libavcodec/aacdec.c:2047: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload`.

libavcodec/aacdec.c:2023:19: Call
2021. 
2022.         case TYPE_DSE:
2023.             err = skip_data_stream_element(ac, &gb);
                        ^
2024.             break;
2025. 

libavcodec/aacdec.c:606:1: Parameter `*ac->avctx`
  604.  * Skip data_stream_element; reference: table 4.10.
  605.  */
  606. static int skip_data_stream_element(AACContext *ac, GetBitContext *gb)
       ^
  607. {
  608.     int byte_align = get_bits1(gb);

libavcodec/aacdec.c:2047:28: Call
2045.             }
2046.             while (elem_id > 0)
2047.                 elem_id -= decode_extension_payload(ac, &gb, elem_id, che_prev, elem_type_prev);
                                 ^
2048.             err = 0; /* FIXME */
2049.             break;

libavcodec/aacdec.c:1650:1: Parameter `che->sbr.n[*]`
  1648.  * @return Returns number of bytes consumed
  1649.  */
  1650. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1651.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1652. {

libavcodec/aacdec.c:1673:15: Call
  1671.             ac->m4ac.sbr = 1;
  1672.         }
  1673.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1674.         break;
  1675.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1037:1: Parameter `sbr->n[*]`
    1035.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1036.  */
    1037. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1038.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1039. {

libavcodec/aacsbr.c:1063:25: Call
    1061.     num_sbr_bits++;
    1062.     if (get_bits1(gb)) // bs_header_flag
    1063.         num_sbr_bits += read_sbr_header(sbr, gb);
                                  ^
    1064. 
    1065.     if (sbr->reset)

libavcodec/aacsbr.c:203:1: Parameter `sbr->n[*]`
      201. }
      202. 
      203. static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext *gb)
           ^
      204. {
      205.     unsigned int cnt = get_bits_count(gb);

libavcodec/aacsbr.c:252:9: Call
      250. 
      251.     if (sbr->bs_limiter_bands != old_bs_limiter_bands && !sbr->reset)
      252.         sbr_make_f_tablelim(sbr);
                   ^
      253. 
      254.     return get_bits_count(gb) - cnt;

libavcodec/aacsbr.c:156:1: <LHS trace>
154. 
155. /// Limiter Frequency Band Table (14496-3 sp04 p198)
156. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
     ^
157. {
158.     int k;

libavcodec/aacsbr.c:156:1: Parameter `sbr->n[*]`
        154. 
        155. /// Limiter Frequency Band Table (14496-3 sp04 p198)
        156. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
             ^
        157. {
        158.     int k;

libavcodec/aacsbr.c:181:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload` 
        179.               qsort_comparison_function_int16);
        180. 
        181.         sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;
                     ^
        182.         while (out < sbr->f_tablelim + sbr->n_lim) {
        183.             if (*in >= *out * lim_bands_per_octave_warped) {
