libavcodec/sipr16k.c:188: error: Buffer Overrun L1
  Offset: [9, +oo] (⇐ 16 + [-7, +oo]) Size: 2 by call to `acelp_lp_decodef`.

libavcodec/sipr16k.c:165:1: Array declaration
163. #define DIVIDE_BY_3(x) ((x) * 10923 >> 15)
164. 
165. void ff_sipr_decode_frame_16k(SiprContext *ctx, SiprParameters *params,
     ^
166.                               float *out_data)
167. {

libavcodec/sipr16k.c:188:5: Call
186.     lsf2lsp(lsf_new, lsp_new);
187. 
188.     acelp_lp_decodef(Az[0], Az[1], lsp_new, ctx->lsp_history_16k);
         ^
189. 
190.     memcpy(ctx->lsp_history_16k, lsp_new, LP_FILTER_ORDER_16k * sizeof(double));

libavcodec/sipr16k.c:131:1: Parameter `*lp_2nd`
  129.  * Floating point version of ff_acelp_lp_decode().
  130.  */
  131. static void acelp_lp_decodef(float *lp_1st, float *lp_2nd,
       ^
  132.                              const double *lsp_2nd, const double *lsp_prev)
  133. {

libavcodec/sipr16k.c:144:5: Call
  142. 
  143.     /* LSP values for second subframe (3.2.5 of G.729) */
  144.     ff_acelp_lspd2lpc(lsp_2nd, lp_2nd, LP_FILTER_ORDER_16k >> 1);
           ^
  145. }
  146. 

libavcodec/lsp.c:148:1: <Offset trace>
146. }
147. 
148. void ff_acelp_lspd2lpc(const double *lsp, float *lpc, int lp_half_order)
     ^
149. {
150.     double pa[MAX_LP_HALF_ORDER+1], qa[MAX_LP_HALF_ORDER+1];

libavcodec/lsp.c:148:1: Parameter `lp_half_order`
    146. }
    147. 
    148. void ff_acelp_lspd2lpc(const double *lsp, float *lpc, int lp_half_order)
         ^
    149. {
    150.     double pa[MAX_LP_HALF_ORDER+1], qa[MAX_LP_HALF_ORDER+1];

libavcodec/lsp.c:158:12: Assignment
    156.     ff_lsp2polyf(lsp + 1, qa, lp_half_order);
    157. 
    158.     while (lp_half_order--) {
                    ^
    159.         double paf = pa[lp_half_order+1] + pa[lp_half_order];
    160.         double qaf = qa[lp_half_order+1] - qa[lp_half_order];

libavcodec/lsp.c:148:1: <Length trace>
146. }
147. 
148. void ff_acelp_lspd2lpc(const double *lsp, float *lpc, int lp_half_order)
     ^
149. {
150.     double pa[MAX_LP_HALF_ORDER+1], qa[MAX_LP_HALF_ORDER+1];

libavcodec/lsp.c:148:1: Parameter `lp_half_order`
    146. }
    147. 
    148. void ff_acelp_lspd2lpc(const double *lsp, float *lpc, int lp_half_order)
         ^
    149. {
    150.     double pa[MAX_LP_HALF_ORDER+1], qa[MAX_LP_HALF_ORDER+1];

libavcodec/lsp.c:151:5: Assignment
    149. {
    150.     double pa[MAX_LP_HALF_ORDER+1], qa[MAX_LP_HALF_ORDER+1];
    151.     float *lpc2 = lpc + (lp_half_order << 1) - 1;
             ^
    152. 
    153.     assert(lp_half_order <= MAX_LP_HALF_ORDER);

libavcodec/lsp.c:163:9: Array access: Offset: [9, +oo] (⇐ 16 + [-7, +oo]) Size: 2 by call to `acelp_lp_decodef` 
    161. 
    162.         lpc [ lp_half_order] = 0.5*(paf+qaf);
    163.         lpc2[-lp_half_order] = 0.5*(paf-qaf);
                 ^
    164.     }
    165. }
