AAC encoder: fix OOB access in search_for_pns

Fix OOB access in search_for_pns which was using
w2 outside the window group loop, and fix a typo
in which it was checking sf_idx instead of band_type

Reviewed-by: Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>

libavcodec/aaccoder.c

@@ -711,7 +711,7 @@ static void search_for_pns(AACEncContext *s, AVCodecContext *avctx, SingleChanne
                 /* Estimate rd on average as 5 bits for SF, 4 for the CB, plus spread energy * lambda/thr */
                 dist2 += band->energy/(band->spread*band->spread)*lambda*dist_thresh/band->threshold;
             }
-            if (g && sce->sf_idx[(w+w2)*16+g-1] == NOISE_BT) {
+            if (g && sce->band_type[w*16+g-1] == NOISE_BT) {
                 dist2 += 5;
             } else {
                 dist2 += 9;