libavcodec/g2meet.c:563: error: Buffer Overrun L3
  Offset: 3 Size: [1, 2147483631].

libavcodec/g2meet.c:541:18: <Length trace>
539.     case 1: // old monochrome
540.         for (j = 0; j < c->cursor_h; j++) {
541.             for (i = 0; i < c->cursor_w; i += 32) {
                      ^
542.                 bits = bytestream2_get_be32(gb);
543.                 for (k = 0; k < 32; k++) {

libavcodec/g2meet.c:541:18: Assignment
539.     case 1: // old monochrome
540.         for (j = 0; j < c->cursor_h; j++) {
541.             for (i = 0; i < c->cursor_w; i += 32) {
                      ^
542.                 bits = bytestream2_get_be32(gb);
543.                 for (k = 0; k < 32; k++) {

libavcodec/g2meet.c:581:13: Assignment
579.                 }
580.             }
581.             dst += c->cursor_stride - c->cursor_w * 4;
                 ^
582.         }
583.         break;

libavcodec/g2meet.c:563:25: Array access: Offset: 3 Size: [1, 2147483631]
561.                         dst[1] = 0x00;
562.                         dst[2] = 0x00;
563.                         dst[3] = 0x00;
                             ^
564.                         break;
565.                     case 1:

static int g2m_load_cursor(AVCodecContext *avctx, G2MContext *c,
                           GetByteContext *gb)
{
    int i, j, k;
    uint8_t *dst;
    uint32_t bits;
    uint32_t cur_size, cursor_w, cursor_h, cursor_stride;
    uint32_t cursor_hot_x, cursor_hot_y;
    int cursor_fmt, err;
    cur_size     = bytestream2_get_be32(gb);
    cursor_w     = bytestream2_get_byte(gb);
    cursor_h     = bytestream2_get_byte(gb);
    cursor_hot_x = bytestream2_get_byte(gb);
    cursor_hot_y = bytestream2_get_byte(gb);
    cursor_fmt   = bytestream2_get_byte(gb);
    cursor_stride = FFALIGN(cursor_w, 32) * 4;
    if (cursor_w < 1 || cursor_w > 256 ||
        cursor_h < 1 || cursor_h > 256) {
        av_log(avctx, AV_LOG_ERROR, "Invalid cursor dimensions %dx%d\n",
               cursor_w, cursor_h);
        return AVERROR_INVALIDDATA;
    }
    if (cursor_hot_x > cursor_w || cursor_hot_y > cursor_h) {
        av_log(avctx, AV_LOG_WARNING, "Invalid hotspot position %d,%d\n",
               cursor_hot_x, cursor_hot_y);
        cursor_hot_x = FFMIN(cursor_hot_x, cursor_w - 1);
        cursor_hot_y = FFMIN(cursor_hot_y, cursor_h - 1);
    }
    if (cur_size - 9 > bytestream2_get_bytes_left(gb) ||
        c->cursor_w * c->cursor_h / 4 > cur_size) {
        av_log(avctx, AV_LOG_ERROR, "Invalid cursor data size %d/%d\n",
               cur_size, bytestream2_get_bytes_left(gb));
        return AVERROR_INVALIDDATA;
    }
    if (cursor_fmt != 1 && cursor_fmt != 32) {
        avpriv_report_missing_feature(avctx, "Cursor format %d",
                                      cursor_fmt);
        return AVERROR_PATCHWELCOME;
    }
    if ((err = av_reallocp(&c->cursor, cursor_stride * cursor_h)) < 0) {
        av_log(avctx, AV_LOG_ERROR, "Cannot allocate cursor buffer\n");
        return err;
    }
    c->cursor_w      = cursor_w;
    c->cursor_h      = cursor_h;
    c->cursor_hot_x  = cursor_hot_x;
    c->cursor_hot_y  = cursor_hot_y;
    c->cursor_fmt    = cursor_fmt;
    c->cursor_stride = cursor_stride;
    dst = c->cursor;
    switch (c->cursor_fmt) {
    case 1:
        for (j = 0; j < c->cursor_h; j++) {
            for (i = 0; i < c->cursor_w; i += 32) {
                bits = bytestream2_get_be32(gb);
                for (k = 0; k < 32; k++) {
                    dst[0] = !!(bits & 0x80000000);
                    dst   += 4;
                    bits <<= 1;
                }
            }
            dst += c->cursor_stride - c->cursor_w * 4;
        }
        dst = c->cursor;
        for (j = 0; j < c->cursor_h; j++) {
            for (i = 0; i < c->cursor_w; i += 32) {
                bits = bytestream2_get_be32(gb);
                for (k = 0; k < 32; k++) {
                    int mask_bit = !!(bits & 0x80000000);
                    switch (dst[0] * 2 + mask_bit) {
                    case 0:
                        dst[0] = 0xFF;
                        dst[1] = 0x00;
                        dst[2] = 0x00;
                        dst[3] = 0x00;
                        break;
                    case 1:
                        dst[0] = 0xFF;
                        dst[1] = 0xFF;
                        dst[2] = 0xFF;
                        dst[3] = 0xFF;
                        break;
                    default:
                        dst[0] = 0x00;
                        dst[1] = 0x00;
                        dst[2] = 0x00;
                        dst[3] = 0x00;
                    }
                    dst   += 4;
                    bits <<= 1;
                }
            }
            dst += c->cursor_stride - c->cursor_w * 4;
        }
        break;
