libavcodec/twinvq.c:840: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `read_and_decode_spectrum`.

libavcodec/twinvq.c:840:5: Call
838.     ftype = wtype_to_ftype_table[window_type];
839. 
840.     read_and_decode_spectrum(tctx, &gb, tctx->spectrum, ftype);
         ^
841. 
842.     imdct_output(tctx, ftype, window_type, out);

libavcodec/twinvq.c:721:1: Parameter `tctx->mtab->n_lsp`
  719. }
  720. 
  721. static void read_and_decode_spectrum(TwinContext *tctx, GetBitContext *gb,
       ^
  722.                                      float *out, enum FrameType ftype)
  723. {

libavcodec/twinvq.c:794:9: Call
  792.         }
  793. 
  794.         decode_lsp(tctx, lpc_idx1[i], lpc_idx2[i], lpc_hist_idx[i], lsp,
               ^
  795.                    tctx->lsp_hist[i]);
  796. 

libavcodec/twinvq.c:539:1: Parameter `*lsp`
    537. }
    538. 
    539. static void decode_lsp(TwinContext *tctx, int lpc_idx1, uint8_t *lpc_idx2,
         ^
    540.                        int lpc_hist_idx, float *lsp, float *hist)
    541. {

libavcodec/twinvq.c:575:5: Call
    573.     rearrange_lsp(mtab->n_lsp, lsp, 0.0001);
    574.     rearrange_lsp(mtab->n_lsp, lsp, 0.000095);
    575.     ff_sort_nearly_sorted_floats(lsp, mtab->n_lsp);
             ^
    576. }
    577. 

libavcodec/lsp.c:177:1: <Offset trace>
175. }
176. 
177. void ff_sort_nearly_sorted_floats(float *vals, int len)
     ^
178. {
179.     int i,j;

libavcodec/lsp.c:177:1: Parameter `len`
      175. }
      176. 
      177. void ff_sort_nearly_sorted_floats(float *vals, int len)
           ^
      178. {
      179.     int i,j;

libavcodec/lsp.c:182:14: Assignment
      180. 
      181.     for (i = 0; i < len - 1; i++)
      182.         for (j = i; j >= 0 && vals[j] > vals[j+1]; j--)
                        ^
      183.             FFSWAP(float, vals[j], vals[j+1]);
      184. }

libavcodec/lsp.c:177:1: <Length trace>
175. }
176. 
177. void ff_sort_nearly_sorted_floats(float *vals, int len)
     ^
178. {
179.     int i,j;

libavcodec/lsp.c:177:1: Parameter `*vals`
      175. }
      176. 
      177. void ff_sort_nearly_sorted_floats(float *vals, int len)
           ^
      178. {
      179.     int i,j;

libavcodec/lsp.c:182:41: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `read_and_decode_spectrum` 
      180. 
      181.     for (i = 0; i < len - 1; i++)
      182.         for (j = i; j >= 0 && vals[j] > vals[j+1]; j--)
                                                   ^
      183.             FFSWAP(float, vals[j], vals[j+1]);
      184. }
