libavformat/avidec.c:1267: error: Integer Overflow L2
  ([0, 255] - 48):unsigned32.

libavformat/avidec.c:1260:17: <LHS trace>
1258.     /* Read the entries and sort them in each stream component. */
1259.     for (i = 0; i < nb_index_entries; i++) {
1260.         tag   = avio_rl32(pb);
                      ^
1261.         flags = avio_rl32(pb);
1262.         pos   = avio_rl32(pb);

libavformat/avidec.c:1260:17: Call
1258.     /* Read the entries and sort them in each stream component. */
1259.     for (i = 0; i < nb_index_entries; i++) {
1260.         tag   = avio_rl32(pb);
                      ^
1261.         flags = avio_rl32(pb);
1262.         pos   = avio_rl32(pb);

libavformat/aviobuf.c:549:11: Call
  547. {
  548.     unsigned int val;
  549.     val = avio_rl16(s);
                 ^
  550.     val |= avio_rl16(s) << 16;
  551.     return val;

libavformat/aviobuf.c:533:11: Call
    531. {
    532.     unsigned int val;
    533.     val = avio_r8(s);
                   ^
    534.     val |= avio_r8(s) << 8;
    535.     return val;

libavformat/aviobuf.c:443:5: Assignment
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
      443.     return 0;
               ^
      444. }
      445. 

libavformat/aviobuf.c:533:5: Assignment
    531. {
    532.     unsigned int val;
    533.     val = avio_r8(s);
             ^
    534.     val |= avio_r8(s) << 8;
    535.     return val;

libavformat/aviobuf.c:534:5: Assignment
    532.     unsigned int val;
    533.     val = avio_r8(s);
    534.     val |= avio_r8(s) << 8;
             ^
    535.     return val;
    536. }

libavformat/aviobuf.c:535:5: Assignment
    533.     val = avio_r8(s);
    534.     val |= avio_r8(s) << 8;
    535.     return val;
             ^
    536. }
    537. 

libavformat/aviobuf.c:549:5: Assignment
  547. {
  548.     unsigned int val;
  549.     val = avio_rl16(s);
           ^
  550.     val |= avio_rl16(s) << 16;
  551.     return val;

libavformat/aviobuf.c:550:5: Assignment
  548.     unsigned int val;
  549.     val = avio_rl16(s);
  550.     val |= avio_rl16(s) << 16;
           ^
  551.     return val;
  552. }

libavformat/aviobuf.c:551:5: Assignment
  549.     val = avio_rl16(s);
  550.     val |= avio_rl16(s) << 16;
  551.     return val;
           ^
  552. }
  553. 

libavformat/avidec.c:1260:9: Assignment
1258.     /* Read the entries and sort them in each stream component. */
1259.     for (i = 0; i < nb_index_entries; i++) {
1260.         tag   = avio_rl32(pb);
              ^
1261.         flags = avio_rl32(pb);
1262.         pos   = avio_rl32(pb);

libavformat/avidec.c:1267:9: Binary operation: ([0, 255] - 48):unsigned32
1265.                 i, tag, flags, pos, len);
1266. 
1267.         index  = ((tag      & 0xff) - '0') * 10;
              ^
1268.         index +=  (tag >> 8 & 0xff) - '0';
1269.         if (index >= s->nb_streams)

