libavcodec/amrnbdec.c:346: error: Buffer Overrun L2
  Offset: [3, 12] (⇐ 3 + [0, 9]) Size: 4 by call to `ff_acelp_lsf2lspd`.

libavcodec/amrnbdec.c:319:1: Parameter `p->lsp[*]`
317.  * @param p                 pointer to the AMRContext
318.  */
319. static void lsf2lsp_3(AMRContext *p)
     ^
320. {
321.     const uint16_t *lsf_param = p->frame.lsf;

libavcodec/amrnbdec.c:346:5: Call
344.     memcpy(p->prev_lsf_r, lsf_r, LP_FILTER_ORDER * sizeof(*lsf_r));
345. 
346.     ff_acelp_lsf2lspd(p->lsp[3], lsf_q, LP_FILTER_ORDER);
         ^
347. 
348.     // interpolate LSP vectors at subframes 1, 2 and 3

libavcodec/lsp.c:68:1: <Offset trace>
66. }
67. 
68. void ff_acelp_lsf2lspd(double *lsp, const float *lsf, int lp_order)
    ^
69. {
70.     int i;

libavcodec/lsp.c:68:1: Parameter `lp_order`
  66. }
  67. 
  68. void ff_acelp_lsf2lspd(double *lsp, const float *lsf, int lp_order)
      ^
  69. {
  70.     int i;

libavcodec/lsp.c:68:1: <Length trace>
66. }
67. 
68. void ff_acelp_lsf2lspd(double *lsp, const float *lsf, int lp_order)
    ^
69. {
70.     int i;

libavcodec/lsp.c:68:1: Parameter `*lsp`
  66. }
  67. 
  68. void ff_acelp_lsf2lspd(double *lsp, const float *lsf, int lp_order)
      ^
  69. {
  70.     int i;

libavcodec/lsp.c:73:9: Array access: Offset: [3, 12] (⇐ 3 + [0, 9]) Size: 4 by call to `ff_acelp_lsf2lspd` 
  71. 
  72.     for(i = 0; i < lp_order; i++)
  73.         lsp[i] = cos(2.0 * M_PI * lsf[i]);
              ^
  74. }
  75. 
