libavcodec/qcelpdec.c:753: error: Buffer Overrun L2
  Offset: [0, 15] Size: 5 by call to `decode_lspf`.

libavcodec/qcelpdec.c:699:16: Call
697.     /* get output buffer */
698.     frame->nb_samples = 160;
699.     if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
                    ^
700.         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
701.         return ret;

libavcodec/decode.c:1144:9: Call
  1142. 
  1143.     if (ret < 0)
  1144.         av_frame_unref(frame);
                ^
  1145. 
  1146.     return ret;

libavutil/frame.c:310:5: Call
    308.     int i;
    309. 
    310.     wipe_side_data(frame);
             ^
    311. 
    312.     for (i = 0; i < FF_ARRAY_ELEMS(frame->buf); i++)

libavutil/frame.c:62:9: Call
      60. 
      61.     for (i = 0; i < frame->nb_side_data; i++) {
      62.         free_side_data(&frame->side_data[i]);
                  ^
      63.     }
      64.     frame->nb_side_data = 0;

libavutil/frame.c:53:5: Call
        51. 
        52.     av_freep(&sd->data);
        53.     av_dict_free(&sd->metadata);
                ^
        54.     av_freep(ptr_sd);
        55. }

libavutil/dict.c:186:5: Call
          184.         av_free(m->elems);
          185.     }
          186.     av_freep(pm);
                   ^
          187. }
          188. 

libavutil/mem.c:198:26: Assignment
            196. 
            197.     memcpy(&val, arg, sizeof(val));
            198.     memcpy(arg, &(void *){ NULL }, sizeof(val));
                                          ^
            199.     av_free(val);
            200. }

libavcodec/qcelpdec.c:750:5: Call
748.     }
749. 
750.     decode_gain_and_index(q, gain);
         ^
751.     compute_svector(q, gain, outbuffer);
752. 

libavcodec/qcelpdec.c:198:1: Parameter `q->frame.cindex[*]`
  196.  * TIA/EIA/IS-733 2.4.6.2
  197.  */
  198. static void decode_gain_and_index(QCELPContext *q, float *gain)
       ^
  199. {
  200.     int i, subframes_count, g1[16];

libavcodec/qcelpdec.c:751:5: Call
749. 
750.     decode_gain_and_index(q, gain);
751.     compute_svector(q, gain, outbuffer);
         ^
752. 
753.     if (decode_lspf(q, quantized_lspf) < 0) {

libavcodec/qcelpdec.c:312:1: Parameter `q->frame.lspv[*]`
  310.  * @param cdn_vector array for the generated scaled codebook vector
  311.  */
  312. static void compute_svector(QCELPContext *q, const float *gain,
       ^
  313.                             float *cdn_vector)
  314. {

libavcodec/qcelpdec.c:753:9: Call
751.     compute_svector(q, gain, outbuffer);
752. 
753.     if (decode_lspf(q, quantized_lspf) < 0) {
             ^
754.         warn_insufficient_frame_quality(avctx, "Badly received packets in frame.");
755.         goto erasure;

libavcodec/qcelpdec.c:114:1: <Offset trace>
112.  * TIA/EIA/IS-733 2.4.3.2.6.2-2, 2.4.8.7.3
113.  */
114. static int decode_lspf(QCELPContext *q, float *lspf)
     ^
115. {
116.     int i;

libavcodec/qcelpdec.c:114:1: Parameter `q->frame.lspv[*]`
  112.  * TIA/EIA/IS-733 2.4.3.2.6.2-2, 2.4.8.7.3
  113.  */
  114. static int decode_lspf(QCELPContext *q, float *lspf)
       ^
  115. {
  116.     int i;

libavcodec/qcelpdata.h:414:1: <Length trace>
412. { 539,1564},{1142, 533},{ 984, 391},{2130,1089}};
413. 
414. static const qcelp_vector * const qcelp_lspvq[5] = {
     ^
415.     qcelp_lspvq1,
416.     qcelp_lspvq2,

libavcodec/qcelpdata.h:414:1: Array declaration
  412. { 539,1564},{1142, 533},{ 984, 391},{2130,1089}};
  413. 
  414. static const qcelp_vector * const qcelp_lspvq[5] = {
       ^
  415.     qcelp_lspvq1,
  416.     qcelp_lspvq2,

libavcodec/qcelpdec.c:168:43: Array access: Offset: [0, 15] Size: 5 by call to `decode_lspf` 
  166.         tmp_lspf = 0.0;
  167.         for (i = 0; i < 5; i++) {
  168.             lspf[2 * i + 0] = tmp_lspf += qcelp_lspvq[i][q->frame.lspv[i]][0] * 0.0001;
                                                 ^
  169.             lspf[2 * i + 1] = tmp_lspf += qcelp_lspvq[i][q->frame.lspv[i]][1] * 0.0001;
  170.         }