static int avi_read_idx1(AVFormatContext *s, int size)
{
    AVIContext *avi = s->priv_data;
    AVIOContext *pb = s->pb;
    int nb_index_entries, i;
    AVStream *st;
    AVIStream *ast;
    unsigned int index, tag, flags, pos, len, first_packet = 1;
    unsigned last_pos = -1;
    int64_t idx1_pos, first_packet_pos = 0, data_offset = 0;
    nb_index_entries = size / 16;
    if (nb_index_entries <= 0)
        return AVERROR_INVALIDDATA;
    idx1_pos = avio_tell(pb);
    avio_seek(pb, avi->movi_list + 4, SEEK_SET);
    if (avi_sync(s, 1) == 0)
        first_packet_pos = avio_tell(pb) - 8;
    avi->stream_index = -1;
    avio_seek(pb, idx1_pos, SEEK_SET);
    for (i = 0; i < nb_index_entries; i++) {
        tag   = avio_rl32(pb);
        flags = avio_rl32(pb);
        pos   = avio_rl32(pb);
        len   = avio_rl32(pb);
        av_dlog(s, "%d: tag=0x%x flags=0x%x pos=0x%x len=%d/",
                i, tag, flags, pos, len);
        index  = ((tag      & 0xff) - '0') * 10;
        index +=  (tag >> 8 & 0xff) - '0';
        if (index >= s->nb_streams)
            continue;
        st  = s->streams[index];
        ast = st->priv_data;
        if (first_packet && first_packet_pos && len) {
            data_offset  = first_packet_pos - pos;
            first_packet = 0;
        }
        pos += data_offset;
        av_dlog(s, "%d cum_len=%"PRId64"\n", len, ast->cum_len);
        if (pb->eof_reached)
            return AVERROR_INVALIDDATA;
        if (last_pos == pos)
            avi->non_interleaved = 1;
        else if (len || !ast->sample_size)
            av_add_index_entry(st, pos, ast->cum_len, len, 0,
                               (flags & AVIIF_INDEX) ? AVINDEX_KEYFRAME : 0);
        ast->cum_len += get_duration(ast, len);
        last_pos      = pos;
    }
    return 0;
}
['static int avi_read_idx1(AVFormatContext *s, int size)\n{\n    AVIContext *avi = s->priv_data;\n    AVIOContext *pb = s->pb;\n    int nb_index_entries, i;\n    AVStream *st;\n    AVIStream *ast;\n    unsigned int index, tag, flags, pos, len, first_packet = 1;\n    unsigned last_pos = -1;\n    int64_t idx1_pos, first_packet_pos = 0, data_offset = 0;\n    nb_index_entries = size / 16;\n    if (nb_index_entries <= 0)\n        return AVERROR_INVALIDDATA;\n    idx1_pos = avio_tell(pb);\n    avio_seek(pb, avi->movi_list + 4, SEEK_SET);\n    if (avi_sync(s, 1) == 0)\n        first_packet_pos = avio_tell(pb) - 8;\n    avi->stream_index = -1;\n    avio_seek(pb, idx1_pos, SEEK_SET);\n    for (i = 0; i < nb_index_entries; i++) {\n        tag   = avio_rl32(pb);\n        flags = avio_rl32(pb);\n        pos   = avio_rl32(pb);\n        len   = avio_rl32(pb);\n        av_dlog(s, "%d: tag=0x%x flags=0x%x pos=0x%x len=%d/",\n                i, tag, flags, pos, len);\n        index  = ((tag      & 0xff) - \'0\') * 10;\n        index +=  (tag >> 8 & 0xff) - \'0\';\n        if (index >= s->nb_streams)\n            continue;\n        st  = s->streams[index];\n        ast = st->priv_data;\n        if (first_packet && first_packet_pos && len) {\n            data_offset  = first_packet_pos - pos;\n            first_packet = 0;\n        }\n        pos += data_offset;\n        av_dlog(s, "%d cum_len=%"PRId64"\\n", len, ast->cum_len);\n        if (pb->eof_reached)\n            return AVERROR_INVALIDDATA;\n        if (last_pos == pos)\n            avi->non_interleaved = 1;\n        else if (len || !ast->sample_size)\n            av_add_index_entry(st, pos, ast->cum_len, len, 0,\n                               (flags & AVIIF_INDEX) ? AVINDEX_KEYFRAME : 0);\n        ast->cum_len += get_duration(ast, len);\n        last_pos      = pos;\n    }\n    return 0;\n}', 'unsigned int avio_rl32(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rl16(s);\n    val |= avio_rl16(s) << 16;\n    return val;\n}', 'unsigned int avio_rl16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s);\n    val |= avio_r8(s) << 8;\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}']