libavcodec/aac.c:133: error: Buffer Overrun L2
  Offset: [`elem_id`, max(16, `elem_id`)] Size: 16.

libavcodec/aac.c:114:1: <Offset trace>
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aac.c:114:1: Parameter `elem_id`
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aac.c:114:1: <Length trace>
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aac.c:114:1: Parameter `ac->tag_che_map[*][*]`
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aac.c:133:16: Array access: Offset: [elem_id, max(16, elem_id)] Size: 16
131. 
132.     if (ac->tag_che_map[type][elem_id]) {
133.         return ac->tag_che_map[type][elem_id];
                    ^
134.     }
135.     if (ac->tags_mapped >= tags_per_config[ac->m4ac.chan_config]) {
