libavcodec/aacsbr.c:534: error: Buffer Overrun L3
  Offset: [-1, +oo] Size: 6.

libavcodec/aacsbr.c:506:5: <Offset trace>
504.     int goal_sb = ((1000 << 11) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
505. 
506.     sbr->num_patches = 0;
         ^
507. 
508.     if (goal_sb < sbr->kx[1] + sbr->m[1]) {

libavcodec/aacsbr.c:506:5: Assignment
504.     int goal_sb = ((1000 << 11) + (sbr->sample_rate >> 1)) / sbr->sample_rate;
505. 
506.     sbr->num_patches = 0;
         ^
507. 
508.     if (goal_sb < sbr->kx[1] + sbr->m[1]) {

libavcodec/aacsbr.c:499:1: <Length trace>
497. 
498. /// High Frequency Generation - Patch Construction (14496-3 sp04 p216 fig. 4.46)
499. static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
     ^
500. {
501.     int i, k, sb = 0;

libavcodec/aacsbr.c:499:1: Parameter `sbr->patch_num_subbands[*]`
497. 
498. /// High Frequency Generation - Patch Construction (14496-3 sp04 p216 fig. 4.46)
499. static int sbr_hf_calc_npatches(AACContext *ac, SpectralBandReplication *sbr)
     ^
500. {
501.     int i, k, sb = 0;

libavcodec/aacsbr.c:534:9: Array access: Offset: [-1, +oo] Size: 6
532.     } while (sb != sbr->kx[1] + sbr->m[1]);
533. 
534.     if (sbr->patch_num_subbands[sbr->num_patches-1] < 3 && sbr->num_patches > 1)
             ^
535.         sbr->num_patches--;
536. 
