libavcodec/mpegaudiodec.c:1537: error: Buffer Overrun L1
  Offset: [48, +oo] (⇐ [0, +oo] + [48, 68]) Size: 2 by call to `compute_imdct`.

libavcodec/mpegaudiodec.c:1293:1: Parameter `s->mdct_buf[*]`
1291. 
1292. /* main layer3 decoding function */
1293. static int mp_decode_layer3(MPADecodeContext *s)
      ^
1294. {
1295.     int nb_granules, main_data_begin;

libavcodec/mpegaudiodec.c:1537:13: Call
1535.             reorder_block(s, g);
1536.             compute_antialias(s, g);
1537.             compute_imdct(s, g, &s->sb_samples[ch][18 * gr][0], s->mdct_buf[ch]);
                  ^
1538.         }
1539.     } /* gr */

libavcodec/mpegaudiodec.c:1259:14: <Offset trace>
1257.         }
1258.         imdct12(out2, ptr + 0);
1259.         for (i = 0; i < 6; i++) {
                   ^
1260.             *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*1)];
1261.             buf[4*(i + 6*2)] = MULH3(out2[i + 6], win[i + 6], 1);

libavcodec/mpegaudiodec.c:1259:14: Assignment
  1257.         }
  1258.         imdct12(out2, ptr + 0);
  1259.         for (i = 0; i < 6; i++) {
                     ^
  1260.             *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*1)];
  1261.             buf[4*(i + 6*2)] = MULH3(out2[i + 6], win[i + 6], 1);

libavcodec/mpegaudiodec.c:1213:1: <Length trace>
1211. }
1212. 
1213. static void compute_imdct(MPADecodeContext *s, GranuleDef *g,
      ^
1214.                           INTFLOAT *sb_samples, INTFLOAT *mdct_buf)
1215. {

libavcodec/mpegaudiodec.c:1213:1: Parameter `*mdct_buf`
  1211. }
  1212. 
  1213. static void compute_imdct(MPADecodeContext *s, GranuleDef *g,
        ^
  1214.                           INTFLOAT *sb_samples, INTFLOAT *mdct_buf)
  1215. {

libavcodec/mpegaudiodec.c:1246:5: Assignment
  1244.                                      g->block_type);
  1245. 
  1246.     buf = mdct_buf + 4*18*(mdct_long_end >> 2) + (mdct_long_end & 3);
            ^
  1247.     ptr = g->sb_hybrid + 18 * mdct_long_end;
  1248. 

libavcodec/mpegaudiodec.c:1261:13: Array access: Offset: [48, +oo] (⇐ [0, +oo] + [48, 68]) Size: 2 by call to `compute_imdct` 
  1259.         for (i = 0; i < 6; i++) {
  1260.             *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*1)];
  1261.             buf[4*(i + 6*2)] = MULH3(out2[i + 6], win[i + 6], 1);
                    ^
  1262.             out_ptr += SBLIMIT;
  1263.         }

