libavcodec/twinvq.c:1067: error: Buffer Overrun L2
  Offset: [0, 3] Size: 3 by call to `construct_perm_table`.

libavcodec/twinvq.c:1066:10: Assignment
1064.     }
1065. 
1066.     for (i=0; i < 4; i++)
               ^
1067.         construct_perm_table(tctx, i);
1068. }

libavcodec/twinvq.c:1067:9: Call
1065. 
1066.     for (i=0; i < 4; i++)
1067.         construct_perm_table(tctx, i);
              ^
1068. }
1069. 

libavcodec/twinvq.c:978:1: <Offset trace>
976. }
977. 
978. static av_cold void construct_perm_table(TwinContext *tctx,enum FrameType ftype)
     ^
979. {
980.     int block_size;

libavcodec/twinvq.c:978:1: Parameter `ftype`
  976. }
  977. 
  978. static av_cold void construct_perm_table(TwinContext *tctx,enum FrameType ftype)
       ^
  979. {
  980.     int block_size;

libavcodec/twinvq.c:978:1: <Length trace>
976. }
977. 
978. static av_cold void construct_perm_table(TwinContext *tctx,enum FrameType ftype)
     ^
979. {
980.     int block_size;

libavcodec/twinvq.c:978:1: Parameter `tctx->mtab->fmode[*]`
  976. }
  977. 
  978. static av_cold void construct_perm_table(TwinContext *tctx,enum FrameType ftype)
       ^
  979. {
  980.     int block_size;

libavcodec/twinvq.c:982:38: Array access: Offset: [0, 3] Size: 3 by call to `construct_perm_table` 
  980.     int block_size;
  981.     const ModeTab *mtab = tctx->mtab;
  982.     int size = tctx->avctx->channels*mtab->fmode[ftype].sub;
                                            ^
  983.     int16_t *tmp_perm = (int16_t *) tctx->tmp_buf;
  984. 

static av_cold void construct_perm_table(TwinContext *tctx,enum FrameType ftype)
{
    int block_size;
    const ModeTab *mtab = tctx->mtab;
    int size = tctx->avctx->channels*mtab->fmode[ftype].sub;
    int16_t *tmp_perm = (int16_t *) tctx->tmp_buf;
    if (ftype == FT_PPC) {
        size  = tctx->avctx->channels;
        block_size = mtab->ppc_shape_len;
    } else
        block_size = mtab->size / mtab->fmode[ftype].sub;
    permutate_in_line(tmp_perm, tctx->n_div[ftype], size,
                      block_size, tctx->length[ftype],
                      tctx->length_change[ftype], ftype);
    transpose_perm(tctx->permut[ftype], tmp_perm, tctx->n_div[ftype],
                   tctx->length[ftype], tctx->length_change[ftype]);
    linear_perm(tctx->permut[ftype], tctx->permut[ftype], size,
                size*block_size);
}
['static av_cold void init_bitstream_params(TwinContext *tctx)\n{\n    const ModeTab *mtab = tctx->mtab;\n    int n_ch = tctx->avctx->channels;\n    int total_fr_bits = tctx->avctx->bit_rate*mtab->size/\n                             tctx->avctx->sample_rate;\n    int lsp_bits_per_block = n_ch*(mtab->lsp_bit0 + mtab->lsp_bit1 +\n                                   mtab->lsp_split*mtab->lsp_bit2);\n    int ppc_bits = n_ch*(mtab->pgain_bit + mtab->ppc_shape_bit +\n                         mtab->ppc_period_bit);\n    int bsize_no_main_cb[3];\n    int bse_bits[3];\n    int i;\n    for (i=0; i < 3; i++)\n        bse_bits[i] = n_ch *\n            (mtab->fmode[i].bark_n_coef * mtab->fmode[i].bark_n_bit + 1);\n    bsize_no_main_cb[2] = bse_bits[2] + lsp_bits_per_block + ppc_bits +\n                          WINDOW_TYPE_BITS + n_ch*GAIN_BITS;\n    for (i=0; i < 2; i++)\n        bsize_no_main_cb[i] =\n            lsp_bits_per_block + n_ch*GAIN_BITS + WINDOW_TYPE_BITS +\n            mtab->fmode[i].sub*(bse_bits[i] + n_ch*SUB_GAIN_BITS);\n    for (i=0; i < 4; i++) {\n        int bit_size;\n        int vect_size;\n        int rounded_up, rounded_down, num_rounded_down, num_rounded_up;\n        if (i == 3) {\n            bit_size  = n_ch * mtab->ppc_shape_bit;\n            vect_size = n_ch * mtab->ppc_shape_len;\n        } else {\n            bit_size = total_fr_bits - bsize_no_main_cb[i];\n            vect_size = n_ch * mtab->size;\n        }\n        tctx->n_div[i] = (bit_size + 13) / 14;\n        rounded_up   = (bit_size + tctx->n_div[i] - 1)/tctx->n_div[i];\n        rounded_down = (bit_size           )/tctx->n_div[i];\n        num_rounded_down = rounded_up * tctx->n_div[i] - bit_size;\n        num_rounded_up = tctx->n_div[i] - num_rounded_down;\n        tctx->bits_main_spec[0][i][0] = (rounded_up   + 1)/2;\n        tctx->bits_main_spec[1][i][0] = (rounded_up      )/2;\n        tctx->bits_main_spec[0][i][1] = (rounded_down + 1)/2;\n        tctx->bits_main_spec[1][i][1] = (rounded_down    )/2;\n        tctx->bits_main_spec_change[i] = num_rounded_up;\n        rounded_up   = (vect_size + tctx->n_div[i] - 1)/tctx->n_div[i];\n        rounded_down = (vect_size                     )/tctx->n_div[i];\n        num_rounded_down = rounded_up * tctx->n_div[i] - vect_size;\n        num_rounded_up = tctx->n_div[i] - num_rounded_down;\n        tctx->length[i][0] = rounded_up;\n        tctx->length[i][1] = rounded_down;\n        tctx->length_change[i] = num_rounded_up;\n    }\n    for (i=0; i < 4; i++)\n        construct_perm_table(tctx, i);\n}', 'static av_cold void construct_perm_table(TwinContext *tctx,enum FrameType ftype)\n{\n    int block_size;\n    const ModeTab *mtab = tctx->mtab;\n    int size = tctx->avctx->channels*mtab->fmode[ftype].sub;\n    int16_t *tmp_perm = (int16_t *) tctx->tmp_buf;\n    if (ftype == FT_PPC) {\n        size  = tctx->avctx->channels;\n        block_size = mtab->ppc_shape_len;\n    } else\n        block_size = mtab->size / mtab->fmode[ftype].sub;\n    permutate_in_line(tmp_perm, tctx->n_div[ftype], size,\n                      block_size, tctx->length[ftype],\n                      tctx->length_change[ftype], ftype);\n    transpose_perm(tctx->permut[ftype], tmp_perm, tctx->n_div[ftype],\n                   tctx->length[ftype], tctx->length_change[ftype]);\n    linear_perm(tctx->permut[ftype], tctx->permut[ftype], size,\n                size*block_size);\n}']