libavcodec/qdm2.c:1944: error: Buffer Overrun L1
  Offset: [16, +oo] Size: 4 by call to `qdm2_decode`.

libavcodec/qdm2.c:1937:16: Call
1935.     /* get output buffer */
1936.     frame->nb_samples = 16 * s->frame_size;
1937.     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
                     ^
1938.         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
1939.         return ret;

libavcodec/utils.c:549:1: Parameter `*frame->buf[*]`
  547. #endif
  548. 
  549. int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)
       ^
  550. {
  551.     int ret;

libavcodec/qdm2.c:1944:13: Call
1942. 
1943.     for (i = 0; i < 16; i++) {
1944.         if (qdm2_decode(s, buf, out) < 0)
                  ^
1945.             return -1;
1946.         out += s->channels * s->frame_size;

libavcodec/qdm2.c:1860:1: Parameter `q->fft_tones[*].duration`
  1858. 
  1859. 
  1860. static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)
        ^
  1861. {
  1862.     int ch, i;

libavcodec/qdm2.c:1885:9: Call
  1883.             qdm2_decode_fft_packets(q);
  1884. 
  1885.         qdm2_fft_tone_synthesizer(q, q->sub_packet);
                ^
  1886.     }
  1887. 

libavcodec/qdm2.c:1520:1: Parameter `q->fft_tones[*].duration`
    1518. 
    1519. 
    1520. static void qdm2_fft_tone_synthesizer (QDM2Context *q, int sub_packet)
          ^
    1521. {
    1522.     int i, j, ch;

libavcodec/qdm2.c:1552:9: Call
    1550.     /* generate existing FFT tones */
    1551.     for (i = q->fft_tone_end; i != q->fft_tone_start; ) {
    1552.         qdm2_fft_generate_tone(q, &q->fft_tones[q->fft_tone_start]);
                  ^
    1553.         q->fft_tone_start = (q->fft_tone_start + 1) % 1000;
    1554.     }

libavcodec/qdm2.c:1475:1: <Offset trace>
1473. 
1474. 
1475. static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone)
      ^
1476. {
1477.    float level, f[6];

libavcodec/qdm2.c:1475:1: Parameter `tone->duration`
      1473. 
      1474. 
      1475. static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone)
            ^
      1476. {
      1477.    float level, f[6];

libavcodec/qdm2data.h:476:1: <Length trace>
474. } };
475. 
476. static const float fft_tone_envelope_table[4][31] = {
     ^
477.     { .009607375f, .038060248f, .084265202f, .146446645f, .222214907f, .308658302f,
478.       .402454883f, .500000060f, .597545207f, .691341758f, .777785182f, .853553414f,

libavcodec/qdm2data.h:476:1: Array declaration
      474. } };
      475. 
      476. static const float fft_tone_envelope_table[4][31] = {
           ^
      477.     { .009607375f, .038060248f, .084265202f, .146446645f, .222214907f, .308658302f,
      478.       .402454883f, .500000060f, .597545207f, .691341758f, .777785182f, .853553414f,

libavcodec/qdm2.c:1485:13: Array access: Offset: [16, +oo] Size: 4 by call to `qdm2_decode` 
      1483. 
      1484.     /* calculate current level (maximum amplitude) of tone */
      1485.     level = fft_tone_envelope_table[tone->duration][tone->time_index] * tone->level;
                        ^
      1486.     c.im = level * sin(tone->phase*iscale);
      1487.     c.re = level * cos(tone->phase*iscale);

