libavcodec/aacdec.c:2001: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload`.

libavcodec/aacdec.c:1950:23: Call
1948. 
1949.         if (elem_type < TYPE_DSE) {
1950.             if (!(che=get_che(ac, elem_type, elem_id))) {
                            ^
1951.                 av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\n",
1952.                        elem_type, elem_id);

libavcodec/aacdec.c:114:1: Parameter `*ac->tag_che_map[*][*]`
  112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
  113. 
  114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
       ^
  115. {
  116.     // For PCE based channel configurations map the channels solely based on tags.

libavcodec/aacdec.c:2001:28: Call
1999.             }
2000.             while (elem_id > 0)
2001.                 elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);
                                 ^
2002.             err = 0; /* FIXME */
2003.             break;

libavcodec/aacdec.c:1606:1: Parameter `che->sbr.n[*]`
  1604.  * @return Returns number of bytes consumed
  1605.  */
  1606. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1607.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1608. {

libavcodec/aacdec.c:1633:15: Call
  1631.             ac->m4ac.sbr = 1;
  1632.         }
  1633.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1634.         break;
  1635.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1044:1: Parameter `sbr->n[*]`
    1042.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1043.  */
    1044. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1045.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1046. {

libavcodec/aacsbr.c:1070:25: Call
    1068.     num_sbr_bits++;
    1069.     if (get_bits1(gb)) // bs_header_flag
    1070.         num_sbr_bits += read_sbr_header(sbr, gb);
                                  ^
    1071. 
    1072.     if (sbr->reset)

libavcodec/aacsbr.c:207:1: Parameter `sbr->n[*]`
      205. }
      206. 
      207. static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext *gb)
           ^
      208. {
      209.     unsigned int cnt = get_bits_count(gb);

libavcodec/aacsbr.c:256:9: Call
      254. 
      255.     if (sbr->bs_limiter_bands != old_bs_limiter_bands && !sbr->reset)
      256.         sbr_make_f_tablelim(sbr);
                   ^
      257. 
      258.     return get_bits_count(gb) - cnt;

libavcodec/aacsbr.c:160:1: <LHS trace>
158. 
159. /// Limiter Frequency Band Table (14496-3 sp04 p198)
160. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
     ^
161. {
162.     int k;

libavcodec/aacsbr.c:160:1: Parameter `sbr->n[*]`
        158. 
        159. /// Limiter Frequency Band Table (14496-3 sp04 p198)
        160. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
             ^
        161. {
        162.     int k;

libavcodec/aacsbr.c:185:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload` 
        183.               qsort_comparison_function_int16);
        184. 
        185.         sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;
                     ^
        186.         while (out < sbr->f_tablelim + sbr->n_lim) {
        187.             if (*in >= *out * lim_bands_per_octave_warped) {
