libavcodec/opus_celt.c:2054: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 21 by call to `celt_decode_bands`.

libavcodec/opus_celt.c:1975:1: Parameter `startband`
1973. }
1974. 
1975. int ff_celt_decode_frame(CeltContext *s, OpusRangeCoder *rc,
      ^
1976.                          float **output, int coded_channels, int frame_size,
1977.                          int startband,  int endband)

libavcodec/opus_celt.c:2001:5: Assignment
1999.     s->flushed        = 0;
2000.     s->coded_channels = coded_channels;
2001.     s->startband      = startband;
          ^
2002.     s->endband        = endband;
2003.     s->framebits      = rc->rb.bytes * 8;

libavcodec/opus_celt.c:2034:16: Call
2032. 
2033.     /* obtain post-filter options */
2034.     consumed = parse_postfilter(s, rc, consumed);
                     ^
2035. 
2036.     /* obtain transient flag */

libavcodec/opus_celt.c:1787:1: Parameter `s->startband`
  1785. }
  1786. 
  1787. static int parse_postfilter(CeltContext *s, OpusRangeCoder *rc, int consumed)
        ^
  1788. {
  1789.     static const float postfilter_taps[3][3] = {

libavcodec/opus_celt.c:2050:5: Call
2048.     }
2049. 
2050.     celt_decode_coarse_energy(s, rc);
          ^
2051.     celt_decode_tf_changes   (s, rc, transient);
2052.     celt_decode_allocation   (s, rc);

libavcodec/opus_celt.c:517:1: Parameter `s->endband`
  515. }
  516. 
  517. static void celt_decode_coarse_energy(CeltContext *s, OpusRangeCoder *rc)
       ^
  518. {
  519.     int i, j;

libavcodec/opus_celt.c:2052:5: Call
2050.     celt_decode_coarse_energy(s, rc);
2051.     celt_decode_tf_changes   (s, rc, transient);
2052.     celt_decode_allocation   (s, rc);
          ^
2053.     celt_decode_fine_energy  (s, rc);
2054.     celt_decode_bands        (s, rc);

libavcodec/opus_celt.c:636:1: Parameter `s->startband`
  634. }
  635. 
  636. static void celt_decode_allocation(CeltContext *s, OpusRangeCoder *rc)
       ^
  637. {
  638.     // approx. maximum bit allocation for each band before boost/trim

libavcodec/opus_celt.c:2054:5: Call
2052.     celt_decode_allocation   (s, rc);
2053.     celt_decode_fine_energy  (s, rc);
2054.     celt_decode_bands        (s, rc);
          ^
2055. 
2056.     if (s->anticollapse_bit)

libavcodec/opus_celt.c:1887:5: <Offset trace>
1885. 
1886.     int update_lowband = 1;
1887.     int lowband_offset = 0;
          ^
1888. 
1889.     int i, j;

libavcodec/opus_celt.c:1887:5: Assignment
  1885. 
  1886.     int update_lowband = 1;
  1887.     int lowband_offset = 0;
            ^
  1888. 
  1889.     int i, j;

libavcodec/opus_celt.c:1930:13: Assignment
  1928.             foldstart = lowband_offset;
  1929.             while (celt_freq_bands[--foldstart] > effective_lowband);
  1930.             foldend = lowband_offset - 1;
                    ^
  1931.             while (celt_freq_bands[++foldend] < effective_lowband + celt_freq_range[i]);
  1932. 

libavcodec/opus_celt.c:1931:36: Assignment
  1929.             while (celt_freq_bands[--foldstart] > effective_lowband);
  1930.             foldend = lowband_offset - 1;
  1931.             while (celt_freq_bands[++foldend] < effective_lowband + celt_freq_range[i]);
                                           ^
  1932. 
  1933.             cm[0] = cm[1] = 0;

libavcodec/opus_celt.c:1879:1: <Length trace>
1877. }
1878. 
1879. static void celt_decode_bands(CeltContext *s, OpusRangeCoder *rc)
      ^
1880. {
1881.     float lowband_scratch[8 * 22];

libavcodec/opus_celt.c:1879:1: Parameter `s->frame[*].collapse_masks[*]`
  1877. }
  1878. 
  1879. static void celt_decode_bands(CeltContext *s, OpusRangeCoder *rc)
        ^
  1880. {
  1881.     float lowband_scratch[8 * 22];

libavcodec/opus_celt.c:1935:26: Array access: Offset: [-1, +oo] Size: 21 by call to `celt_decode_bands` 
  1933.             cm[0] = cm[1] = 0;
  1934.             for (j = foldstart; j < foldend; j++) {
  1935.                 cm[0] |= s->frame[0].collapse_masks[j];
                                 ^
  1936.                 cm[1] |= s->frame[s->coded_channels - 1].collapse_masks[j];
  1937.             }
