libavcodec/flicvideo.c:537: error: Integer Overflow L2
  ([min(0, `buf->l`), max(0, `buf->l`)] - 6):unsigned32.

libavcodec/flicvideo.c:428:1: <LHS trace>
426. }
427. 
428. static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     ^
429.                                       void *data, int *data_size,
430.                                       const uint8_t *buf, int buf_size)

libavcodec/flicvideo.c:428:1: Parameter `buf->l`
426. }
427. 
428. static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
     ^
429.                                       void *data, int *data_size,
430.                                       const uint8_t *buf, int buf_size)

libavcodec/flicvideo.c:480:22: Call
478.     /* iterate through the chunks */
479.     while ((frame_size > 0) && (num_chunks > 0)) {
480.         chunk_size = bytestream2_get_le32(&g2);
                          ^
481.         chunk_type = bytestream2_get_le16(&g2);
482. 

libavcodec/bytestream.h:65:1: Assignment
  63. 
  64. DEF64(le64, 8, AV_RL64, AV_WL64)
  65. DEF  (le32, 4, AV_RL32, AV_WL32)
      ^
  66. DEF  (le24, 3, AV_RL24, AV_WL24)
  67. DEF  (le16, 2, AV_RL16, AV_WL16)

libavcodec/flicvideo.c:480:9: Assignment
478.     /* iterate through the chunks */
479.     while ((frame_size > 0) && (num_chunks > 0)) {
480.         chunk_size = bytestream2_get_le32(&g2);
             ^
481.         chunk_type = bytestream2_get_le16(&g2);
482. 

libavcodec/flicvideo.c:537:13: Binary operation: ([min(0, buf->l), max(0, buf->l)] - 6):unsigned32
535.         case FLI_LC:
536.             av_log(avctx, AV_LOG_ERROR, "Unexpected FLI_LC chunk in non-paletised FLC\n");
537.             bytestream2_skip(&g2, chunk_size - 6);
                 ^
538.             break;
539. 

