libavformat/nutdec.c:543: error: Integer Overflow L1
  ([-oo, -8] - [0, +oo]):unsigned64.

libavformat/nutdec.c:537:31: <LHS trace>
535.     int ret;
536. 
537.     nut->last_syncpoint_pos = avio_tell(bc) - 8;
                                   ^
538. 
539.     end  = get_packetheader(nut, bc, 1, SYNCPOINT_STARTCODE);

libavformat/nutdec.c:537:31: Call
535.     int ret;
536. 
537.     nut->last_syncpoint_pos = avio_tell(bc) - 8;
                                   ^
538. 
539.     end  = get_packetheader(nut, bc, 1, SYNCPOINT_STARTCODE);

libavformat/avio.h:221:12: Call
  219. static av_always_inline int64_t avio_tell(AVIOContext *s)
  220. {
  221.     return avio_seek(s, 0, SEEK_CUR);
                  ^
  222. }
  223. 

libavformat/aviobuf.c:194:9: Assignment
    192. 
    193.     if(!s)
    194.         return AVERROR(EINVAL);
                 ^
    195. 
    196.     pos = s->pos - (s->write_flag ? 0 : (s->buf_end - s->buffer));

libavformat/avio.h:221:5: Assignment
  219. static av_always_inline int64_t avio_tell(AVIOContext *s)
  220. {
  221.     return avio_seek(s, 0, SEEK_CUR);
           ^
  222. }
  223. 

libavformat/nutdec.c:537:5: Assignment
535.     int ret;
536. 
537.     nut->last_syncpoint_pos = avio_tell(bc) - 8;
         ^
538. 
539.     end  = get_packetheader(nut, bc, 1, SYNCPOINT_STARTCODE);

libavformat/nutdec.c:543:48: <RHS trace>
541. 
542.     tmp       = ffio_read_varlen(bc);
543.     *back_ptr = nut->last_syncpoint_pos - 16 * ffio_read_varlen(bc);
                                                    ^
544.     if (*back_ptr < 0)
545.         return -1;

libavformat/nutdec.c:543:48: Call
541. 
542.     tmp       = ffio_read_varlen(bc);
543.     *back_ptr = nut->last_syncpoint_pos - 16 * ffio_read_varlen(bc);
                                                    ^
544.     if (*back_ptr < 0)
545.         return -1;

libavformat/aviobuf.c:663:5: Assignment
  661. 
  662. uint64_t ffio_read_varlen(AVIOContext *bc){
  663.     uint64_t val = 0;
           ^
  664.     int tmp;
  665. 

libavformat/aviobuf.c:668:9: Assignment
  666.     do{
  667.         tmp = avio_r8(bc);
  668.         val= (val<<7) + (tmp&127);
               ^
  669.     }while(tmp&128);
  670.     return val;

libavformat/aviobuf.c:670:5: Assignment
  668.         val= (val<<7) + (tmp&127);
  669.     }while(tmp&128);
  670.     return val;
           ^
  671. }
  672. 

libavformat/nutdec.c:543:5: Binary operation: ([-oo, -8] - [0, +oo]):unsigned64
541. 
542.     tmp       = ffio_read_varlen(bc);
543.     *back_ptr = nut->last_syncpoint_pos - 16 * ffio_read_varlen(bc);
         ^
544.     if (*back_ptr < 0)
545.         return -1;

