libavcodec/aacdec.c:2444: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload`.

libavcodec/aacdec.c:2363:13: Call
2361. 
2362.     if (show_bits(gb, 12) == 0xfff) {
2363.         if (parse_adts_frame_header(ac, gb) < 0) {
                  ^
2364.             av_log(avctx, AV_LOG_ERROR, "Error decoding AAC frame header.\n");
2365.             err = -1;

libavcodec/aacdec.c:2332:17: Call
  2330.                     &layout_map_tags, hdr_info.chan_config))
  2331.                 return -7;
  2332.             if (output_configure(ac, layout_map, layout_map_tags,
                        ^
  2333.                                  FFMAX(ac->oc[1].status, OC_TRIAL_FRAME)))
  2334.                 return -7;

libavcodec/aacdec.c:2444:28: Call
2442.             }
2443.             while (elem_id > 0)
2444.                 elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);
                                 ^
2445.             err = 0; /* FIXME */
2446.             break;

libavcodec/aacdec.c:1919:1: Parameter `che->sbr.f_master[*]`
  1917.  * @return Returns number of bytes consumed
  1918.  */
  1919. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1920.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1921. {

libavcodec/aacdec.c:1947:15: Call
  1945.             ac->oc[1].m4ac.sbr = 1;
  1946.         }
  1947.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1948.         break;
  1949.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1063:1: Parameter `sbr->f_master[*]`
    1061.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1062.  */
    1063. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1064.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1065. {

libavcodec/aacsbr.c:1093:9: Call
    1091. 
    1092.     if (sbr->reset)
    1093.         sbr_reset(ac, sbr);
                  ^
    1094. 
    1095.     if (sbr->start)

libavcodec/aacsbr.c:1042:1: Parameter `sbr->f_master[*]`
      1040. }
      1041. 
      1042. static void sbr_reset(AACContext *ac, SpectralBandReplication *sbr)
            ^
      1043. {
      1044.     int err;

libavcodec/aacsbr.c:1045:11: Call
      1043. {
      1044.     int err;
      1045.     err = sbr_make_f_master(ac, sbr, &sbr->spectrum_params);
                      ^
      1046.     if (err >= 0)
      1047.         err = sbr_make_f_derived(ac, sbr);

libavcodec/aacsbr.c:323:1: <LHS trace>
321. 
322. /// Master Frequency Band Table (14496-3 sp04 p194)
323. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
     ^
324.                              SpectrumParameters *spectrum)
325. {

libavcodec/aacsbr.c:323:1: Parameter `sbr->f_master[*]`
        321. 
        322. /// Master Frequency Band Table (14496-3 sp04 p194)
        323. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
             ^
        324.                              SpectrumParameters *spectrum)
        325. {

libavcodec/aacsbr.c:413:13: Binary operation: ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload` 
        411.         k2diff = sbr->k[2] - sbr->k[0] - sbr->n_master * dk;
        412.         if (k2diff < 0) {
        413.             sbr->f_master[1]--;
                         ^
        414.             sbr->f_master[2]-= (k2diff < -1);
        415.         } else if (k2diff) {
