libavcodec/aacdec.c:2126: error: Buffer Overrun L1
  Offset: -1 Size: 7 by call to `output_configure`.

libavcodec/aacdec.c:2126:23: Call
2124.                        "Not evaluating a further program_config_element as this construct is dubious at best.\n");
2125.             else
2126.                 err = output_configure(ac, ac->che_pos, new_che_pos, 0, OC_TRIAL_PCE);
                            ^
2127.             break;
2128.         }

libavcodec/aacdec.c:213:1: <Offset trace>
211.  * @return  Returns error status. 0 - OK, !0 - error
212.  */
213. static av_cold int output_configure(AACContext *ac,
     ^
214.                                     enum ChannelPosition che_pos[4][MAX_ELEM_ID],
215.                                     enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],

libavcodec/aacdec.c:213:1: Parameter `channel_config`
  211.  * @return  Returns error status. 0 - OK, !0 - error
  212.  */
  213. static av_cold int output_configure(AACContext *ac,
       ^
  214.                                     enum ChannelPosition che_pos[4][MAX_ELEM_ID],
  215.                                     enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],

libavcodec/aacdectab.h:83:1: <Length trace>
81. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 0, 0, 0, 0, 0 };
82. 
83. static const uint8_t aac_channel_layout_map[7][5][2] = {
    ^
84.     { { TYPE_SCE, 0 }, },
85.     { { TYPE_CPE, 0 }, },

libavcodec/aacdectab.h:83:1: Array declaration
  81. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 0, 0, 0, 0, 0 };
  82. 
  83. static const uint8_t aac_channel_layout_map[7][5][2] = {
      ^
  84.     { { TYPE_SCE, 0 }, },
  85.     { { TYPE_CPE, 0 }, },

libavcodec/aacdec.c:227:38: Array access: Offset: -1 Size: 7 by call to `output_configure` 
  225.         for (i = 0; i < tags_per_config[channel_config]; i++) {
  226.             if ((ret = che_configure(ac, che_pos,
  227.                                      aac_channel_layout_map[channel_config - 1][i][0],
                                            ^
  228.                                      aac_channel_layout_map[channel_config - 1][i][1],
  229.                                      &channels)))

