libavcodec/nellymoserenc.c:231: error: Buffer Overrun L2
  Offset: [-35767+min(35767, `*cand`), 35767+max(1, `*cand`)] Size: 35768.

libavcodec/nellymoserenc.c:219:23: <Offset trace>
217.         power_candidate = cand[band];
218.         for (q = 1000; !c && q < OPT_SIZE; q <<= 2) {
219.             idx_min = FFMAX(0, cand[band] - q);
                           ^
220.             idx_max = FFMIN(OPT_SIZE, cand[band - 1] + q);
221.             for (i = FFMAX(0, cand[band - 1] - q); i < FFMIN(OPT_SIZE, cand[band - 1] + q); i++) {

libavcodec/nellymoserenc.c:219:23: Assignment
217.         power_candidate = cand[band];
218.         for (q = 1000; !c && q < OPT_SIZE; q <<= 2) {
219.             idx_min = FFMAX(0, cand[band] - q);
                           ^
220.             idx_max = FFMIN(OPT_SIZE, cand[band - 1] + q);
221.             for (i = FFMAX(0, cand[band - 1] - q); i < FFMIN(OPT_SIZE, cand[band - 1] + q); i++) {

libavcodec/nellymoserenc.c:219:13: Assignment
217.         power_candidate = cand[band];
218.         for (q = 1000; !c && q < OPT_SIZE; q <<= 2) {
219.             idx_min = FFMAX(0, cand[band] - q);
                 ^
220.             idx_max = FFMIN(OPT_SIZE, cand[band - 1] + q);
221.             for (i = FFMAX(0, cand[band - 1] - q); i < FFMIN(OPT_SIZE, cand[band - 1] + q); i++) {

libavcodec/nellymoserenc.c:196:1: <Length trace>
194. }
195. 
196. static void get_exponent_dynamic(NellyMoserEncodeContext *s, float *cand, int *idx_table)
     ^
197. {
198.     int i, j, band, best_idx;

libavcodec/nellymoserenc.c:196:1: Array declaration
194. }
195. 
196. static void get_exponent_dynamic(NellyMoserEncodeContext *s, float *cand, int *idx_table)
     ^
197. {
198.     int i, j, band, best_idx;

libavcodec/nellymoserenc.c:231:29: Array access: Offset: [-35767+min(35767, *cand), 35767+max(1, *cand)] Size: 35768
229.                         tmp = opt[band - 1][i] + distance(idx, power_candidate, band);
230.                         if (opt[band][idx] > tmp) {
231.                             opt[band][idx] = tmp;
                                 ^
232.                             path[band][idx] = j;
233.                             c = 1;