    case 32:
        bytestream2_skip(gb, c->cursor_h * (FFALIGN(c->cursor_w, 32) >> 3));
        for (j = 0; j < c->cursor_h; j++) {
            for (i = 0; i < c->cursor_w; i++) {
                int val = bytestream2_get_be32(gb);
                *dst++ = val >>  0;
                *dst++ = val >>  8;
                *dst++ = val >> 16;
                *dst++ = val >> 24;
            }
            dst += c->cursor_stride - c->cursor_w * 4;
        }
        break;
    default:
        return AVERROR_PATCHWELCOME;
    }
    return 0;
}
['static int g2m_load_cursor(AVCodecContext *avctx, G2MContext *c,\n                           GetByteContext *gb)\n{\n    int i, j, k;\n    uint8_t *dst;\n    uint32_t bits;\n    uint32_t cur_size, cursor_w, cursor_h, cursor_stride;\n    uint32_t cursor_hot_x, cursor_hot_y;\n    int cursor_fmt, err;\n    cur_size     = bytestream2_get_be32(gb);\n    cursor_w     = bytestream2_get_byte(gb);\n    cursor_h     = bytestream2_get_byte(gb);\n    cursor_hot_x = bytestream2_get_byte(gb);\n    cursor_hot_y = bytestream2_get_byte(gb);\n    cursor_fmt   = bytestream2_get_byte(gb);\n    cursor_stride = FFALIGN(cursor_w, 32) * 4;\n    if (cursor_w < 1 || cursor_w > 256 ||\n        cursor_h < 1 || cursor_h > 256) {\n        av_log(avctx, AV_LOG_ERROR, "Invalid cursor dimensions %dx%d\\n",\n               cursor_w, cursor_h);\n        return AVERROR_INVALIDDATA;\n    }\n    if (cursor_hot_x > cursor_w || cursor_hot_y > cursor_h) {\n        av_log(avctx, AV_LOG_WARNING, "Invalid hotspot position %d,%d\\n",\n               cursor_hot_x, cursor_hot_y);\n        cursor_hot_x = FFMIN(cursor_hot_x, cursor_w - 1);\n        cursor_hot_y = FFMIN(cursor_hot_y, cursor_h - 1);\n    }\n    if (cur_size - 9 > bytestream2_get_bytes_left(gb) ||\n        c->cursor_w * c->cursor_h / 4 > cur_size) {\n        av_log(avctx, AV_LOG_ERROR, "Invalid cursor data size %d/%d\\n",\n               cur_size, bytestream2_get_bytes_left(gb));\n        return AVERROR_INVALIDDATA;\n    }\n    if (cursor_fmt != 1 && cursor_fmt != 32) {\n        avpriv_report_missing_feature(avctx, "Cursor format %d",\n                                      cursor_fmt);\n        return AVERROR_PATCHWELCOME;\n    }\n    if ((err = av_reallocp(&c->cursor, cursor_stride * cursor_h)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "Cannot allocate cursor buffer\\n");\n        return err;\n    }\n    c->cursor_w      = cursor_w;\n    c->cursor_h      = cursor_h;\n    c->cursor_hot_x  = cursor_hot_x;\n    c->cursor_hot_y  = cursor_hot_y;\n    c->cursor_fmt    = cursor_fmt;\n    c->cursor_stride = cursor_stride;\n    dst = c->cursor;\n    switch (c->cursor_fmt) {\n    case 1:\n        for (j = 0; j < c->cursor_h; j++) {\n            for (i = 0; i < c->cursor_w; i += 32) {\n                bits = bytestream2_get_be32(gb);\n                for (k = 0; k < 32; k++) {\n                    dst[0] = !!(bits & 0x80000000);\n                    dst   += 4;\n                    bits <<= 1;\n                }\n            }\n            dst += c->cursor_stride - c->cursor_w * 4;\n        }\n        dst = c->cursor;\n        for (j = 0; j < c->cursor_h; j++) {\n            for (i = 0; i < c->cursor_w; i += 32) {\n                bits = bytestream2_get_be32(gb);\n                for (k = 0; k < 32; k++) {\n                    int mask_bit = !!(bits & 0x80000000);\n                    switch (dst[0] * 2 + mask_bit) {\n                    case 0:\n                        dst[0] = 0xFF;\n                        dst[1] = 0x00;\n                        dst[2] = 0x00;\n                        dst[3] = 0x00;\n                        break;\n                    case 1:\n                        dst[0] = 0xFF;\n                        dst[1] = 0xFF;\n                        dst[2] = 0xFF;\n                        dst[3] = 0xFF;\n                        break;\n                    default:\n                        dst[0] = 0x00;\n                        dst[1] = 0x00;\n                        dst[2] = 0x00;\n                        dst[3] = 0x00;\n                    }\n                    dst   += 4;\n                    bits <<= 1;\n                }\n            }\n            dst += c->cursor_stride - c->cursor_w * 4;\n        }\n        break;\n    case 32:\n        bytestream2_skip(gb, c->cursor_h * (FFALIGN(c->cursor_w, 32) >> 3));\n        for (j = 0; j < c->cursor_h; j++) {\n            for (i = 0; i < c->cursor_w; i++) {\n                int val = bytestream2_get_be32(gb);\n                *dst++ = val >>  0;\n                *dst++ = val >>  8;\n                *dst++ = val >> 16;\n                *dst++ = val >> 24;\n            }\n            dst += c->cursor_stride - c->cursor_w * 4;\n        }\n        break;\n    default:\n        return AVERROR_PATCHWELCOME;\n    }\n    return 0;\n}']