libavformat/idroqdec.c:202: error: Integer Overflow L2
  ([-oo, 2147483655] + 8):signed32 by call to `av_new_packet`.

libavformat/idroqdec.c:117:22: Call
115. 
116.         chunk_type = AV_RL16(&preamble[0]);
117.         chunk_size = AV_RL32(&preamble[2]);
                          ^
118.         if(chunk_size > INT_MAX)
119.             return AVERROR_INVALIDDATA;

libavutil/ppc/intreadwrite.h:48:5: Assignment
  46.     uint32_t v;
  47.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
  48.     return v;
          ^
  49. }
  50. 

libavformat/idroqdec.c:117:9: Assignment
115. 
116.         chunk_type = AV_RL16(&preamble[0]);
117.         chunk_size = AV_RL32(&preamble[2]);
             ^
118.         if(chunk_size > INT_MAX)
119.             return AVERROR_INVALIDDATA;

libavformat/idroqdec.c:202:17: Call
200. 
201.             /* load up the packet */
202.             if (av_new_packet(pkt, chunk_size + RoQ_CHUNK_PREAMBLE_SIZE))
                     ^
203.                 return AVERROR(EIO);
204.             /* copy over preamble */

libavcodec/avpacket.c:80:1: Parameter `size`
  78. }
  79. 
  80. int av_new_packet(AVPacket *pkt, int size)
      ^
  81. {
  82.     AVBufferRef *buf = NULL;

libavcodec/avpacket.c:83:15: Call
  81. {
  82.     AVBufferRef *buf = NULL;
  83.     int ret = packet_alloc(&buf, size);
                    ^
  84.     if (ret < 0)
  85.         return ret;

libavcodec/avpacket.c:65:1: <LHS trace>
63. }
64. 
65. static int packet_alloc(AVBufferRef **buf, int size)
    ^
66. {
67.     int ret;

libavcodec/avpacket.c:65:1: Parameter `size`
    63. }
    64. 
    65. static int packet_alloc(AVBufferRef **buf, int size)
        ^
    66. {
    67.     int ret;

libavcodec/avpacket.c:71:11: Binary operation: ([-oo, 2147483655] + 8):signed32 by call to `av_new_packet` 
    69.         return AVERROR(EINVAL);
    70. 
    71.     ret = av_buffer_realloc(buf, size + FF_INPUT_BUFFER_PADDING_SIZE);
                  ^
    72.     if (ret < 0)
    73.         return ret;

