libavcodec/lsp.c:125: error: Buffer Overrun L3
  Offset: 1 Size: [0, +oo] by call to `ff_acelp_lsp2lpc`.

libavcodec/lsp.c:112:1: Parameter `lp_order`
110. }
111. 
112. void ff_acelp_lp_decode(int16_t* lp_1st, int16_t* lp_2nd, const int16_t* lsp_2nd, const int16_t* lsp_prev, int lp_order)
     ^
113. {
114.     int16_t lsp_1st[lp_order]; // (0.15)

libavcodec/lsp.c:125:5: Call
123. #endif
124. 
125.     ff_acelp_lsp2lpc(lp_1st, lsp_1st, lp_order >> 1);
         ^
126. 
127.     /* LSP values for second subframe (3.2.5 of G.729)*/

libavcodec/lsp.c:90:1: Parameter `lp_half_order`
  88. }
  89. 
  90. void ff_acelp_lsp2lpc(int16_t* lp, const int16_t* lsp, int lp_half_order)
      ^
  91. {
  92.     int i;

libavcodec/lsp.c:93:12: Array declaration
  91. {
  92.     int i;
  93.     int f1[lp_half_order+1]; // (3.22)
                 ^
  94.     int f2[lp_half_order+1]; // (3.22)
  95. 

libavcodec/lsp.c:96:5: Call
  94.     int f2[lp_half_order+1]; // (3.22)
  95. 
  96.     lsp2poly(f1, lsp  , lp_half_order);
          ^
  97.     lsp2poly(f2, lsp+1, lp_half_order);
  98. 

libavcodec/lsp.c:73:1: <Length trace>
71.  * \param lsp LSP coefficients (-0x8000 <= (0.15) <= 0x7fff)
72.  */
73. static void lsp2poly(int* f, const int16_t* lsp, int lp_half_order)
    ^
74. {
75.     int i, j;

libavcodec/lsp.c:73:1: Parameter `*f`
    71.  * \param lsp LSP coefficients (-0x8000 <= (0.15) <= 0x7fff)
    72.  */
    73. static void lsp2poly(int* f, const int16_t* lsp, int lp_half_order)
        ^
    74. {
    75.     int i, j;

libavcodec/lsp.c:78:5: Array access: Offset: 1 Size: [0, +oo] by call to `ff_acelp_lsp2lpc` 
    76. 
    77.     f[0] = 0x400000;          // 1.0 in (3.22)
    78.     f[1] = -lsp[0] << 8;      // *2 and (0.15) -> (3.22)
            ^
    79. 
    80.     for(i=2; i<=lp_half_order; i++)