static int decode_syncpoint(NUTContext *nut, int64_t *ts, int64_t *back_ptr)
{
    AVFormatContext *s = nut->avf;
    AVIOContext *bc    = s->pb;
    int64_t end, tmp;
    int ret;
    nut->last_syncpoint_pos = avio_tell(bc) - 8;
    end  = get_packetheader(nut, bc, 1, SYNCPOINT_STARTCODE);
    end += avio_tell(bc);
    tmp       = ffio_read_varlen(bc);
    *back_ptr = nut->last_syncpoint_pos - 16 * ffio_read_varlen(bc);
    if (*back_ptr < 0)
        return -1;
    ff_nut_reset_ts(nut, nut->time_base[tmp % nut->time_base_count],
                    tmp / nut->time_base_count);
    if (skip_reserved(bc, end) || ffio_get_checksum(bc)) {
        av_log(s, AV_LOG_ERROR, "sync point checksum mismatch\n");
        return AVERROR_INVALIDDATA;
    }
    *ts = tmp / s->nb_streams *
          av_q2d(nut->time_base[tmp % s->nb_streams]) * AV_TIME_BASE;
    if ((ret = ff_nut_add_sp(nut, nut->last_syncpoint_pos, *back_ptr, *ts)) < 0)
        return ret;
    return 0;
}
['static int decode_syncpoint(NUTContext *nut, int64_t *ts, int64_t *back_ptr)\n{\n    AVFormatContext *s = nut->avf;\n    AVIOContext *bc    = s->pb;\n    int64_t end, tmp;\n    int ret;\n    nut->last_syncpoint_pos = avio_tell(bc) - 8;\n    end  = get_packetheader(nut, bc, 1, SYNCPOINT_STARTCODE);\n    end += avio_tell(bc);\n    tmp       = ffio_read_varlen(bc);\n    *back_ptr = nut->last_syncpoint_pos - 16 * ffio_read_varlen(bc);\n    if (*back_ptr < 0)\n        return -1;\n    ff_nut_reset_ts(nut, nut->time_base[tmp % nut->time_base_count],\n                    tmp / nut->time_base_count);\n    if (skip_reserved(bc, end) || ffio_get_checksum(bc)) {\n        av_log(s, AV_LOG_ERROR, "sync point checksum mismatch\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    *ts = tmp / s->nb_streams *\n          av_q2d(nut->time_base[tmp % s->nb_streams]) * AV_TIME_BASE;\n    if ((ret = ff_nut_add_sp(nut, nut->last_syncpoint_pos, *back_ptr, *ts)) < 0)\n        return ret;\n    return 0;\n}', 'static av_always_inline int64_t avio_tell(AVIOContext *s)\n{\n    return avio_seek(s, 0, SEEK_CUR);\n}', 'int64_t avio_seek(AVIOContext *s, int64_t offset, int whence)\n{\n    int64_t offset1;\n    int64_t pos;\n    int force = whence & AVSEEK_FORCE;\n    whence &= ~AVSEEK_FORCE;\n    if(!s)\n        return AVERROR(EINVAL);\n    pos = s->pos - (s->write_flag ? 0 : (s->buf_end - s->buffer));\n    if (whence != SEEK_CUR && whence != SEEK_SET)\n        return AVERROR(EINVAL);\n    if (whence == SEEK_CUR) {\n        offset1 = pos + (s->buf_ptr - s->buffer);\n        if (offset == 0)\n            return offset1;\n        offset += offset1;\n    }\n    offset1 = offset - pos;\n    if (!s->must_flush &&\n        offset1 >= 0 && offset1 <= (s->buf_end - s->buffer)) {\n        s->buf_ptr = s->buffer + offset1;\n    } else if ((!s->seekable ||\n               offset1 <= s->buf_end + SHORT_SEEK_THRESHOLD - s->buffer) &&\n               !s->write_flag && offset1 >= 0 &&\n              (whence != SEEK_END || force)) {\n        while(s->pos < offset && !s->eof_reached)\n            fill_buffer(s);\n        if (s->eof_reached)\n            return AVERROR_EOF;\n        s->buf_ptr = s->buf_end + offset - s->pos;\n    } else {\n        int64_t res;\n        if (s->write_flag) {\n            flush_buffer(s);\n            s->must_flush = 1;\n        }\n        if (!s->seek)\n            return AVERROR(EPIPE);\n        if ((res = s->seek(s->opaque, offset, SEEK_SET)) < 0)\n            return res;\n        if (!s->write_flag)\n            s->buf_end = s->buffer;\n        s->buf_ptr = s->buffer;\n        s->pos = offset;\n    }\n    s->eof_reached = 0;\n    return offset;\n}', 'uint64_t ffio_read_varlen(AVIOContext *bc){\n    uint64_t val = 0;\n    int tmp;\n    do{\n        tmp = avio_r8(bc);\n        val= (val<<7) + (tmp&127);\n    }while(tmp&128);\n    return val;\n}']