libavcodec/aacsbr.c:545: error: Buffer Overrun L3
  Offset: [-1, 5] Size: 6.

libavcodec/aacsbr.c:508:5: <Offset trace>
506.     int goal_sb = ((1000 << 11) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
507. 
508.     sbr->num_patches = 0;
         ^
509. 
510.     if (goal_sb < sbr->kx[1] + sbr->m[1]) {

libavcodec/aacsbr.c:508:5: Assignment
506.     int goal_sb = ((1000 << 11) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
507. 
508.     sbr->num_patches = 0;
         ^
509. 
510.     if (goal_sb < sbr->kx[1] + sbr->m[1]) {

libavcodec/aacsbr.c:501:1: <Length trace>
499. 
500. /// High Frequency Generation - Patch Construction (14496-3 sp04 p216 fig. 4.46)
501. static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
     ^
502. {
503.     int i, k, sb = 0;

libavcodec/aacsbr.c:501:1: Parameter `sbr->patch_num_subbands[*]`
499. 
500. /// High Frequency Generation - Patch Construction (14496-3 sp04 p216 fig. 4.46)
501. static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
     ^
502. {
503.     int i, k, sb = 0;

libavcodec/aacsbr.c:545:9: Array access: Offset: [-1, 5] Size: 6
543.     } while (sb != sbr->kx[1] + sbr->m[1]);
544. 
545.     if (sbr->patch_num_subbands[sbr->num_patches-1] < 3 && sbr->num_patches > 1)
             ^
546.         sbr->num_patches--;
547. 
