libavcodec/aacdec.c:2389: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload`.

libavcodec/aacdec.c:2362:19: Call
2360. 
2361.         case TYPE_DSE:
2362.             err = skip_data_stream_element(ac, gb);
                        ^
2363.             break;
2364. 

libavcodec/aacdec.c:849:1: Parameter `*ac->avctx`
  847.  * Skip data_stream_element; reference: table 4.10.
  848.  */
  849. static int skip_data_stream_element(AACContext *ac, GetBitContext *gb)
       ^
  850. {
  851.     int byte_align = get_bits1(gb);

libavcodec/aacdec.c:2389:28: Call
2387.             }
2388.             while (elem_id > 0)
2389.                 elem_id -= decode_extension_payload(ac, gb, elem_id, che_prev, elem_type_prev);
                                 ^
2390.             err = 0; /* FIXME */
2391.             break;

libavcodec/aacdec.c:1870:1: Parameter `che->sbr.f_master[*]`
  1868.  * @return Returns number of bytes consumed
  1869.  */
  1870. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1871.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1872. {

libavcodec/aacdec.c:1898:15: Call
  1896.             ac->m4ac.sbr = 1;
  1897.         }
  1898.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1899.         break;
  1900.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:1052:1: Parameter `sbr->f_master[*]`
    1050.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    1051.  */
    1052. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
          ^
    1053.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    1054. {

libavcodec/aacsbr.c:1081:9: Call
    1079. 
    1080.     if (sbr->reset)
    1081.         sbr_reset(ac, sbr);
                  ^
    1082. 
    1083.     if (sbr->start)

libavcodec/aacsbr.c:1031:1: Parameter `sbr->f_master[*]`
      1029. }
      1030. 
      1031. static void sbr_reset(AACContext *ac, SpectralBandReplication *sbr)
            ^
      1032. {
      1033.     int err;

libavcodec/aacsbr.c:1034:11: Call
      1032. {
      1033.     int err;
      1034.     err = sbr_make_f_master(ac, sbr, &sbr->spectrum_params);
                      ^
      1035.     if (err >= 0)
      1036.         err = sbr_make_f_derived(ac, sbr);

libavcodec/aacsbr.c:312:1: <LHS trace>
310. 
311. /// Master Frequency Band Table (14496-3 sp04 p194)
312. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
     ^
313.                              SpectrumParameters *spectrum)
314. {

libavcodec/aacsbr.c:312:1: Parameter `sbr->f_master[*]`
        310. 
        311. /// Master Frequency Band Table (14496-3 sp04 p194)
        312. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
             ^
        313.                              SpectrumParameters *spectrum)
        314. {

libavcodec/aacsbr.c:402:13: Binary operation: ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload` 
        400.         k2diff = sbr->k[2] - sbr->k[0] - sbr->n_master * dk;
        401.         if (k2diff < 0) {
        402.             sbr->f_master[1]--;
                         ^
        403.             sbr->f_master[2]-= (k2diff < -1);
        404.         } else if (k2diff) {