static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,
                                      void *data, int *data_size,
                                      const uint8_t *buf, int buf_size)
{
    FlicDecodeContext *s = avctx->priv_data;
    GetByteContext g2;
    int pixel_ptr;
    unsigned char palette_idx1;
    unsigned int frame_size;
    int num_chunks;
    unsigned int chunk_size;
    int chunk_type;
    int i, j;
    int lines;
    int compressed_lines;
    signed short line_packets;
    int y_ptr;
    int byte_run;
    int pixel_skip;
    int pixel_countdown;
    unsigned char *pixels;
    int pixel;
    unsigned int pixel_limit;
    bytestream2_init(&g2, buf, buf_size);
    s->frame.reference = 1;
    s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
    if (avctx->reget_buffer(avctx, &s->frame) < 0) {
        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
        return -1;
    }
    pixels = s->frame.data[0];
    pixel_limit = s->avctx->height * s->frame.linesize[0];
    frame_size = bytestream2_get_le32(&g2);
    bytestream2_skip(&g2, 2);
    num_chunks = bytestream2_get_le16(&g2);
    bytestream2_skip(&g2, 8);
    frame_size -= 16;
    while ((frame_size > 0) && (num_chunks > 0)) {
        chunk_size = bytestream2_get_le32(&g2);
        chunk_type = bytestream2_get_le16(&g2);
        switch (chunk_type) {
        case FLI_256_COLOR:
        case FLI_COLOR:
            bytestream2_skip(&g2, chunk_size - 6);
            break;
        case FLI_DELTA:
        case FLI_DTA_LC:
            y_ptr = 0;
            compressed_lines = bytestream2_get_le16(&g2);
            while (compressed_lines > 0) {
                line_packets = bytestream2_get_le16(&g2);
                if (line_packets < 0) {
                    line_packets = -line_packets;
                    y_ptr += line_packets * s->frame.linesize[0];
                } else {
                    compressed_lines--;
                    pixel_ptr = y_ptr;
                    CHECK_PIXEL_PTR(0);
                    pixel_countdown = s->avctx->width;
                    for (i = 0; i < line_packets; i++) {
                        pixel_skip = bytestream2_get_byte(&g2);
                        pixel_ptr += (pixel_skip*2);
                        pixel_countdown -= pixel_skip;
                        byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                        if (byte_run < 0) {
                            byte_run = -byte_run;
                            pixel    = bytestream2_get_le16(&g2);
                            CHECK_PIXEL_PTR(2 * byte_run);
                            for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
                                *((signed short*)(&pixels[pixel_ptr])) = pixel;
                                pixel_ptr += 2;
                            }
                        } else {
                            CHECK_PIXEL_PTR(2 * byte_run);
                            for (j = 0; j < byte_run; j++, pixel_countdown--) {
                                *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);
                                pixel_ptr += 2;
                            }
                        }
                    }
                    y_ptr += s->frame.linesize[0];
                }
            }
            break;
        case FLI_LC:
            av_log(avctx, AV_LOG_ERROR, "Unexpected FLI_LC chunk in non-paletised FLC\n");
            bytestream2_skip(&g2, chunk_size - 6);
            break;
        case FLI_BLACK:
            memset(pixels, 0x0000,
                   s->frame.linesize[0] * s->avctx->height);
            break;
        case FLI_BRUN:
            y_ptr = 0;
            for (lines = 0; lines < s->avctx->height; lines++) {
                pixel_ptr = y_ptr;
                bytestream2_skip(&g2, 1);
                pixel_countdown = (s->avctx->width * 2);
                while (pixel_countdown > 0) {
                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                    if (byte_run > 0) {
                        palette_idx1 = bytestream2_get_byte(&g2);
                        CHECK_PIXEL_PTR(byte_run);
                        for (j = 0; j < byte_run; j++) {
                            pixels[pixel_ptr++] = palette_idx1;
                            pixel_countdown--;
                            if (pixel_countdown < 0)
                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) (linea%d)\n",
                                       pixel_countdown, lines);
                        }
                    } else {
                        byte_run = -byte_run;
                        CHECK_PIXEL_PTR(byte_run);
                        for (j = 0; j < byte_run; j++) {
                            palette_idx1 = bytestream2_get_byte(&g2);
                            pixels[pixel_ptr++] = palette_idx1;
                            pixel_countdown--;
                            if (pixel_countdown < 0)
                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\n",
                                       pixel_countdown, lines);
                        }
                    }
                }
#if HAVE_BIGENDIAN
                pixel_ptr = y_ptr;
                pixel_countdown = s->avctx->width;
                while (pixel_countdown > 0) {
                    *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[pixel_ptr]);
                    pixel_ptr += 2;
                }
#endif
                y_ptr += s->frame.linesize[0];
            }
            break;
        case FLI_DTA_BRUN:
            y_ptr = 0;
            for (lines = 0; lines < s->avctx->height; lines++) {
                pixel_ptr = y_ptr;
                bytestream2_skip(&g2, 1);
                pixel_countdown = s->avctx->width;
                while (pixel_countdown > 0) {
