libavcodec/motionpixels.c:292: error: Integer Overflow L2
  ([1, +oo] - 12):unsigned32 by call to `bitstream_read`.

libavcodec/motionpixels.c:292:18: Call
290.     memset(mp->changes_map, 0, avctx->width * avctx->height);
291.     for (i = !(avctx->extradata[1] & 2); i < 2; ++i) {
292.         count1 = bitstream_read(&bc, 12);
                      ^
293.         count2 = bitstream_read(&bc, 12);
294.         mp_read_changes_map(mp, &bc, count1, 8, i);

libavcodec/bitstream.h:183:1: Parameter `n`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/bitstream.h:194:12: Call
  192.     }
  193. 
  194.     return get_val(bc, n);
                  ^
  195. }
  196. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([1, +oo] - 12):unsigned32 by call to `bitstream_read` 
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int mp_decode_frame(AVCodecContext *avctx,\n                                 void *data, int *got_frame,\n                                 AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    MotionPixelsContext *mp = avctx->priv_data;\n    BitstreamContext bc;\n    int i, count1, count2, sz, ret;\n    if ((ret = ff_reget_buffer(avctx, mp->frame)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\\n");\n        return ret;\n    }\n    av_fast_malloc(&mp->bswapbuf, &mp->bswapbuf_size, buf_size + AV_INPUT_BUFFER_PADDING_SIZE);\n    if (!mp->bswapbuf)\n        return AVERROR(ENOMEM);\n    mp->bdsp.bswap_buf((uint32_t *) mp->bswapbuf, (const uint32_t *) buf,\n                       buf_size / 4);\n    if (buf_size & 3)\n        memcpy(mp->bswapbuf + (buf_size & ~3), buf + (buf_size & ~3), buf_size & 3);\n    memset(mp->bswapbuf + buf_size, 0, AV_INPUT_BUFFER_PADDING_SIZE);\n    bitstream_init(&bc, mp->bswapbuf, buf_size * 8);\n    memset(mp->changes_map, 0, avctx->width * avctx->height);\n    for (i = !(avctx->extradata[1] & 2); i < 2; ++i) {\n        count1 = bitstream_read(&bc, 12);\n        count2 = bitstream_read(&bc, 12);\n        mp_read_changes_map(mp, &bc, count1, 8, i);\n        mp_read_changes_map(mp, &bc, count2, 4, i);\n    }\n    mp->codes_count = bitstream_read(&bc, 4);\n    if (mp->codes_count == 0)\n        goto end;\n    if (mp->changes_map[0] == 0) {\n        *(uint16_t *)mp->frame->data[0] = bitstream_read(&bc, 15);\n        mp->changes_map[0] = 1;\n    }\n    mp_read_codes_table(mp, &bc);\n    sz = bitstream_read(&bc, 18);\n    if (avctx->extradata[0] != 5)\n        sz += bitstream_read(&bc, 18);\n    if (sz == 0)\n        goto end;\n    if (mp->max_codes_bits <= 0)\n        goto end;\n    if (init_vlc(&mp->vlc, mp->max_codes_bits, mp->codes_count, &mp->codes[0].size, sizeof(HuffCode), 1, &mp->codes[0].code, sizeof(HuffCode), 4, 0))\n        goto end;\n    mp_decode_frame_helper(mp, &bc);\n    ff_free_vlc(&mp->vlc);\nend:\n    if ((ret = av_frame_ref(data, mp->frame)) < 0)\n        return ret;\n    *got_frame       = 1;\n    return buf_size;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']