libavcodec/twinvq.c:808: error: Buffer Overrun L2
  Offset: [3, `tctx->mtab->n_lsp` + 1] Size: `tctx->mtab->n_lsp` by call to `dec_lpc_spectrum_inv`.

libavcodec/twinvq.c:732:1: Parameter `tctx->mtab->n_lsp`
730. }
731. 
732. static void read_and_decode_spectrum(TwinContext *tctx, GetBitContext *gb,
     ^
733.                                      float *out, enum FrameType ftype)
734. {

libavcodec/twinvq.c:783:19: Array declaration
781.     for (i=0; i < channels; i++) {
782.         float *chunk = out + mtab->size * i;
783.         float lsp[tctx->mtab->n_lsp];
                       ^
784. 
785.         for (j=0; j < sub; j++) {

libavcodec/twinvq.c:808:9: Call
806.                    tctx->lsp_hist[i]);
807. 
808.         dec_lpc_spectrum_inv(tctx, lsp, ftype, tctx->tmp_buf);
             ^
809. 
810.         for (j=0; j < mtab->fmode[ftype].sub; j++) {

libavcodec/twinvq.c:589:1: Parameter `*lsp`
  587. }
  588. 
  589. static void dec_lpc_spectrum_inv(TwinContext *tctx, float *lsp,
       ^
  590.                                  enum FrameType ftype, float *lpc)
  591. {

libavcodec/twinvq.c:606:9: Call
  604.         break;
  605.     case FT_SHORT:
  606.         eval_lpcenv(tctx, lsp, lpc);
               ^
  607.         break;
  608.     }

libavcodec/twinvq.c:255:1: Parameter `*cos_vals`
    253.  * Evaluates the LPC amplitude spectrum envelope from the line spectrum pairs.
    254.  */
    255. static void eval_lpcenv(TwinContext *tctx, const float *cos_vals, float *lpc)
         ^
    256. {
    257.     int i;

libavcodec/twinvq.c:263:27: Call
    261.     for (i=0; i < size_s/2; i++) {
    262.         float cos_i = tctx->cos_tabs[0][i];
    263.         lpc[i]          = eval_lpc_spectrum(cos_vals,  cos_i, mtab->n_lsp);
                                   ^
    264.         lpc[size_s-i-1] = eval_lpc_spectrum(cos_vals, -cos_i, mtab->n_lsp);
    265.     }

libavcodec/twinvq.c:230:1: <Offset trace>
228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
229.  */
230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
     ^
231. {
232.     int j;

libavcodec/twinvq.c:230:1: Parameter `order`
      228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
      229.  */
      230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
           ^
      231. {
      232.     int j;

libavcodec/twinvq.c:230:1: <Length trace>
228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
229.  */
230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
     ^
231. {
232.     int j;

libavcodec/twinvq.c:230:1: Parameter `*lsp`
      228.  * @todo reuse code from vorbis_dec.c: vorbis_floor0_decode
      229.  */
      230. static float eval_lpc_spectrum(const float *lsp, float cos_val, int order)
           ^
      231. {
      232.     int j;

libavcodec/twinvq.c:243:14: Array access: Offset: [3, tctx->mtab->n_lsp + 1] Size: tctx->mtab->n_lsp by call to `dec_lpc_spectrum_inv` 
      241. 
      242.         q *= lsp[j+2] - two_cos_w;
      243.         p *= lsp[j+3] - two_cos_w;
                        ^
      244.     }
      245. 
