libavcodec/aacdec.c:2854: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload`.

libavcodec/aacdec.c:2791:23: Call
2789. 
2790.         if (elem_type < TYPE_DSE) {
2791.             if (!(che=get_che(ac, elem_type, elem_id))) {
                            ^
2792.                 av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\n",
2793.                        elem_type, elem_id);

libavcodec/aacdec.c:526:13: Call
  524.                                        &layout_map_tags, 2) < 0)
  525.             return NULL;
  526.         if (output_configure(ac, layout_map, layout_map_tags,
                   ^
  527.                              OC_TRIAL_FRAME, 1) < 0)
  528.             return NULL;

libavcodec/aacdec.c:2854:28: Call
2852.             }
2853.             while (elem_id > 0)
2854.                 elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);
                                 ^
2855.             err = 0; /* FIXME */
2856.             break;

libavcodec/aacdec.c:2165:1: Parameter `che->sbr.n[*]`
  2163.  * @return Returns number of bytes consumed
  2164.  */
  2165. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  2166.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  2167. {

libavcodec/aacdec.c:2195:15: Call
  2193.             ac->avctx->profile = FF_PROFILE_AAC_HE;
  2194.         }
  2195.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  2196.         break;
  2197.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1062:1: Parameter `sbr->n[*]`
    1060.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1061.  */
    1062. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1063.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1064. {

libavcodec/aacsbr.c:1089:25: Call
    1087.     num_sbr_bits++;
    1088.     if (get_bits1(gb)) // bs_header_flag
    1089.         num_sbr_bits += read_sbr_header(sbr, gb);
                                  ^
    1090. 
    1091.     if (sbr->reset)

libavcodec/aacsbr.c:224:1: Parameter `sbr->n[*]`
      222. }
      223. 
      224. static unsigned int read_sbr_header(SpectralBandReplication *sbr, GetBitContext *gb)
           ^
      225. {
      226.     unsigned int cnt = get_bits_count(gb);

libavcodec/aacsbr.c:273:9: Call
      271. 
      272.     if (sbr->bs_limiter_bands != old_bs_limiter_bands && !sbr->reset)
      273.         sbr_make_f_tablelim(sbr);
                   ^
      274. 
      275.     return get_bits_count(gb) - cnt;

libavcodec/aacsbr.c:177:1: <LHS trace>
175. 
176. /// Limiter Frequency Band Table (14496-3 sp04 p198)
177. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
     ^
178. {
179.     int k;

libavcodec/aacsbr.c:177:1: Parameter `sbr->n[*]`
        175. 
        176. /// Limiter Frequency Band Table (14496-3 sp04 p198)
        177. static void sbr_make_f_tablelim(SpectralBandReplication *sbr)
             ^
        178. {
        179.     int k;

libavcodec/aacsbr.c:202:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_extension_payload` 
        200.               qsort_comparison_function_int16);
        201. 
        202.         sbr->n_lim = sbr->n[0] + sbr->num_patches - 1;
                     ^
        203.         while (out < sbr->f_tablelim + sbr->n_lim) {
        204.             if (*in >= *out * lim_bands_per_octave_warped) {