static av_cold int output_configure(AACContext *ac,
                                    enum ChannelPosition che_pos[4][MAX_ELEM_ID],
                                    enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],
                                    int channel_config, enum OCStatus oc_type)
{
    AVCodecContext *avctx = ac->avctx;
    int i, type, channels = 0, ret;
    if (new_che_pos != che_pos)
    memcpy(che_pos, new_che_pos, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));
    if (channel_config) {
        for (i = 0; i < tags_per_config[channel_config]; i++) {
            if ((ret = che_configure(ac, che_pos,
                                     aac_channel_layout_map[channel_config - 1][i][0],
                                     aac_channel_layout_map[channel_config - 1][i][1],
                                     &channels)))
                return ret;
        }
        memset(ac->tag_che_map, 0, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));
        avctx->channel_layout = aac_channel_layout[channel_config - 1];
    } else {
        for (i = 0; i < MAX_ELEM_ID; i++) {
            for (type = 0; type < 4; type++) {
                if ((ret = che_configure(ac, che_pos, type, i, &channels)))
                    return ret;
            }
        }
        memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));
        avctx->channel_layout = 0;
    }
    avctx->channels = channels;
    ac->output_configured = oc_type;
    return 0;
}
['static int aac_decode_frame_int(AVCodecContext *avctx, void *data,\n                                int *data_size, GetBitContext *gb)\n{\n    AACContext *ac = avctx->priv_data;\n    ChannelElement *che = NULL, *che_prev = NULL;\n    enum RawDataBlockType elem_type, elem_type_prev = TYPE_END;\n    int err, elem_id, data_size_tmp;\n    int samples = 0, multiplier;\n    if (show_bits(gb, 12) == 0xfff) {\n        if (parse_adts_frame_header(ac, gb) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\\n");\n            return -1;\n        }\n        if (ac->m4ac.sampling_index > 12) {\n            av_log(ac->avctx, AV_LOG_ERROR, "invalid sampling rate index %d\\n", ac->m4ac.sampling_index);\n            return -1;\n        }\n    }\n    ac->tags_mapped = 0;\n    while ((elem_type = get_bits(gb, 3)) != TYPE_END) {\n        elem_id = get_bits(gb, 4);\n        if (elem_type < TYPE_DSE) {\n            if (!(che=get_che(ac, elem_type, elem_id))) {\n                av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\\n",\n                       elem_type, elem_id);\n                return -1;\n            }\n            samples = 1024;\n        }\n        switch (elem_type) {\n        case TYPE_SCE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            break;\n        case TYPE_CPE:\n            err = decode_cpe(ac, gb, che);\n            break;\n        case TYPE_CCE:\n            err = decode_cce(ac, gb, che);\n            break;\n        case TYPE_LFE:\n            err = decode_ics(ac, &che->ch[0], gb, 0, 0);\n            break;\n        case TYPE_DSE:\n            err = skip_data_stream_element(ac, gb);\n            break;\n        case TYPE_PCE: {\n            enum ChannelPosition new_che_pos[4][MAX_ELEM_ID];\n            memset(new_che_pos, 0, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n            if ((err = decode_pce(avctx, &ac->m4ac, new_che_pos, gb)))\n                break;\n            if (ac->output_configured > OC_TRIAL_PCE)\n                av_log(avctx, AV_LOG_ERROR,\n                       "Not evaluating a further program_config_element as this construct is dubious at best.\\n");\n            else\n                err = output_configure(ac, ac->che_pos, new_che_pos, 0, OC_TRIAL_PCE);\n            break;\n        }\n        case TYPE_FIL:\n            if (elem_id == 15)\n                elem_id += get_bits(gb, 8) - 1;\n            if (get_bits_left(gb) < 8 * elem_id) {\n                    av_log(avctx, AV_LOG_ERROR, overread_err);\n                    return -1;\n            }\n            while (elem_id > 0)\n                elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);\n            err = 0;\n            break;\n        default:\n            err = -1;\n            break;\n        }\n        che_prev       = che;\n        elem_type_prev = elem_type;\n        if (err)\n            return err;\n        if (get_bits_left(gb) < 3) {\n            av_log(avctx, AV_LOG_ERROR, overread_err);\n            return -1;\n        }\n    }\n    spectral_to_sample(ac);\n    multiplier = (ac->m4ac.sbr == 1) ? ac->m4ac.ext_sample_rate > ac->m4ac.sample_rate : 0;\n    samples <<= multiplier;\n    if (ac->output_configured < OC_LOCKED) {\n        avctx->sample_rate = ac->m4ac.sample_rate << multiplier;\n        avctx->frame_size = samples;\n    }\n    data_size_tmp = samples * avctx->channels * sizeof(int16_t);\n    if (*data_size < data_size_tmp) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Output buffer too small (%d) or trying to output too many samples (%d) for this frame.\\n",\n               *data_size, data_size_tmp);\n        return -1;\n    }\n    *data_size = data_size_tmp;\n    if (samples)\n        ac->fmt_conv.float_to_int16_interleave(data, (const float **)ac->output_data, samples, avctx->channels);\n    if (ac->output_configured)\n        ac->output_configured = OC_LOCKED;\n    return 0;\n}', 'static av_cold int output_configure(AACContext *ac,\n                                    enum ChannelPosition che_pos[4][MAX_ELEM_ID],\n                                    enum ChannelPosition new_che_pos[4][MAX_ELEM_ID],\n                                    int channel_config, enum OCStatus oc_type)\n{\n    AVCodecContext *avctx = ac->avctx;\n    int i, type, channels = 0, ret;\n    if (new_che_pos != che_pos)\n    memcpy(che_pos, new_che_pos, 4 * MAX_ELEM_ID * sizeof(new_che_pos[0][0]));\n    if (channel_config) {\n        for (i = 0; i < tags_per_config[channel_config]; i++) {\n            if ((ret = che_configure(ac, che_pos,\n                                     aac_channel_layout_map[channel_config - 1][i][0],\n                                     aac_channel_layout_map[channel_config - 1][i][1],\n                                     &channels)))\n                return ret;\n        }\n        memset(ac->tag_che_map, 0, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));\n        avctx->channel_layout = aac_channel_layout[channel_config - 1];\n    } else {\n        for (i = 0; i < MAX_ELEM_ID; i++) {\n            for (type = 0; type < 4; type++) {\n                if ((ret = che_configure(ac, che_pos, type, i, &channels)))\n                    return ret;\n            }\n        }\n        memcpy(ac->tag_che_map, ac->che, 4 * MAX_ELEM_ID * sizeof(ac->che[0][0]));\n        avctx->channel_layout = 0;\n    }\n    avctx->channels = channels;\n    ac->output_configured = oc_type;\n    return 0;\n}']