libavcodec/aacdec.c:121: error: Buffer Overrun L2
  Offset: [`elem_id`, max(16, `elem_id`)] Size: 16.

libavcodec/aacdec.c:114:1: <Offset trace>
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aacdec.c:114:1: Parameter `elem_id`
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aacdec.c:114:1: <Length trace>
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aacdec.c:114:1: Parameter `ac->tags_seen_this_frame[*][*]`
112. static const char overread_err[] = "Input buffer exhausted before END element found\n";
113. 
114. static ChannelElement *get_che(AACContext *ac, int type, int elem_id)
     ^
115. {
116.     /* Some buggy encoders appear to set all elem_ids to zero and rely on

libavcodec/aacdec.c:121:12: Array access: Offset: [elem_id, max(16, elem_id)] Size: 16
119.     */
120.     int err_printed = 0;
121.     while (ac->tags_seen_this_frame[type][elem_id] && elem_id < MAX_ELEM_ID) {
                ^
122.         if (ac->output_configured < OC_LOCKED && !err_printed) {
123.             av_log(ac->avctx, AV_LOG_WARNING, "Duplicate channel tag found, attempting to remap.\n");