                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                    if (byte_run > 0) {
                        pixel    = bytestream2_get_le16(&g2);
                        CHECK_PIXEL_PTR(2 * byte_run);
                        for (j = 0; j < byte_run; j++) {
                            *((signed short*)(&pixels[pixel_ptr])) = pixel;
                            pixel_ptr += 2;
                            pixel_countdown--;
                            if (pixel_countdown < 0)
                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d)\n",
                                       pixel_countdown);
                        }
                    } else {
                        byte_run = -byte_run;
                        CHECK_PIXEL_PTR(2 * byte_run);
                        for (j = 0; j < byte_run; j++) {
                            *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);
                            pixel_ptr  += 2;
                            pixel_countdown--;
                            if (pixel_countdown < 0)
                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d)\n",
                                       pixel_countdown);
                        }
                    }
                }
                y_ptr += s->frame.linesize[0];
            }
            break;
        case FLI_COPY:
        case FLI_DTA_COPY:
            if (chunk_size - 6 > (unsigned int)(s->avctx->width * s->avctx->height)*2) {
                av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \
                       "bigger than image, skipping chunk\n", chunk_size - 6);
                bytestream2_skip(&g2, chunk_size - 6);
            } else {
                for (y_ptr = 0; y_ptr < s->frame.linesize[0] * s->avctx->height;
                     y_ptr += s->frame.linesize[0]) {
                    pixel_countdown = s->avctx->width;
                    pixel_ptr = 0;
                    while (pixel_countdown > 0) {
                      *((signed short*)(&pixels[y_ptr + pixel_ptr])) = bytestream2_get_le16(&g2);
                      pixel_ptr += 2;
                      pixel_countdown--;
                    }
                }
            }
            break;
        case FLI_MINI:
            bytestream2_skip(&g2, chunk_size - 6);
            break;
        default:
            av_log(avctx, AV_LOG_ERROR, "Unrecognized chunk type: %d\n", chunk_type);
            break;
        }
        frame_size -= chunk_size;
        num_chunks--;
    }
    if ((bytestream2_get_bytes_left(&g2) != 0) && (bytestream2_get_bytes_left(&g2) != 1))
        av_log(avctx, AV_LOG_ERROR, "Processed FLI chunk where chunk size = %d " \
               "and final chunk ptr = %d\n", buf_size, bytestream2_tell(&g2));
    *data_size=sizeof(AVFrame);
    *(AVFrame*)data = s->frame;
    return buf_size;
}
['static int flic_decode_frame_15_16BPP(AVCodecContext *avctx,\n                                      void *data, int *data_size,\n                                      const uint8_t *buf, int buf_size)\n{\n    FlicDecodeContext *s = avctx->priv_data;\n    GetByteContext g2;\n    int pixel_ptr;\n    unsigned char palette_idx1;\n    unsigned int frame_size;\n    int num_chunks;\n    unsigned int chunk_size;\n    int chunk_type;\n    int i, j;\n    int lines;\n    int compressed_lines;\n    signed short line_packets;\n    int y_ptr;\n    int byte_run;\n    int pixel_skip;\n    int pixel_countdown;\n    unsigned char *pixels;\n    int pixel;\n    unsigned int pixel_limit;\n    bytestream2_init(&g2, buf, buf_size);\n    s->frame.reference = 1;\n    s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;\n    if (avctx->reget_buffer(avctx, &s->frame) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\\n");\n        return -1;\n    }\n    pixels = s->frame.data[0];\n    pixel_limit = s->avctx->height * s->frame.linesize[0];\n    frame_size = bytestream2_get_le32(&g2);\n    bytestream2_skip(&g2, 2);\n    num_chunks = bytestream2_get_le16(&g2);\n    bytestream2_skip(&g2, 8);\n    frame_size -= 16;\n    while ((frame_size > 0) && (num_chunks > 0)) {\n        chunk_size = bytestream2_get_le32(&g2);\n        chunk_type = bytestream2_get_le16(&g2);\n        switch (chunk_type) {\n        case FLI_256_COLOR:\n        case FLI_COLOR:\n            bytestream2_skip(&g2, chunk_size - 6);\n            break;\n        case FLI_DELTA:\n        case FLI_DTA_LC:\n            y_ptr = 0;\n            compressed_lines = bytestream2_get_le16(&g2);\n            while (compressed_lines > 0) {\n                line_packets = bytestream2_get_le16(&g2);\n                if (line_packets < 0) {\n                    line_packets = -line_packets;\n                    y_ptr += line_packets * s->frame.linesize[0];\n                } else {\n                    compressed_lines--;\n                    pixel_ptr = y_ptr;\n                    CHECK_PIXEL_PTR(0);\n                    pixel_countdown = s->avctx->width;\n                    for (i = 0; i < line_packets; i++) {\n                        pixel_skip = bytestream2_get_byte(&g2);\n                        pixel_ptr += (pixel_skip*2);\n                        pixel_countdown -= pixel_skip;\n                        byte_run = sign_extend(bytestream2_get_byte(&g2), 8);\n                        if (byte_run < 0) {\n                            byte_run = -byte_run;\n                            pixel    = bytestream2_get_le16(&g2);\n                            CHECK_PIXEL_PTR(2 * byte_run);\n                            for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {\n                                *((signed short*)(&pixels[pixel_ptr])) = pixel;\n                                pixel_ptr += 2;\n                            }\n                        } else {\n                            CHECK_PIXEL_PTR(2 * byte_run);\n                            for (j = 0; j < byte_run; j++, pixel_countdown--) {\n                                *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);\n                                pixel_ptr += 2;\n                            }\n                        }\n                    }\n                    y_ptr += s->frame.linesize[0];\n                }\n            }\n            break;\n        case FLI_LC:\n            av_log(avctx, AV_LOG_ERROR, "Unexpected FLI_LC chunk in non-paletised FLC\\n");\n            bytestream2_skip(&g2, chunk_size - 6);\n            break;\n        case FLI_BLACK:\n            memset(pixels, 0x0000,\n                   s->frame.linesize[0] * s->avctx->height);\n            break;\n        case FLI_BRUN:\n            y_ptr = 0;\n            for (lines = 0; lines < s->avctx->height; lines++) {\n                pixel_ptr = y_ptr;\n                bytestream2_skip(&g2, 1);\n                pixel_countdown = (s->avctx->width * 2);\n                while (pixel_countdown > 0) {\n                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);\n                    if (byte_run > 0) {\n                        palette_idx1 = bytestream2_get_byte(&g2);\n                        CHECK_PIXEL_PTR(byte_run);\n                        for (j = 0; j < byte_run; j++) {\n                            pixels[pixel_ptr++] = palette_idx1;\n                            pixel_countdown--;\n                            if (pixel_countdown < 0)\n                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) (linea%d)\\n",\n                                       pixel_countdown, lines);\n                        }\n                    } else {\n                        byte_run = -byte_run;\n                        CHECK_PIXEL_PTR(byte_run);\n                        for (j = 0; j < byte_run; j++) {\n                            palette_idx1 = bytestream2_get_byte(&g2);\n                            pixels[pixel_ptr++] = palette_idx1;\n                            pixel_countdown--;\n                            if (pixel_countdown < 0)\n                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\\n",\n                                       pixel_countdown, lines);\n                        }\n                    }\n                }\n#if HAVE_BIGENDIAN\n                pixel_ptr = y_ptr;\n                pixel_countdown = s->avctx->width;\n                while (pixel_countdown > 0) {\n                    *((signed short*)(&pixels[pixel_ptr])) = AV_RL16(&buf[pixel_ptr]);\n                    pixel_ptr += 2;\n                }\n#endif\n                y_ptr += s->frame.linesize[0];\n            }\n            break;\n        case FLI_DTA_BRUN:\n            y_ptr = 0;\n            for (lines = 0; lines < s->avctx->height; lines++) {\n                pixel_ptr = y_ptr;\n                bytestream2_skip(&g2, 1);\n                pixel_countdown = s->avctx->width;\n                while (pixel_countdown > 0) {\n                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);\n                    if (byte_run > 0) {\n                        pixel    = bytestream2_get_le16(&g2);\n                        CHECK_PIXEL_PTR(2 * byte_run);\n                        for (j = 0; j < byte_run; j++) {\n                            *((signed short*)(&pixels[pixel_ptr])) = pixel;\n                            pixel_ptr += 2;\n                            pixel_countdown--;\n                            if (pixel_countdown < 0)\n                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d)\\n",\n                                       pixel_countdown);\n                        }\n                    } else {\n                        byte_run = -byte_run;\n                        CHECK_PIXEL_PTR(2 * byte_run);\n                        for (j = 0; j < byte_run; j++) {\n                            *((signed short*)(&pixels[pixel_ptr])) = bytestream2_get_le16(&g2);\n                            pixel_ptr  += 2;\n                            pixel_countdown--;\n                            if (pixel_countdown < 0)\n                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d)\\n",\n                                       pixel_countdown);\n                        }\n                    }\n                }\n                y_ptr += s->frame.linesize[0];\n            }\n            break;\n        case FLI_COPY:\n        case FLI_DTA_COPY:\n            if (chunk_size - 6 > (unsigned int)(s->avctx->width * s->avctx->height)*2) {\n                av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \\\n                       "bigger than image, skipping chunk\\n", chunk_size - 6);\n                bytestream2_skip(&g2, chunk_size - 6);\n            } else {\n                for (y_ptr = 0; y_ptr < s->frame.linesize[0] * s->avctx->height;\n                     y_ptr += s->frame.linesize[0]) {\n                    pixel_countdown = s->avctx->width;\n                    pixel_ptr = 0;\n                    while (pixel_countdown > 0) {\n                      *((signed short*)(&pixels[y_ptr + pixel_ptr])) = bytestream2_get_le16(&g2);\n                      pixel_ptr += 2;\n                      pixel_countdown--;\n                    }\n                }\n            }\n            break;\n        case FLI_MINI:\n            bytestream2_skip(&g2, chunk_size - 6);\n            break;\n        default:\n            av_log(avctx, AV_LOG_ERROR, "Unrecognized chunk type: %d\\n", chunk_type);\n            break;\n        }\n        frame_size -= chunk_size;\n        num_chunks--;\n    }\n    if ((bytestream2_get_bytes_left(&g2) != 0) && (bytestream2_get_bytes_left(&g2) != 1))\n        av_log(avctx, AV_LOG_ERROR, "Processed FLI chunk where chunk size = %d " \\\n               "and final chunk ptr = %d\\n", buf_size, bytestream2_tell(&g2));\n    *data_size=sizeof(AVFrame);\n    *(AVFrame*)data = s->frame;\n    return buf_size;\n}', 'DEF  (le32, 4, AV_RL32, AV_WL32)']