libavcodec/mpegaudiodec.c:2501: error: Buffer Overrun L2
  Offset: [0, 8] Size: 2 by call to `mp_decode_frame`.

libavcodec/mpegaudiodec.c:2464:1: Parameter `*avpkt->data`
2462. 
2463. 
2464. static int decode_frame_mp3on4(AVCodecContext * avctx,
      ^
2465.                         void *data, int *data_size,
2466.                         AVPacket *avpkt)

libavcodec/mpegaudiodec.c:2495:9: Assignment
2493.         assert (m != NULL);
2494. 
2495.         header = (AV_RB32(buf) & 0x000fffff) | s->syncword; // patch header
              ^
2496. 
2497.         if (ff_mpa_check_header(header) < 0) // Bad header, discard block

libavcodec/mpegaudiodec.c:2500:9: Call
2498.             break;
2499. 
2500.         ff_mpegaudio_decode_header((MPADecodeHeader *)m, header);
              ^
2501.         out_size += mp_decode_frame(m, outptr, buf, fsize);
2502.         buf += fsize;

libavcodec/mpegaudiodecheader.c:39:9: Assignment
  37.     if (header & (1<<20)) {
  38.         s->lsf = (header & (1<<19)) ? 0 : 1;
  39.         mpeg25 = 0;
              ^
  40.     } else {
  41.         s->lsf = 1;

libavcodec/mpegaudiodecheader.c:49:5: Assignment
  47.     sample_rate_index = (header >> 10) & 3;
  48.     sample_rate = ff_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);
  49.     sample_rate_index += 3 * (s->lsf + mpeg25);
          ^
  50.     s->sample_rate_index = sample_rate_index;
  51.     s->error_protection = ((header >> 16) & 1) ^ 1;

libavcodec/mpegaudiodecheader.c:50:5: Assignment
  48.     sample_rate = ff_mpa_freq_tab[sample_rate_index] >> (s->lsf + mpeg25);
  49.     sample_rate_index += 3 * (s->lsf + mpeg25);
  50.     s->sample_rate_index = sample_rate_index;
          ^
  51.     s->error_protection = ((header >> 16) & 1) ^ 1;
  52.     s->sample_rate = sample_rate;

libavcodec/mpegaudiodec.c:2501:21: Call
2499. 
2500.         ff_mpegaudio_decode_header((MPADecodeHeader *)m, header);
2501.         out_size += mp_decode_frame(m, outptr, buf, fsize);
                          ^
2502.         buf += fsize;
2503.         len -= fsize;

libavcodec/mpegaudiodec.c:2188:1: Parameter `s->nb_channels`
  2186. }
  2187. 
  2188. static int mp_decode_frame(MPADecodeContext *s,
        ^
  2189.                            OUT_INT *samples, const uint8_t *buf, int buf_size)
  2190. {

libavcodec/mpegaudiodec.c:2204:21: Call
  2202.     case 1:
  2203.         s->avctx->frame_size = 384;
  2204.         nb_frames = mp_decode_layer1(s);
                            ^
  2205.         break;
  2206.     case 2:

libavcodec/mpegaudiodec.c:1119:1: <Offset trace>
1117. 
1118. /* return the number of decoded frames */
1119. static int mp_decode_layer1(MPADecodeContext *s)
      ^
1120. {
1121.     int bound, i, v, n, ch, j, mant;

libavcodec/mpegaudiodec.c:1119:1: Parameter `s->nb_channels`
    1117. 
    1118. /* return the number of decoded frames */
    1119. static int mp_decode_layer1(MPADecodeContext *s)
          ^
    1120. {
    1121.     int bound, i, v, n, ch, j, mant;

libavcodec/mpegaudiodec.c:1119:1: <Length trace>
1117. 
1118. /* return the number of decoded frames */
1119. static int mp_decode_layer1(MPADecodeContext *s)
      ^
1120. {
1121.     int bound, i, v, n, ch, j, mant;

libavcodec/mpegaudiodec.c:1119:1: Array declaration
    1117. 
    1118. /* return the number of decoded frames */
    1119. static int mp_decode_layer1(MPADecodeContext *s)
          ^
    1120. {
    1121.     int bound, i, v, n, ch, j, mant;

libavcodec/mpegaudiodec.c:1133:13: Array access: Offset: [0, 8] Size: 2 by call to `mp_decode_frame` 
    1131.     for(i=0;i<bound;i++) {
    1132.         for(ch=0;ch<s->nb_channels;ch++) {
    1133.             allocation[ch][i] = get_bits(&s->gb, 4);
                      ^
    1134.         }
    1135.     }
