libavcodec/aacdec.c:2766: error: Buffer Overrun L3
  Offset: [-1, 11] Size: 16.

libavcodec/aacdec.c:2743:5: <Offset trace>
2741.     int err, i;
2742.     int samples = m4ac->frame_length_short ? 960 : 1024;
2743.     int chan_config = m4ac->chan_config;
          ^
2744.     int aot = m4ac->object_type;
2745. 

libavcodec/aacdec.c:2743:5: Assignment
2741.     int err, i;
2742.     int samples = m4ac->frame_length_short ? 960 : 1024;
2743.     int chan_config = m4ac->chan_config;
          ^
2744.     int aot = m4ac->object_type;
2745. 

libavcodec/aacdectab.h:83:1: <Length trace>
81. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 4, 5, 0, 5, 0 };
82. 
83. static const uint8_t aac_channel_layout_map[16][5][3] = {
    ^
84.     { { TYPE_SCE, 0, AAC_CHANNEL_FRONT }, },
85.     { { TYPE_CPE, 0, AAC_CHANNEL_FRONT }, },

libavcodec/aacdectab.h:83:1: Array declaration
81. static const int8_t tags_per_config[16] = { 0, 1, 1, 2, 3, 3, 4, 5, 0, 0, 0, 4, 5, 0, 5, 0 };
82. 
83. static const uint8_t aac_channel_layout_map[16][5][3] = {
    ^
84.     { { TYPE_SCE, 0, AAC_CHANNEL_FRONT }, },
85.     { { TYPE_CPE, 0, AAC_CHANNEL_FRONT }, },

libavcodec/aacdec.c:2766:31: Array access: Offset: [-1, 11] Size: 16
2764.     }
2765.     for (i = 0; i < tags_per_config[chan_config]; i++) {
2766.         const int elem_type = aac_channel_layout_map[chan_config-1][i][0];
                                    ^
2767.         const int elem_id   = aac_channel_layout_map[chan_config-1][i][1];
2768.         if (!(che=get_che(ac, elem_type, elem_id))) {