static void compute_imdct(MPADecodeContext *s, GranuleDef *g,
                          INTFLOAT *sb_samples, INTFLOAT *mdct_buf)
{
    INTFLOAT *win, *out_ptr, *ptr, *buf, *ptr1;
    INTFLOAT out2[12];
    int i, j, mdct_long_end, sblimit;
    ptr  = g->sb_hybrid + 576;
    ptr1 = g->sb_hybrid + 2 * 18;
    while (ptr >= ptr1) {
        int32_t *p;
        ptr -= 6;
        p    = (int32_t*)ptr;
        if (p[0] | p[1] | p[2] | p[3] | p[4] | p[5])
            break;
    }
    sblimit = ((ptr - g->sb_hybrid) / 18) + 1;
    if (g->block_type == 2) {
        if (g->switch_point)
            mdct_long_end = 2;
        else
            mdct_long_end = 0;
    } else {
        mdct_long_end = sblimit;
    }
    s->mpadsp.RENAME(imdct36_blocks)(sb_samples, mdct_buf, g->sb_hybrid,
                                     mdct_long_end, g->switch_point,
                                     g->block_type);
    buf = mdct_buf + 4*18*(mdct_long_end >> 2) + (mdct_long_end & 3);
    ptr = g->sb_hybrid + 18 * mdct_long_end;
    for (j = mdct_long_end; j < sblimit; j++) {
        win     = RENAME(ff_mdct_win)[2 + (4  & -(j & 1))];
        out_ptr = sb_samples + j;
        for (i = 0; i < 6; i++) {
            *out_ptr = buf[4*i];
            out_ptr += SBLIMIT;
        }
        imdct12(out2, ptr + 0);
        for (i = 0; i < 6; i++) {
            *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*1)];
            buf[4*(i + 6*2)] = MULH3(out2[i + 6], win[i + 6], 1);
            out_ptr += SBLIMIT;
        }
        imdct12(out2, ptr + 1);
        for (i = 0; i < 6; i++) {
            *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*2)];
            buf[4*(i + 6*0)] = MULH3(out2[i + 6], win[i + 6], 1);
            out_ptr += SBLIMIT;
        }
        imdct12(out2, ptr + 2);
        for (i = 0; i < 6; i++) {
            buf[4*(i + 6*0)] = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*0)];
            buf[4*(i + 6*1)] = MULH3(out2[i + 6], win[i + 6], 1);
            buf[4*(i + 6*2)] = 0;
        }
        ptr += 18;
        buf += (j&3) != 3 ? 1 : (4*18-3);
    }
    for (j = sblimit; j < SBLIMIT; j++) {
        out_ptr = sb_samples + j;
        for (i = 0; i < 18; i++) {
            *out_ptr = buf[4*i];
            buf[4*i]   = 0;
            out_ptr += SBLIMIT;
        }
        buf += (j&3) != 3 ? 1 : (4*18-3);
    }
}
['static int mp_decode_layer3(MPADecodeContext *s)\n{\n    int nb_granules, main_data_begin;\n    int gr, ch, blocksplit_flag, i, j, k, n, bits_pos;\n    GranuleDef *g;\n    int16_t exponents[576];\n    if (s->lsf) {\n        main_data_begin = get_bits(&s->gb, 8);\n        skip_bits(&s->gb, s->nb_channels);\n        nb_granules = 1;\n    } else {\n        main_data_begin = get_bits(&s->gb, 9);\n        if (s->nb_channels == 2)\n            skip_bits(&s->gb, 3);\n        else\n            skip_bits(&s->gb, 5);\n        nb_granules = 2;\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            s->granules[ch][0].scfsi = 0;\n            s->granules[ch][1].scfsi = get_bits(&s->gb, 4);\n        }\n    }\n    for (gr = 0; gr < nb_granules; gr++) {\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            av_dlog(s->avctx, "gr=%d ch=%d: side_info\\n", gr, ch);\n            g = &s->granules[ch][gr];\n            g->part2_3_length = get_bits(&s->gb, 12);\n            g->big_values     = get_bits(&s->gb,  9);\n            if (g->big_values > 288) {\n                av_log(s->avctx, AV_LOG_ERROR, "big_values too big\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            g->global_gain = get_bits(&s->gb, 8);\n            if ((s->mode_ext & (MODE_EXT_MS_STEREO | MODE_EXT_I_STEREO)) ==\n                MODE_EXT_MS_STEREO)\n                g->global_gain -= 2;\n            if (s->lsf)\n                g->scalefac_compress = get_bits(&s->gb, 9);\n            else\n                g->scalefac_compress = get_bits(&s->gb, 4);\n            blocksplit_flag = get_bits1(&s->gb);\n            if (blocksplit_flag) {\n                g->block_type = get_bits(&s->gb, 2);\n                if (g->block_type == 0) {\n                    av_log(s->avctx, AV_LOG_ERROR, "invalid block type\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                g->switch_point = get_bits1(&s->gb);\n                for (i = 0; i < 2; i++)\n                    g->table_select[i] = get_bits(&s->gb, 5);\n                for (i = 0; i < 3; i++)\n                    g->subblock_gain[i] = get_bits(&s->gb, 3);\n                ff_init_short_region(s, g);\n            } else {\n                int region_address1, region_address2;\n                g->block_type = 