libavcodec/dxtory.c:298: error: Integer Overflow L2
  ([min(0, `src->l`), max(0, `src->l`)] - 16):unsigned32.

libavcodec/dxtory.c:268:1: <LHS trace>
266. typedef void (*setup_lru_func)(uint8_t lru[3][8]);
267. 
268. static int dxtory_decode_v2(AVCodecContext *avctx, AVFrame *pic,
     ^
269.                             const uint8_t *src, int src_size,
270.                             decode_slice_func decode_slice,

libavcodec/dxtory.c:268:1: Parameter `src->l`
266. typedef void (*setup_lru_func)(uint8_t lru[3][8]);
267. 
268. static int dxtory_decode_v2(AVCodecContext *avctx, AVFrame *pic,
     ^
269.                             const uint8_t *src, int src_size,
270.                             decode_slice_func decode_slice,

libavcodec/dxtory.c:290:22: Call
288. 
289.     for (slice = 0; slice < nslices; slice++) {
290.         slice_size = bytestream2_get_le32(&gb);
                          ^
291. 
292.         setup_lru(lru);

libavcodec/bytestream.h:87:1: Assignment
  85. 
  86. DEF(uint64_t,     le64, 8, AV_RL64, AV_WL64)
  87. DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)
      ^
  88. DEF(unsigned int, le24, 3, AV_RL24, AV_WL24)
  89. DEF(unsigned int, le16, 2, AV_RL16, AV_WL16)

libavcodec/dxtory.c:290:9: Assignment
288. 
289.     for (slice = 0; slice < nslices; slice++) {
290.         slice_size = bytestream2_get_le32(&gb);
             ^
291. 
292.         setup_lru(lru);

libavcodec/dxtory.c:298:9: Binary operation: ([min(0, src->l), max(0, src->l)] - 16):unsigned32
296.             return ret;
297. 
298.         init_get_bits(&gb2, src + off + 16, (slice_size - 16) * 8);
             ^
299. 
300.         line += decode_slice(&gb2, pic, line, avctx->height - line, lru);

static int dxtory_decode_v2(AVCodecContext *avctx, AVFrame *pic,
                            const uint8_t *src, int src_size,
                            decode_slice_func decode_slice,
                            setup_lru_func setup_lru,
                            enum AVPixelFormat fmt)
{
    GetByteContext gb;
    GetBitContext  gb2;
    int nslices, slice, line = 0;
    uint32_t off, slice_size;
    uint8_t lru[3][8];
    int ret;
    ret = load_buffer(avctx, src, src_size, &gb, &nslices, &off);
    if (ret < 0)
        return ret;
    avctx->pix_fmt = fmt;
    if ((ret = ff_get_buffer(avctx, pic, 0)) < 0)
        return ret;
    for (slice = 0; slice < nslices; slice++) {
        slice_size = bytestream2_get_le32(&gb);
        setup_lru(lru);
        ret = check_slice_size(avctx, src, src_size, slice_size, off);
        if (ret < 0)
            return ret;
        init_get_bits(&gb2, src + off + 16, (slice_size - 16) * 8);
        line += decode_slice(&gb2, pic, line, avctx->height - line, lru);
        off += slice_size;
    }
    if (avctx->height - line) {
        av_log(avctx, AV_LOG_VERBOSE,
               "Not enough slice data available, "
               "cropping the frame by %d pixels\n",
                avctx->height - line);
        avctx->height = line;
    }
    return 0;
}
['static int dxtory_decode_v2(AVCodecContext *avctx, AVFrame *pic,\n                            const uint8_t *src, int src_size,\n                            decode_slice_func decode_slice,\n                            setup_lru_func setup_lru,\n                            enum AVPixelFormat fmt)\n{\n    GetByteContext gb;\n    GetBitContext  gb2;\n    int nslices, slice, line = 0;\n    uint32_t off, slice_size;\n    uint8_t lru[3][8];\n    int ret;\n    ret = load_buffer(avctx, src, src_size, &gb, &nslices, &off);\n    if (ret < 0)\n        return ret;\n    avctx->pix_fmt = fmt;\n    if ((ret = ff_get_buffer(avctx, pic, 0)) < 0)\n        return ret;\n    for (slice = 0; slice < nslices; slice++) {\n        slice_size = bytestream2_get_le32(&gb);\n        setup_lru(lru);\n        ret = check_slice_size(avctx, src, src_size, slice_size, off);\n        if (ret < 0)\n            return ret;\n        init_get_bits(&gb2, src + off + 16, (slice_size - 16) * 8);\n        line += decode_slice(&gb2, pic, line, avctx->height - line, lru);\n        off += slice_size;\n    }\n    if (avctx->height - line) {\n        av_log(avctx, AV_LOG_VERBOSE,\n               "Not enough slice data available, "\n               "cropping the frame by %d pixels\\n",\n                avctx->height - line);\n        avctx->height = line;\n    }\n    return 0;\n}', 'DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)']