static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone)
{
   float level, f[6];
   int i;
   QDM2Complex c;
   const double iscale = 2.0*M_PI / 512.0;
    tone->phase += tone->phase_shift;
    level = fft_tone_envelope_table[tone->duration][tone->time_index] * tone->level;
    c.im = level * sin(tone->phase*iscale);
    c.re = level * cos(tone->phase*iscale);
    if (tone->duration >= 3 || tone->cutoff >= 3) {
        tone->complex[0].im += c.im;
        tone->complex[0].re += c.re;
        tone->complex[1].im -= c.im;
        tone->complex[1].re -= c.re;
    } else {
        f[1] = -tone->table[4];
        f[0] =  tone->table[3] - tone->table[0];
        f[2] =  1.0 - tone->table[2] - tone->table[3];
        f[3] =  tone->table[1] + tone->table[4] - 1.0;
        f[4] =  tone->table[0] - tone->table[1];
        f[5] =  tone->table[2];
        for (i = 0; i < 2; i++) {
            tone->complex[fft_cutoff_index_table[tone->cutoff][i]].re += c.re * f[i];
            tone->complex[fft_cutoff_index_table[tone->cutoff][i]].im += c.im *((tone->cutoff <= i) ? -f[i] : f[i]);
        }
        for (i = 0; i < 4; i++) {
            tone->complex[i].re += c.re * f[i+2];
            tone->complex[i].im += c.im * f[i+2];
        }
    }
    if (++tone->time_index < ((1 << (5 - tone->duration)) - 1)) {
      memcpy(&q->fft_tones[q->fft_tone_end], tone, sizeof(FFTTone));
      q->fft_tone_end = (q->fft_tone_end + 1) % 1000;
    }
}
['static int qdm2_decode_frame(AVCodecContext *avctx, void *data,\n                             int *got_frame_ptr, AVPacket *avpkt)\n{\n    AVFrame *frame     = data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    QDM2Context *s = avctx->priv_data;\n    int16_t *out;\n    int i, ret;\n    if(!buf)\n        return 0;\n    if(buf_size < s->checksum_size)\n        return -1;\n    frame->nb_samples = 16 * s->frame_size;\n    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    out = (int16_t *)frame->data[0];\n    for (i = 0; i < 16; i++) {\n        if (qdm2_decode(s, buf, out) < 0)\n            return -1;\n        out += s->channels * s->frame_size;\n    }\n    *got_frame_ptr = 1;\n    return s->checksum_size;\n}', 'int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)\n{\n    int ret;\n    switch (avctx->codec_type) {\n    case AVMEDIA_TYPE_VIDEO:\n        if (!frame->width)\n            frame->width               = avctx->width;\n        if (!frame->height)\n            frame->height              = avctx->height;\n        if (frame->format < 0)\n            frame->format              = avctx->pix_fmt;\n        if (!frame->sample_aspect_ratio.num)\n            frame->sample_aspect_ratio = avctx->sample_aspect_ratio;\n        if ((ret = av_image_check_size(avctx->width, avctx->height, 0, avctx)) < 0)\n            return ret;\n        break;\n    case AVMEDIA_TYPE_AUDIO:\n        if (!frame->sample_rate)\n            frame->sample_rate    = avctx->sample_rate;\n        if (frame->format < 0)\n            frame->format         = avctx->sample_fmt;\n        if (!frame->channel_layout) {\n            if (avctx->channel_layout) {\n                 if (av_get_channel_layout_nb_channels(avctx->channel_layout) !=\n                     avctx->channels) {\n                     av_log(avctx, AV_LOG_ERROR, "Inconsistent channel "\n                            "configuration.\\n");\n                     return AVERROR(EINVAL);\n                 }\n                frame->channel_layout = avctx->channel_layout;\n            } else {\n                if (avctx->channels > FF_SANE_NB_CHANNELS) {\n                    av_log(avctx, AV_LOG_ERROR, "Too many channels: %d.\\n",\n                           avctx->channels);\n                    return AVERROR(ENOSYS);\n                }\n                frame->channel_layout = av_get_default_channel_layout(avctx->channels);\n                if (!frame->channel_layout)\n                    frame->channel_layout = (1ULL << avctx->channels) - 1;\n            }\n        }\n        break;\n    default: return AVERROR(EINVAL);\n    }\n    frame->pkt_pts = avctx->pkt ? avctx->pkt->pts : AV_NOPTS_VALUE;\n    frame->reordered_opaque = avctx->reordered_opaque;\n#if FF_API_GET_BUFFER\n    if (avctx->get_buffer) {\n        CompatReleaseBufPriv *priv = NULL;\n        AVBufferRef *dummy_buf = NULL;\n        int planes, i, ret;\n        if (flags & AV_GET_BUFFER_FLAG_REF)\n            frame->reference    = 1;\n        ret = avctx->get_buffer(avctx, frame);\n        if (ret < 0)\n            return ret;\n        if (frame->buf[0])\n            return 0;\n        priv = av_mallocz(sizeof(*priv));\n        if (!priv) {\n            ret = AVERROR(ENOMEM);\n            goto fail;\n        }\n        priv->avctx = *avctx;\n        priv->frame = *frame;\n        dummy_buf = av_buffer_create(NULL, 0, compat_free_buffer, priv, 0);\n        if (!dummy_buf) {\n            ret = AVERROR(ENOMEM);\n            goto fail;\n        }\n#define WRAP_PLANE(ref_out, data, data_size)                            \\\ndo {                                                                    \\\n    AVBufferRef *dummy_ref = av_buffer_ref(dummy_buf);                  \\\n    if (!dummy_ref) {                                                   \\\n        ret = AVERROR(ENOMEM);                                          \\\n        goto fail;                                                      \\\n    }                                                                   \\\n    ref_out = av_buffer_create(data, data_size, compat_release_buffer,  \\\n                               dummy_ref, 0);                           \\\n    if (!ref_out) {                                                     \\\n        av_frame_unref(frame);                                          \\\n        ret = AVERROR(ENOMEM);                                          \\\n        goto fail;                                                      \\\n    }                                                                   \\\n} while (0)\n        if (avctx->codec_type == AVMEDIA_TYPE_VIDEO) {\n            const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(frame->format);\n            if (!desc) {\n                ret = AVERROR(EINVAL);\n                goto fail;\n            }\n            planes = (desc->flags & PIX_FMT_PLANAR) ? desc->nb_components : 1;\n            for (i = 0; i < planes; i++) {\n                int h_shift    = (i == 1 || i == 2) ? desc->log2_chroma_h : 0;\n                int plane_size = (frame->width >> h_shift) * frame->linesize[i];\n                WRAP_PLANE(frame->buf[i], frame->data[i], plane_size);\n            }\n        } else {\n            int planar = av_sample_fmt_is_planar(frame->format);\n            planes = planar ? avctx->channels : 1;\n            if (planes > FF_ARRAY_ELEMS(frame->buf)) {\n                frame->nb_extended_buf = planes - FF_ARRAY_ELEMS(frame->buf);\n                frame->extended_buf = av_malloc(sizeof(*frame->extended_buf) *\n                                                frame->nb_extended_buf);\n                if (!frame->extended_buf) {\n                    ret = AVERROR(ENOMEM);\n                    goto fail;\n                }\n            }\n            for (i = 0; i < FFMIN(planes, FF_ARRAY_ELEMS(frame->buf)); i++)\n                WRAP_PLANE(frame->buf[i], frame->extended_data[i], frame->linesize[0]);\n            for (i = 0; i < planes - FF_ARRAY_ELEMS(frame->buf); i++)\n                WRAP_PLANE(frame->extended_buf[i],\n                           frame->extended_data[i + FF_ARRAY_ELEMS(frame->buf)],\n                           frame->linesize[0]);\n        }\n        av_buffer_unref(&dummy_buf);\n        return 0;\nfail:\n        avctx->release_buffer(avctx, frame);\n        av_freep(&priv);\n        av_buffer_unref(&dummy_buf);\n        return ret;\n    }\n#endif\n    return avctx->get_buffer2(avctx, frame, flags);\n}', 'static int qdm2_decode (QDM2Context *q, const uint8_t *in, int16_t *out)\n{\n    int ch, i;\n    const int frame_size = (q->frame_size * q->channels);\n    q->compressed_data = in;\n    q->compressed_size = q->checksum_size;\n    memmove(q->output_buffer, &q->output_buffer[frame_size], frame_size * sizeof(float));\n    memset(&q->output_buffer[frame_size], 0, frame_size * sizeof(float));\n    if (q->sub_packet == 0) {\n        q->has_errors = 0;\n        av_log(NULL,AV_LOG_DEBUG,"Superblock follows\\n");\n        qdm2_decode_super_block(q);\n    }\n    if (!q->has_errors) {\n        if (q->sub_packet == 2)\n            qdm2_decode_fft_packets(q);\n        qdm2_fft_tone_synthesizer(q, q->sub_packet);\n    }\n    for (ch = 0; ch < q->channels; ch++) {\n        qdm2_calculate_fft(q, ch, q->sub_packet);\n        if (!q->has_errors && q->sub_packet_list_C[0].packet != NULL) {\n            SAMPLES_NEEDED_2("has errors, and C list is not empty")\n            return -1;\n        }\n    }\n    if (!q->has_errors && q->do_synth_filter)\n        qdm2_synthesis_filter(q, q->sub_packet);\n    q->sub_packet = (q->sub_packet + 1) % 16;\n    for (i = 0; i < frame_size; i++) {\n        int value = (int)q->output_buffer[i];\n        if (value > SOFTCLIP_THRESHOLD)\n            value = (value >  HARDCLIP_THRESHOLD) ?  