0;\n                g->switch_point = 0;\n                for (i = 0; i < 3; i++)\n                    g->table_select[i] = get_bits(&s->gb, 5);\n                region_address1 = get_bits(&s->gb, 4);\n                region_address2 = get_bits(&s->gb, 3);\n                av_dlog(s->avctx, "region1=%d region2=%d\\n",\n                        region_address1, region_address2);\n                ff_init_long_region(s, g, region_address1, region_address2);\n            }\n            ff_region_offset2size(g);\n            ff_compute_band_indexes(s, g);\n            g->preflag = 0;\n            if (!s->lsf)\n                g->preflag = get_bits1(&s->gb);\n            g->scalefac_scale     = get_bits1(&s->gb);\n            g->count1table_select = get_bits1(&s->gb);\n            av_dlog(s->avctx, "block_type=%d switch_point=%d\\n",\n                    g->block_type, g->switch_point);\n        }\n    }\n    if (!s->adu_mode) {\n        int skip;\n        const uint8_t *ptr = s->gb.buffer + (get_bits_count(&s->gb)>>3);\n        assert((get_bits_count(&s->gb) & 7) == 0);\n        av_dlog(s->avctx, "seekback: %d\\n", main_data_begin);\n        memcpy(s->last_buf + s->last_buf_size, ptr, EXTRABYTES);\n        s->in_gb = s->gb;\n        init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);\n#if !UNCHECKED_BITSTREAM_READER\n        s->gb.size_in_bits_plus8 += EXTRABYTES * 8;\n#endif\n        s->last_buf_size <<= 3;\n        for (gr = 0; gr < nb_granules && (s->last_buf_size >> 3) < main_data_begin; gr++) {\n            for (ch = 0; ch < s->nb_channels; ch++) {\n                g = &s->granules[ch][gr];\n                s->last_buf_size += g->part2_3_length;\n                memset(g->sb_hybrid, 0, sizeof(g->sb_hybrid));\n            }\n        }\n        skip = s->last_buf_size - 8 * main_data_begin;\n        if (skip >= s->gb.size_in_bits && s->in_gb.buffer) {\n            skip_bits_long(&s->in_gb, skip - s->gb.size_in_bits);\n            s->gb           = s->in_gb;\n            s->in_gb.buffer = NULL;\n        } else {\n            skip_bits_long(&s->gb, skip);\n        }\n    } else {\n        gr = 0;\n    }\n    for (; gr < nb_granules; gr++) {\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            g = &s->granules[ch][gr];\n            bits_pos = get_bits_count(&s->gb);\n            if (!s->lsf) {\n                uint8_t *sc;\n                int slen, slen1, slen2;\n                slen1 = slen_table[0][g->scalefac_compress];\n                slen2 = slen_table[1][g->scalefac_compress];\n                av_dlog(s->avctx, "slen1=%d slen2=%d\\n", slen1, slen2);\n                if (g->block_type == 2) {\n                    n = g->switch_point ? 17 : 18;\n                    j = 0;\n                    if (slen1) {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, slen1);\n                    } else {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                    if (slen2) {\n                        for (i = 0; i < 18; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, slen2);\n                        for (i = 0; i < 3; i++)\n                            g->scale_factors[j++] = 0;\n                    } else {\n                        for (i = 0; i < 21; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                } else {\n                    sc = s->granules[ch][0].scale_factors;\n                    j = 0;\n                    for (k = 0; k < 4; k++) {\n                        n = k == 0 ? 6 : 5;\n                        if ((g->scfsi & (0x8 >> k)) == 0) {\n                            slen = (k < 2) ? slen1 : slen2;\n                            if (slen) {\n                                for (i = 0; i < n; i++)\n                                    g->scale_factors[j++] = get_bits(&s->gb, slen);\n                            } else {\n                                for (i = 0; i < n; i++)\n                                    g->scale_factors[j++] = 0;\n                            }\n                        } else {\n                            for (i = 0; i < n; i++) {\n                                g->scale_factors[j] = sc[j];\n                                j++;\n                            }\n                        }\n                    }\n                    g->scale_factors[j++] = 0;\n                }\n            } else {\n                int tindex, tindex2, slen[4], sl, sf;\n                if (g->block_type == 2)\n                    tindex = g->switch_point ? 