libavcodec/amrwbdec.c:510: error: Buffer Overrun L2
  Offset: [3, 6] Size: 4 by call to `decode_4p_track`.

libavcodec/amrwbdec.c:476:1: Array declaration
474.  * @param[in]  mode                Mode of the current frame
475.  */
476. static void decode_fixed_vector(float *fixed_vector, const uint16_t *pulse_hi,
     ^
477.                                 const uint16_t *pulse_lo, const enum Mode mode)
478. {

libavcodec/amrwbdec.c:510:13: Call
508.     case MODE_18k25:
509.         for (i = 0; i < 4; i++)
510.             decode_4p_track(sig_pos[i], (int) pulse_lo[i] +
                 ^
511.                            ((int) pulse_hi[i] << 14), 4, 1);
512.         break;

libavcodec/amrwbdec.c:386:1: Parameter `*out`
  384. }
  385. 
  386. static void decode_4p_track(int *out, int code, int m, int off) ///code: 4m bits
       ^
  387. {
  388.     int half_4p, subhalf_2p;

libavcodec/amrwbdec.c:404:9: Call
  402.         decode_1p_track(out, BIT_STR(code,  3*m - 2, m),
  403.                         m - 1, off);
  404.         decode_3p_track(out + 1, BIT_STR(code, 0, 3*m - 2),
               ^
  405.                         m - 1, off + b_offset);
  406.         break;

libavcodec/amrwbdec.c:377:1: Parameter `*out`
    375. }
    376. 
    377. static void decode_3p_track(int *out, int code, int m, int off) ///code: 3m+1 bits
         ^
    378. {
    379.     int half_2p = BIT_POS(code, 2*m - 1) << (m - 1);

libavcodec/amrwbdec.c:383:5: Call
    381.     decode_2p_track(out, BIT_STR(code, 0, 2*m - 1),
    382.                     m - 1, off + half_2p);
    383.     decode_1p_track(out + 2, BIT_STR(code, 2*m, m + 1), m, off);
             ^
    384. }
    385. 

libavcodec/amrwbdec.c:360:1: <Length trace>
358.  * @param[in]  off                 Offset for decoded positions
359.  */
360. static inline void decode_1p_track(int *out, int code, int m, int off)
     ^
361. {
362.     int pos = BIT_STR(code, 0, m) + off; ///code: m+1 bits

libavcodec/amrwbdec.c:360:1: Parameter `*out`
      358.  * @param[in]  off                 Offset for decoded positions
      359.  */
      360. static inline void decode_1p_track(int *out, int code, int m, int off)
           ^
      361. {
      362.     int pos = BIT_STR(code, 0, m) + off; ///code: m+1 bits

libavcodec/amrwbdec.c:364:5: Array access: Offset: [3, 6] Size: 4 by call to `decode_4p_track` 
      362.     int pos = BIT_STR(code, 0, m) + off; ///code: m+1 bits
      363. 
      364.     out[0] = BIT_POS(code, m) ? -pos : pos;
               ^
      365. }
      366. 
