libavcodec/aacdec.c:2005: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload`.

libavcodec/aacdec.c:1954:23: Call
1952. 
1953.         if (elem_type < TYPE_DSE) {
1954.             if (!(che=get_che(ac, elem_type, elem_id))) {
                            ^
1955.                 av_log(ac->avctx, AV_LOG_ERROR, "channel element %d.%d is not allocated\n",
1956.                        elem_type, elem_id);

libavcodec/aacdec.c:114:1: Parameter `*ac->tag_che_map[*][*]`
  112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
  113. 
  114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
       ^
  115. {
  116.     // For PCE based channel configurations map the channels solely based on tags.

libavcodec/aacdec.c:2005:28: Call
2003.             }
2004.             while (elem_id > 0)
2005.                 elem_id -= decode_extension_payload(ac, &gb, elem_id, che_prev, elem_type_prev);
                                 ^
2006.             err = 0; /* FIXME */
2007.             break;

libavcodec/aacdec.c:1603:1: Parameter `che->sbr.f_master[*]`
  1601.  * @return Returns number of bytes consumed
  1602.  */
  1603. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1604.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1605. {

libavcodec/aacdec.c:1630:15: Call
  1628.             ac->m4ac.sbr = 1;
  1629.         }
  1630.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1631.         break;
  1632.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1044:1: Parameter `sbr->f_master[*]`
    1042.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1043.  */
    1044. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1045.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1046. {

libavcodec/aacsbr.c:1073:9: Call
    1071. 
    1072.     if (sbr->reset)
    1073.         sbr_reset(ac, sbr);
                  ^
    1074. 
    1075.     if (sbr->start)

libavcodec/aacsbr.c:1023:1: Parameter `sbr->f_master[*]`
      1021. }
      1022. 
      1023. static void sbr_reset(AACContext *ac, SpectralBandReplication *sbr)
            ^
      1024. {
      1025.     int err;

libavcodec/aacsbr.c:1026:11: Call
      1024. {
      1025.     int err;
      1026.     err = sbr_make_f_master(ac, sbr, &sbr->spectrum_params);
                      ^
      1027.     if (err >= 0)
      1028.         err = sbr_make_f_derived(ac, sbr);

libavcodec/aacsbr.c:304:1: <LHS trace>
302. 
303. /// Master Frequency Band Table (14496-3 sp04 p194)
304. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
     ^
305.                              SpectrumParameters *spectrum)
306. {

libavcodec/aacsbr.c:304:1: Parameter `sbr->f_master[*]`
        302. 
        303. /// Master Frequency Band Table (14496-3 sp04 p194)
        304. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
             ^
        305.                              SpectrumParameters *spectrum)
        306. {

libavcodec/aacsbr.c:394:13: Binary operation: ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload` 
        392.         k2diff = sbr->k[2] - sbr->k[0] - sbr->n_master * dk;
        393.         if (k2diff < 0) {
        394.             sbr->f_master[1]--;
                         ^
        395.             sbr->f_master[2]-= (k2diff < -1);
        396.         } else if (k2diff) {
