libavcodec/amrwbdec.c:524: error: Buffer Overrun L1
  Offset: [5, 8] (⇐ [4, 7] + 1) Size: 4 by call to `decode_6p_track`.

libavcodec/amrwbdec.c:476:1: Array declaration
474.  * @param[in]  mode                Mode of the current frame
475.  */
476. static void decode_fixed_vector(float *fixed_vector, const uint16_t *pulse_hi,
     ^
477.                                 const uint16_t *pulse_lo, const enum Mode mode)
478. {

libavcodec/amrwbdec.c:524:13: Call
522.     case MODE_23k85:
523.         for (i = 0; i < 4; i++)
524.             decode_6p_track(sig_pos[i], (int) pulse_lo[i] +
                 ^
525.                            ((int) pulse_hi[i] << 11), 4, 1);
526.         break;

libavcodec/amrwbdec.c:432:1: Parameter `*out`
  430. }
  431. 
  432. static void decode_6p_track(int *out, int code, int m, int off) ///code: 6m-2 bits
       ^
  433. {
  434.     int b_offset = 1 << (m - 1);

libavcodec/amrwbdec.c:443:9: Call
  441.         decode_1p_track(out, BIT_STR(code, 0, m),
  442.                         m - 1, off + half_more);
  443.         decode_5p_track(out + 1, BIT_STR(code, m, 5*m - 5),
               ^
  444.                         m - 1, off + half_more);
  445.         break;

libavcodec/amrwbdec.c:422:1: Parameter `*out`
    420. }
    421. 
    422. static void decode_5p_track(int *out, int code, int m, int off) ///code: 5m bits
         ^
    423. {
    424.     int half_3p = BIT_POS(code, 5*m - 1) << (m - 1);

libavcodec/amrwbdec.c:429:5: Call
    427.                     m - 1, off + half_3p);
    428. 
    429.     decode_2p_track(out + 3, BIT_STR(code, 0, 2*m + 1), m, off);
             ^
    430. }
    431. 

libavcodec/amrwbdec.c:367:1: <Length trace>
365. }
366. 
367. static inline void decode_2p_track(int *out, int code, int m, int off) ///code: 2m+1 bits
     ^
368. {
369.     int pos0 = BIT_STR(code, m, m) + off;

libavcodec/amrwbdec.c:367:1: Parameter `*out`
      365. }
      366. 
      367. static inline void decode_2p_track(int *out, int code, int m, int off) ///code: 2m+1 bits
           ^
      368. {
      369.     int pos0 = BIT_STR(code, m, m) + off;

libavcodec/amrwbdec.c:373:5: Array access: Offset: [5, 8] (⇐ [4, 7] + 1) Size: 4 by call to `decode_6p_track` 
      371. 
      372.     out[0] = BIT_POS(code, 2*m) ? -pos0 : pos0;
      373.     out[1] = BIT_POS(code, 2*m) ? -pos1 : pos1;
               ^
      374.     out[1] = pos0 > pos1 ? -out[1] : out[1];
      375. }
