libavcodec/amrwbdec.c:524: error: Buffer Overrun L1
  Offset: [5, 8] Size: 4 by call to `decode_6p_track`.

libavcodec/amrwbdec.c:476:1: Array declaration
474.  * @param[in]  mode                Mode of the current frame
475.  */
476. static void decode_fixed_vector(float *fixed_vector, const uint16_t *pulse_hi,
     ^
477.                                 const uint16_t *pulse_lo, const enum Mode mode)
478. {

libavcodec/amrwbdec.c:524:13: Call
522.     case MODE_23k85:
523.         for (i = 0; i < 4; i++)
524.             decode_6p_track(sig_pos[i], (int) pulse_lo[i] +
                 ^
525.                            ((int) pulse_hi[i] << 11), 4, 1);
526.         break;

libavcodec/amrwbdec.c:432:1: Parameter `*out`
  430. }
  431. 
  432. static void decode_6p_track(int *out, int code, int m, int off) ///code: 6m-2 bits
       ^
  433. {
  434.     int b_offset = 1 << (m - 1);

libavcodec/amrwbdec.c:455:9: Call
  453.         decode_2p_track(out, BIT_STR(code, 0, 2*m - 1),
  454.                         m - 1, off + half_other);
  455.         decode_4p_track(out + 2, BIT_STR(code, 2*m - 1, 4*m - 4),
               ^
  456.                         m - 1, off + half_more);
  457.         break;

libavcodec/amrwbdec.c:386:1: Parameter `*out`
    384. }
    385. 
    386. static void decode_4p_track(int *out, int code, int m, int off) ///code: 4m bits
         ^
    387. {
    388.     int half_4p, subhalf_2p;

libavcodec/amrwbdec.c:404:9: Call
    402.         decode_1p_track(out, BIT_STR(code,  3*m - 2, m),
    403.                         m - 1, off);
    404.         decode_3p_track(out + 1, BIT_STR(code, 0, 3*m - 2),
                 ^
    405.                         m - 1, off + b_offset);
    406.         break;

libavcodec/amrwbdec.c:377:1: Parameter `*out`
      375. }
      376. 
      377. static void decode_3p_track(int *out, int code, int m, int off) ///code: 3m+1 bits
           ^
      378. {
      379.     int half_2p = BIT_POS(code, 2*m - 1) << (m - 1);

libavcodec/amrwbdec.c:383:5: Call
      381.     decode_2p_track(out, BIT_STR(code, 0, 2*m - 1),
      382.                     m - 1, off + half_2p);
      383.     decode_1p_track(out + 2, BIT_STR(code, 2*m, m + 1), m, off);
               ^
      384. }
      385. 

libavcodec/amrwbdec.c:360:1: <Length trace>
358.  * @param[in]  off                 Offset for decoded positions
359.  */
360. static inline void decode_1p_track(int *out, int code, int m, int off)
     ^
361. {
362.     int pos = BIT_STR(code, 0, m) + off; ///code: m+1 bits

libavcodec/amrwbdec.c:360:1: Parameter `*out`
        358.  * @param[in]  off                 Offset for decoded positions
        359.  */
        360. static inline void decode_1p_track(int *out, int code, int m, int off)
             ^
        361. {
        362.     int pos = BIT_STR(code, 0, m) + off; ///code: m+1 bits

libavcodec/amrwbdec.c:364:5: Array access: Offset: [5, 8] Size: 4 by call to `decode_6p_track` 
        362.     int pos = BIT_STR(code, 0, m) + off; ///code: m+1 bits
        363. 
        364.     out[0] = BIT_POS(code, m) ? -pos : pos;
                 ^
        365. }
        366. 