32767 :  softclip_table[ value - SOFTCLIP_THRESHOLD];\n        else if (value < -SOFTCLIP_THRESHOLD)\n            value = (value < -HARDCLIP_THRESHOLD) ? -32767 : -softclip_table[-value - SOFTCLIP_THRESHOLD];\n        out[i] = value;\n    }\n    return 0;\n}', 'static void qdm2_fft_tone_synthesizer (QDM2Context *q, int sub_packet)\n{\n    int i, j, ch;\n    const double iscale = 0.25 * M_PI;\n    for (ch = 0; ch < q->channels; ch++) {\n        memset(q->fft.complex[ch], 0, q->fft_size * sizeof(QDM2Complex));\n    }\n    if (q->fft_coefs_min_index[4] >= 0)\n        for (i = q->fft_coefs_min_index[4]; i < q->fft_coefs_max_index[4]; i++) {\n            float level;\n            QDM2Complex c;\n            if (q->fft_coefs[i].sub_packet != sub_packet)\n                break;\n            ch = (q->channels == 1) ? 0 : q->fft_coefs[i].channel;\n            level = (q->fft_coefs[i].exp < 0) ? 0.0 : fft_tone_level_table[q->superblocktype_2_3 ? 0 : 1][q->fft_coefs[i].exp & 63];\n            c.re = level * cos(q->fft_coefs[i].phase * iscale);\n            c.im = level * sin(q->fft_coefs[i].phase * iscale);\n            q->fft.complex[ch][q->fft_coefs[i].offset + 0].re += c.re;\n            q->fft.complex[ch][q->fft_coefs[i].offset + 0].im += c.im;\n            q->fft.complex[ch][q->fft_coefs[i].offset + 1].re -= c.re;\n            q->fft.complex[ch][q->fft_coefs[i].offset + 1].im -= c.im;\n        }\n    for (i = q->fft_tone_end; i != q->fft_tone_start; ) {\n        qdm2_fft_generate_tone(q, &q->fft_tones[q->fft_tone_start]);\n        q->fft_tone_start = (q->fft_tone_start + 1) % 1000;\n    }\n    for (i = 0; i < 4; i++)\n        if (q->fft_coefs_min_index[i] >= 0) {\n            for (j = q->fft_coefs_min_index[i]; j < q->fft_coefs_max_index[i]; j++) {\n                int offset, four_i;\n                FFTTone tone;\n                if (q->fft_coefs[j].sub_packet != sub_packet)\n                    break;\n                four_i = (4 - i);\n                offset = q->fft_coefs[j].offset >> four_i;\n                ch = (q->channels == 1) ? 0 : q->fft_coefs[j].channel;\n                if (offset < q->frequency_range) {\n                    if (offset < 2)\n                        tone.cutoff = offset;\n                    else\n                        tone.cutoff = (offset >= 60) ? 3 : 2;\n                    tone.level = (q->fft_coefs[j].exp < 0) ? 0.0 : fft_tone_level_table[q->superblocktype_2_3 ? 0 : 1][q->fft_coefs[j].exp & 63];\n                    tone.complex = &q->fft.complex[ch][offset];\n                    tone.table = fft_tone_sample_table[i][q->fft_coefs[j].offset - (offset << four_i)];\n                    tone.phase = 64 * q->fft_coefs[j].phase - (offset << 8) - 128;\n                    tone.phase_shift = (2 * q->fft_coefs[j].offset + 1) << (7 - four_i);\n                    tone.duration = i;\n                    tone.time_index = 0;\n                    qdm2_fft_generate_tone(q, &tone);\n                }\n            }\n            q->fft_coefs_min_index[i] = j;\n        }\n}', 'static void qdm2_fft_generate_tone (QDM2Context *q, FFTTone *tone)\n{\n   float level, f[6];\n   int i;\n   QDM2Complex c;\n   const double iscale = 2.0*M_PI / 512.0;\n    tone->phase += tone->phase_shift;\n    level = fft_tone_envelope_table[tone->duration][tone->time_index] * tone->level;\n    c.im = level * sin(tone->phase*iscale);\n    c.re = level * cos(tone->phase*iscale);\n    if (tone->duration >= 3 || tone->cutoff >= 3) {\n        tone->complex[0].im += c.im;\n        tone->complex[0].re += c.re;\n        tone->complex[1].im -= c.im;\n        tone->complex[1].re -= c.re;\n    } else {\n        f[1] = -tone->table[4];\n        f[0] =  tone->table[3] - tone->table[0];\n        f[2] =  1.0 - tone->table[2] - tone->table[3];\n        f[3] =  tone->table[1] + tone->table[4] - 1.0;\n        f[4] =  tone->table[0] - tone->table[1];\n        f[5] =  tone->table[2];\n        for (i = 0; i < 2; i++) {\n            tone->complex[fft_cutoff_index_table[tone->cutoff][i]].re += c.re * f[i];\n            tone->complex[fft_cutoff_index_table[tone->cutoff][i]].im += c.im *((tone->cutoff <= i) ? -f[i] : f[i]);\n        }\n        for (i = 0; i < 4; i++) {\n            tone->complex[i].re += c.re * f[i+2];\n            tone->complex[i].im += c.im * f[i+2];\n        }\n    }\n    if (++tone->time_index < ((1 << (5 - tone->duration)) - 1)) {\n      memcpy(&q->fft_tones[q->fft_tone_end], tone, sizeof(FFTTone));\n      q->fft_tone_end = (q->fft_tone_end + 1) % 1000;\n    }\n}']