2 : 1;\n                else\n                    tindex = 0;\n                sf = g->scalefac_compress;\n                if ((s->mode_ext & MODE_EXT_I_STEREO) && ch == 1) {\n                    sf >>= 1;\n                    if (sf < 180) {\n                        lsf_sf_expand(slen, sf, 6, 6, 0);\n                        tindex2 = 3;\n                    } else if (sf < 244) {\n                        lsf_sf_expand(slen, sf - 180, 4, 4, 0);\n                        tindex2 = 4;\n                    } else {\n                        lsf_sf_expand(slen, sf - 244, 3, 0, 0);\n                        tindex2 = 5;\n                    }\n                } else {\n                    if (sf < 400) {\n                        lsf_sf_expand(slen, sf, 5, 4, 4);\n                        tindex2 = 0;\n                    } else if (sf < 500) {\n                        lsf_sf_expand(slen, sf - 400, 5, 4, 0);\n                        tindex2 = 1;\n                    } else {\n                        lsf_sf_expand(slen, sf - 500, 3, 0, 0);\n                        tindex2 = 2;\n                        g->preflag = 1;\n                    }\n                }\n                j = 0;\n                for (k = 0; k < 4; k++) {\n                    n  = lsf_nsf_table[tindex2][tindex][k];\n                    sl = slen[k];\n                    if (sl) {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = get_bits(&s->gb, sl);\n                    } else {\n                        for (i = 0; i < n; i++)\n                            g->scale_factors[j++] = 0;\n                    }\n                }\n                for (; j < 40; j++)\n                    g->scale_factors[j] = 0;\n            }\n            exponents_from_scale_factors(s, g, exponents);\n            huffman_decode(s, g, exponents, bits_pos + g->part2_3_length);\n        }\n        if (s->nb_channels == 2)\n            compute_stereo(s, &s->granules[0][gr], &s->granules[1][gr]);\n        for (ch = 0; ch < s->nb_channels; ch++) {\n            g = &s->granules[ch][gr];\n            reorder_block(s, g);\n            compute_antialias(s, g);\n            compute_imdct(s, g, &s->sb_samples[ch][18 * gr][0], s->mdct_buf[ch]);\n        }\n    }\n    if (get_bits_count(&s->gb) < 0)\n        skip_bits_long(&s->gb, -get_bits_count(&s->gb));\n    return nb_granules * 18;\n}', 'static void compute_imdct(MPADecodeContext *s, GranuleDef *g,\n                          INTFLOAT *sb_samples, INTFLOAT *mdct_buf)\n{\n    INTFLOAT *win, *out_ptr, *ptr, *buf, *ptr1;\n    INTFLOAT out2[12];\n    int i, j, mdct_long_end, sblimit;\n    ptr  = g->sb_hybrid + 576;\n    ptr1 = g->sb_hybrid + 2 * 18;\n    while (ptr >= ptr1) {\n        int32_t *p;\n        ptr -= 6;\n        p    = (int32_t*)ptr;\n        if (p[0] | p[1] | p[2] | p[3] | p[4] | p[5])\n            break;\n    }\n    sblimit = ((ptr - g->sb_hybrid) / 18) + 1;\n    if (g->block_type == 2) {\n        if (g->switch_point)\n            mdct_long_end = 2;\n        else\n            mdct_long_end = 0;\n    } else {\n        mdct_long_end = sblimit;\n    }\n    s->mpadsp.RENAME(imdct36_blocks)(sb_samples, mdct_buf, g->sb_hybrid,\n                                     mdct_long_end, g->switch_point,\n                                     g->block_type);\n    buf = mdct_buf + 4*18*(mdct_long_end >> 2) + (mdct_long_end & 3);\n    ptr = g->sb_hybrid + 18 * mdct_long_end;\n    for (j = mdct_long_end; j < sblimit; j++) {\n        win     = RENAME(ff_mdct_win)[2 + (4  & -(j & 1))];\n        out_ptr = sb_samples + j;\n        for (i = 0; i < 6; i++) {\n            *out_ptr = buf[4*i];\n            out_ptr += SBLIMIT;\n        }\n        imdct12(out2, ptr + 0);\n        for (i = 0; i < 6; i++) {\n            *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*1)];\n            buf[4*(i + 6*2)] = MULH3(out2[i + 6], win[i + 6], 1);\n            out_ptr += SBLIMIT;\n        }\n        imdct12(out2, ptr + 1);\n        for (i = 0; i < 6; i++) {\n            *out_ptr     = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*2)];\n            buf[4*(i + 6*0)] = MULH3(out2[i + 6], win[i + 6], 1);\n            out_ptr += SBLIMIT;\n        }\n        imdct12(out2, ptr + 2);\n        for (i = 0; i < 6; i++) {\n            buf[4*(i + 6*0)] = MULH3(out2[i    ], win[i    ], 1) + buf[4*(i + 6*0)];\n            buf[4*(i + 6*1)] = MULH3(out2[i + 6], win[i + 6], 1);\n            buf[4*(i + 6*2)] = 0;\n        }\n        ptr += 18;\n        buf += (j&3) != 3 ? 1 : (4*18-3);\n    }\n    for (j = sblimit; j < SBLIMIT; j++) {\n        out_ptr = sb_samples + j;\n        for (i = 0; i < 18; i++) {\n            *out_ptr = buf[4*i];\n            buf[4*i]   = 0;\n            out_ptr += SBLIMIT;\n        }\n        buf += (j&3) != 3 ? 1 : (4*18-3);\n    }\n}']