libavcodec/aac.c:2032: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload`.

libavcodec/aac.c:1984:43: Call
1982.         elem_id = get_bits(&gb, 4);
1983. 
1984.         if (elem_type < TYPE_DSE && !(che=get_che(ac, elem_type, elem_id))) {
                                                ^
1985.             av_log(ac->avccontext, AV_LOG_ERROR, "channel element %d.%d is not allocated\n", elem_type, elem_id);
1986.             return -1;

libavcodec/aac.c:115:1: Parameter `*ac->tag_che_map[*][*]`
  113. static const char overread_err[] = "Input buffer exhausted before END element found\n";
  114. 
  115. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
       ^
  116. {
  117.     if (ac->tag_che_map[type][elem_id]) {

libavcodec/aac.c:2032:28: Call
2030.             }
2031.             while (elem_id > 0)
2032.                 elem_id -= decode_extension_payload(ac, &gb, elem_id, che_prev, elem_type_prev);
                                 ^
2033.             err = 0; /* FIXME */
2034.             break;

libavcodec/aac.c:1635:1: Parameter `che->sbr.f_master[*]`
  1633.  * @return Returns number of bytes consumed
  1634.  */
  1635. static int decode_extension_payload(AACContext *ac, GetBitContext *gb, int cnt,
        ^
  1636.                                     ChannelElement *che, enum RawDataBlockType elem_type)
  1637. {

libavcodec/aac.c:1658:15: Call
  1656.             ac->m4ac.sbr = 1;
  1657.         }
  1658.         res = ff_decode_sbr_extension(ac, &che->sbr, gb, crc_flag, cnt, elem_type);
                      ^
  1659.         break;
  1660.     case EXT_DYNAMIC_RANGE:

libavcodec/aacsbr.c:965:1: Parameter `sbr->f_master[*]`
    963.  * @return  Returns number of bytes consumed from the TYPE_FIL element.
    964.  */
    965. int ff_decode_sbr_extension(AACContext *ac, SpectralBandReplication *sbr,
         ^
    966.                             GetBitContext *gb_host, int crc, int cnt, int id_aac)
    967. {

libavcodec/aacsbr.c:994:9: Call
    992. 
    993.     if (sbr->reset)
    994.         sbr_reset(ac, sbr);
                 ^
    995. 
    996.     if (sbr->start)

libavcodec/aacsbr.c:944:1: Parameter `sbr->f_master[*]`
      942. }
      943. 
      944. static void sbr_reset(AACContext *ac, SpectralBandReplication *sbr)
           ^
      945. {
      946.     int err;

libavcodec/aacsbr.c:947:11: Call
      945. {
      946.     int err;
      947.     err = sbr_make_f_master(ac, sbr, &sbr->spectrum_params);
                     ^
      948.     if (err >= 0)
      949.         err = sbr_make_f_derived(ac, sbr);

libavcodec/aacsbr.c:311:1: <LHS trace>
309. 
310. /// Master Frequency Band Table (14496-3 sp04 p194)
311. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
     ^
312.                              SpectrumParameters *spectrum)
313. {

libavcodec/aacsbr.c:311:1: Parameter `sbr->f_master[*]`
        309. 
        310. /// Master Frequency Band Table (14496-3 sp04 p194)
        311. static int sbr_make_f_master(AACContext *ac, SpectralBandReplication *sbr,
             ^
        312.                              SpectrumParameters *spectrum)
        313. {

libavcodec/aacsbr.c:402:13: Binary operation: ([0, +oo] - 1):unsigned16 by call to `decode_extension_payload` 
        400.         k2diff = sbr->k[2] - sbr->k[0] - sbr->n_master * dk;
        401.         if (k2diff < 0) {
        402.             sbr->f_master[1]--;
                         ^
        403.             sbr->f_master[2]-= (k2diff < 1);
        404.         } else if (k2diff) {
