libavcodec/amrwbdec.c:1199: error: Buffer Overrun L2
  Offset: [0, 18] (⇐ [0, 3] + [0, 15]) Size: 4 by call to `hb_synthesis`.

libavcodec/amrwbdec.c:1132:10: Assignment
1130.         ff_amrwb_lsp2lpc(ctx->isp[sub], ctx->lp_coef[sub], LP_ORDER);
1131. 
1132.     for (sub = 0; sub < 4; sub++) {
               ^
1133.         const AMRWBSubFrame *cur_subframe = &cf->subframe[sub];
1134.         float *sub_buf = buf_out + sub * AMRWB_SFR_SIZE_16k;

libavcodec/amrwbdec.c:1199:9: Call
1197.         scaled_hb_excitation(ctx, hb_exc, synth_exc, hb_gain);
1198. 
1199.         hb_synthesis(ctx, sub, &ctx->samples_hb[LP_ORDER_16k],
              ^
1200.                      hb_exc, ctx->isf_cur, ctx->isf_past_final);
1201. 

libavcodec/amrwbdec.c:989:1: Parameter `subframe`
  987.  * @param[in]     isf_past         Past frame final isf vector
  988.  */
  989. static void hb_synthesis(AMRWBContext *ctx, int subframe, float *samples,
       ^
  990.                          const float *exc, const float *isf, const float *isf_past)
  991. {

libavcodec/amrwbdec.c:1010:9: Call
  1008.         lpc_weighting(hb_lpc, hb_lpc, 0.9, LP_ORDER_16k);
  1009.     } else {
  1010.         lpc_weighting(hb_lpc, ctx->lp_coef[subframe], 0.6, LP_ORDER);
                ^
  1011.     }
  1012. 

libavcodec/amrwbdec.c:967:1: <Offset trace>
965.  * @param[in]  size                LP array size
966.  */
967. static void lpc_weighting(float *out, const float *lpc, float gamma, int size)
     ^
968. {
969.     int i;

libavcodec/amrwbdec.c:967:1: Parameter `size`
    965.  * @param[in]  size                LP array size
    966.  */
    967. static void lpc_weighting(float *out, const float *lpc, float gamma, int size)
         ^
    968. {
    969.     int i;

libavcodec/amrwbdec.c:967:1: <Length trace>
965.  * @param[in]  size                LP array size
966.  */
967. static void lpc_weighting(float *out, const float *lpc, float gamma, int size)
     ^
968. {
969.     int i;

libavcodec/amrwbdec.c:967:1: Parameter `*lpc`
    965.  * @param[in]  size                LP array size
    966.  */
    967. static void lpc_weighting(float *out, const float *lpc, float gamma, int size)
         ^
    968. {
    969.     int i;

libavcodec/amrwbdec.c:973:18: Array access: Offset: [0, 18] (⇐ [0, 3] + [0, 15]) Size: 4 by call to `hb_synthesis` 
    971. 
    972.     for (i = 0; i < size; i++) {
    973.         out[i] = lpc[i] * fac;
                          ^
    974.         fac   *= gamma;
    975.     }
