libavcodec/aacps.c:783: error: Buffer Overrun L1
  Offset: [19, `ps->num_env` + 18] (⇐ [0, `ps->num_env` - 1] + 19) Size: 5 by call to `remap20`.

libavcodec/aacps.c:731:1: Parameter `ps->num_env`
729. }
730. 
731. static void stereo_processing(PSContext *ps, float (*l)[32][2], float (*r)[32][2], int is34)
     ^
732. {
733.     int e, b, k;

libavcodec/aacps.c:783:9: Call
781.         }
782.     } else {
783.         remap20(&iid_mapped, ps->iid_par, ps->nr_iid_par, ps->num_env, 1);
             ^
784.         remap20(&icc_mapped, ps->icc_par, ps->nr_icc_par, ps->num_env, 1);
785.         if (ps->enable_ipdopd) {

libavcodec/aacps.c:712:1: Parameter `num_env`
  710. }
  711. 
  712. static void remap20(int8_t (**p_par_mapped)[PS_MAX_NR_IIDICC],
       ^
  713.                     int8_t           (*par)[PS_MAX_NR_IIDICC],
  714.                     int num_par, int num_env, int full)

libavcodec/aacps.c:720:13: Call
  718.     if (num_par == 34 || num_par == 17) {
  719.         for (e = 0; e < num_env; e++) {
  720.             map_idx_34_to_20(par_mapped[e], par[e], full);
                   ^
  721.         }
  722.     } else if (num_par == 10 || num_par == 5) {

libavcodec/aacps.c:439:1: <Length trace>
437. }
438. 
439. static void map_idx_34_to_20(int8_t *par_mapped, const int8_t *par, int full)
     ^
440. {
441.     par_mapped[ 0] = (2*par[ 0] +   par[ 1]) / 3;

libavcodec/aacps.c:439:1: Parameter `*par_mapped`
    437. }
    438. 
    439. static void map_idx_34_to_20(int8_t *par_mapped, const int8_t *par, int full)
         ^
    440. {
    441.     par_mapped[ 0] = (2*par[ 0] +   par[ 1]) / 3;

libavcodec/aacps.c:461:9: Array access: Offset: [19, ps->num_env + 18] (⇐ [0, ps->num_env - 1] + 19) Size: 5 by call to `remap20` 
    459.         par_mapped[17] = (  par[26] +   par[27]) / 2;
    460.         par_mapped[18] = (  par[28] +   par[29] +   par[30] +   par[31]) / 4;
    461.         par_mapped[19] = (  par[32] +   par[33]) / 2;
                 ^
    462.     }
    463. }
