libavcodec/twinvq.c:851: error: Buffer Overrun L3
  Offset: [1, +oo] Size: [0, +oo] by call to `read_and_decode_spectrum`.

libavcodec/twinvq.c:851:5: Call
849.     ftype = wtype_to_ftype_table[window_type];
850. 
851.     read_and_decode_spectrum(tctx, &gb, tctx->spectrum, ftype);
         ^
852. 
853.     imdct_output(tctx, ftype, window_type, out);

libavcodec/twinvq.c:732:1: Parameter `tctx->mtab->n_lsp`
  730. }
  731. 
  732. static void read_and_decode_spectrum(TwinContext *tctx, GetBitContext *gb,
       ^
  733.                                      float *out, enum FrameType ftype)
  734. {

libavcodec/twinvq.c:783:19: Array declaration
  781.     for (i = 0; i < channels; i++) {
  782.         float *chunk = out + mtab->size * i;
  783.         float lsp[tctx->mtab->n_lsp];
                         ^
  784. 
  785.         for (j = 0; j < sub; j++) {

libavcodec/twinvq.c:808:9: Call
  806.                    tctx->lsp_hist[i]);
  807. 
  808.         dec_lpc_spectrum_inv(tctx, lsp, ftype, tctx->tmp_buf);
               ^
  809. 
  810.         for (j = 0; j < mtab->fmode[ftype].sub; j++) {

libavcodec/twinvq.c:589:1: Parameter `*lsp`
    587. }
    588. 
    589. static void dec_lpc_spectrum_inv(TwinContext *tctx, float *lsp,
         ^
    590.                                  enum FrameType ftype, float *lpc)
    591. {

libavcodec/twinvq.c:606:9: Call
    604.         break;
    605.     case FT_SHORT:
    606.         eval_lpcenv(tctx, lsp, lpc);
                 ^
    607.         break;
    608.     }

libavcodec/twinvq.c:255:1: Parameter `*cos_vals`
      253.  * Evaluates the LPC amplitude spectrum envelope from the line spectrum pairs.
      254.  */
      255. static void eval_lpcenv(TwinContext *tctx, const float *cos_vals, float *lpc)
           ^
      256. {
      257.     int i;

libavcodec/twinvq.c:263:27: Call
      261.     for (i = 0; i < size_s/2; i++) {
      262.         float cos_i = tctx->cos_tabs[0][i];
      263.         lpc[i]          = eval_lpc_spectrum(cos_vals,  cos_i, mtab->n_lsp);
                                     ^
      264.         lpc[size_s-i-1] = eval_lpc_spectrum(cos_vals, -cos_i, mtab->n_lsp);
      265.     }

libavcodec/twinvq.c:230:1: <Offset trace>
228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
229.  */
230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
     ^
231. {
232.     int j;

libavcodec/twinvq.c:230:1: Parameter `order`
        228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
        229.  */
        230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
             ^
        231. {
        232.     int j;

libavcodec/twinvq.c:230:1: <Length trace>
228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
229.  */
230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
     ^
231. {
232.     int j;

libavcodec/twinvq.c:230:1: Parameter `*lsp`
        228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
        229.  */
        230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
             ^
        231. {
        232.     int j;

libavcodec/twinvq.c:240:14: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `read_and_decode_spectrum` 
        238.         // Unroll the loop once since order is a multiple of four
        239.         q *= lsp[j  ] - two_cos_w;
        240.         p *= lsp[j+1] - two_cos_w;
                          ^
        241. 
        242.         q *= lsp[j+2] - two_cos_w;
