: 16.

libavcodec/aacdec.c:114:1: <Offset trace>
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aacdec.c:114:1: Parameter `elem_id`
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aacdec.c:114:1: <Length trace>
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aacdec.c:114:1: Parameter `ac->tags_seen_this_frame[*][*]`
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aacdec.c:121:12: Array access: Offset: [elem_id, max(16, elem_id)] Size: 16
119.     */
120.     int err_printed = 0;
121.     while (ac->tags_seen_this_frame[type][elem_id] && elem_id < MAX_ELEM_ID) {
                ^
122.         if (ac->output_configured < OC_LOCKED && !err_printed) {
123.             av_log(ac->avctx, AV_LOG_WARNING, "Duplicate channel tag found, attempting to remap.\n");

static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
{
    int err_printed = 0;
    while (ac->tags_seen_this_frame[type][elem_id] && elem_id < MAX_ELEM_ID) {
        if (ac->output_configured < OC_LOCKED && !err_printed) {
            av_log(ac->avctx, AV_LOG_WARNING, "Duplicate channel tag found, attempting to remap.\n");
            err_printed = 1;
        }
        elem_id++;
    }
    if (elem_id == MAX_ELEM_ID)
        return NULL;
    ac->tags_seen_this_frame[type][elem_id] = 1;
    if (ac->tag_che_map[type][elem_id]) {
        return ac->tag_che_map[type][elem_id];
    }
    if (ac->tags_mapped >= tags_per_config[ac->m4ac.chan_config]) {
        return NULL;
    }
    switch (ac->m4ac.chan_config) {
    case 7:
        if (ac->tags_mapped == 3 && type == TYPE_CPE) {
            ac->tags_mapped++;
            return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][2];
        }
    case 6:
        if (ac->tags_mapped == tags_per_config[ac->m4ac.chan_config] - 1 && (type == TYPE_LFE || type == TYPE_SCE)) {
            ac->tags_mapped++;
            return ac->tag_che_map[type][elem_id] = ac->che[TYPE_LFE][0];
        }
    case 5:
        if (ac->tags_mapped == 2 && type == TYPE_CPE) {
            ac->tags_mapped++;
            return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][1];
        }
    case 4:
        if (ac->tags_mapped == 2 && ac->m4ac.chan_config == 4 && type == TYPE_SCE) {
            ac->tags_mapped++;
            return ac->tag_che_map[TYPE_SCE][elem_id] = ac->che[TYPE_SCE][1];
        }
    case 3:
    case 2:
        if (ac->tags_mapped == (ac->m4ac.chan_config != 2) && type == TYPE_CPE) {
            ac->tags_mapped++;
            return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][0];
        } else if (ac->m4ac.chan_config == 2) {
            return NULL;
        }
    case 1:
        if (!ac->tags_mapped && type == TYPE_SCE) {
            ac->tags_mapped++;
            return ac->tag_che_map[TYPE_SCE][elem_id] = ac->che[TYPE_SCE][0];
        }
    default:
        return NULL;
    }
}
['static ChannelElement *get_che(AACContext *ac, int type, int elem_id)\n{\n    int err_printed = 0;\n    while (ac->tags_seen_this_frame[type][elem_id] && elem_id < MAX_ELEM_ID) {\n        if (ac->output_configured < OC_LOCKED && !err_printed) {\n            av_log(ac->avctx, AV_LOG_WARNING, "Duplicate channel tag found, attempting to remap.\\n");\n            err_printed = 1;\n        }\n        elem_id++;\n    }\n    if (elem_id == MAX_ELEM_ID)\n        return NULL;\n    ac->tags_seen_this_frame[type][elem_id] = 1;\n    if (ac->tag_che_map[type][elem_id]) {\n        return ac->tag_che_map[type][elem_id];\n    }\n    if (ac->tags_mapped >= tags_per_config[ac->m4ac.chan_config]) {\n        return NULL;\n    }\n    switch (ac->m4ac.chan_config) {\n    case 7:\n        if (ac->tags_mapped == 3 && type == TYPE_CPE) {\n            ac->tags_mapped++;\n            return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][2];\n        }\n    case 6:\n        if (ac->tags_mapped == tags_per_config[ac->m4ac.chan_config] - 1 && (type == TYPE_LFE || type == TYPE_SCE)) {\n            ac->tags_mapped++;\n            return ac->tag_che_map[type][elem_id] = ac->che[TYPE_LFE][0];\n        }\n    case 5:\n        if (ac->tags_mapped == 2 && type == TYPE_CPE) {\n            ac->tags_mapped++;\n            return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][1];\n        }\n    case 4:\n        if (ac->tags_mapped == 2 && ac->m4ac.chan_config == 4 && type == TYPE_SCE) {\n            ac->tags_mapped++;\n            return ac->tag_che_map[TYPE_SCE][elem_id] = ac->che[TYPE_SCE][1];\n        }\n    case 3:\n    case 2:\n        if (ac->tags_mapped == (ac->m4ac.chan_config != 2) && type == TYPE_CPE) {\n            ac->tags_mapped++;\n            return ac->tag_che_map[TYPE_CPE][elem_id] = ac->che[TYPE_CPE][0];\n        } else if (ac->m4ac.chan_config == 2) {\n            return NULL;\n        }\n    case 1:\n        if (!ac->tags_mapped && type == TYPE_SCE) {\n            ac->tags_mapped++;\n            return ac->tag_che_map[TYPE_SCE][elem_id] = ac->che[TYPE_SCE][0];\n        }\n    default:\n        return NULL;\n    }\n}']