static int packet_alloc(AVBufferRef **buf, int size)
{
    int ret;
    if ((unsigned)size >= (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE)
        return AVERROR(EINVAL);
    ret = av_buffer_realloc(buf, size + FF_INPUT_BUFFER_PADDING_SIZE);
    if (ret < 0)
        return ret;
    memset((*buf)->data + size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
    return 0;
}
['static int roq_read_packet(AVFormatContext *s,\n                           AVPacket *pkt)\n{\n    RoqDemuxContext *roq = s->priv_data;\n    AVIOContext *pb = s->pb;\n    int ret = 0;\n    unsigned int chunk_size;\n    unsigned int chunk_type;\n    unsigned int codebook_size;\n    unsigned char preamble[RoQ_CHUNK_PREAMBLE_SIZE];\n    int packet_read = 0;\n    int64_t codebook_offset;\n    while (!packet_read) {\n        if (s->pb->eof_reached)\n            return AVERROR(EIO);\n        if ((ret = avio_read(pb, preamble, RoQ_CHUNK_PREAMBLE_SIZE)) !=\n            RoQ_CHUNK_PREAMBLE_SIZE)\n            return AVERROR(EIO);\n        chunk_type = AV_RL16(&preamble[0]);\n        chunk_size = AV_RL32(&preamble[2]);\n        if(chunk_size > INT_MAX)\n            return AVERROR_INVALIDDATA;\n        switch (chunk_type) {\n        case RoQ_INFO:\n            if (roq->video_stream_index == -1) {\n                AVStream *st = avformat_new_stream(s, NULL);\n                if (!st)\n                    return AVERROR(ENOMEM);\n                avpriv_set_pts_info(st, 63, 1, roq->frame_rate);\n                roq->video_stream_index = st->index;\n                st->codec->codec_type   = AVMEDIA_TYPE_VIDEO;\n                st->codec->codec_id     = AV_CODEC_ID_ROQ;\n                st->codec->codec_tag    = 0;\n                if (avio_read(pb, preamble, RoQ_CHUNK_PREAMBLE_SIZE) != RoQ_CHUNK_PREAMBLE_SIZE)\n                    return AVERROR(EIO);\n                st->codec->width  = roq->width  = AV_RL16(preamble);\n                st->codec->height = roq->height = AV_RL16(preamble + 2);\n                break;\n            }\n            avio_skip(pb, RoQ_CHUNK_PREAMBLE_SIZE);\n            break;\n        case RoQ_QUAD_CODEBOOK:\n            if (roq->video_stream_index < 0)\n                return AVERROR_INVALIDDATA;\n            codebook_offset = avio_tell(pb) - RoQ_CHUNK_PREAMBLE_SIZE;\n            codebook_size = chunk_size;\n            avio_skip(pb, codebook_size);\n            if (avio_read(pb, preamble, RoQ_CHUNK_PREAMBLE_SIZE) !=\n                RoQ_CHUNK_PREAMBLE_SIZE)\n                return AVERROR(EIO);\n            chunk_size = AV_RL32(&preamble[2]) + RoQ_CHUNK_PREAMBLE_SIZE * 2 +\n                codebook_size;\n            avio_seek(pb, codebook_offset, SEEK_SET);\n            ret= av_get_packet(pb, pkt, chunk_size);\n            if (ret != chunk_size)\n                return AVERROR(EIO);\n            pkt->stream_index = roq->video_stream_index;\n            pkt->pts = roq->video_pts++;\n            packet_read = 1;\n            break;\n        case RoQ_SOUND_MONO:\n        case RoQ_SOUND_STEREO:\n            if (roq->audio_stream_index == -1) {\n                AVStream *st = avformat_new_stream(s, NULL);\n                if (!st)\n                    return AVERROR(ENOMEM);\n                avpriv_set_pts_info(st, 32, 1, RoQ_AUDIO_SAMPLE_RATE);\n                roq->audio_stream_index = st->index;\n                st->codec->codec_type = AVMEDIA_TYPE_AUDIO;\n                st->codec->codec_id = AV_CODEC_ID_ROQ_DPCM;\n                st->codec->codec_tag = 0;\n                if (chunk_type == RoQ_SOUND_STEREO) {\n                    st->codec->channels       = 2;\n                    st->codec->channel_layout = AV_CH_LAYOUT_STEREO;\n                } else {\n                    st->codec->channels       = 1;\n                    st->codec->channel_layout = AV_CH_LAYOUT_MONO;\n                }\n                roq->audio_channels    = st->codec->channels;\n                st->codec->sample_rate = RoQ_AUDIO_SAMPLE_RATE;\n                st->codec->bits_per_coded_sample = 16;\n                st->codec->bit_rate = st->codec->channels * st->codec->sample_rate *\n                    st->codec->bits_per_coded_sample;\n                st->codec->block_align = st->codec->channels * st->codec->bits_per_coded_sample;\n            }\n        case RoQ_QUAD_VQ:\n            if (chunk_type == RoQ_QUAD_VQ) {\n                if (roq->video_stream_index < 0)\n                    return AVERROR_INVALIDDATA;\n            }\n            if (av_new_packet(pkt, chunk_size + RoQ_CHUNK_PREAMBLE_SIZE))\n                return AVERROR(EIO);\n            memcpy(pkt->data, preamble, RoQ_CHUNK_PREAMBLE_SIZE);\n            if (chunk_type == RoQ_QUAD_VQ) {\n                pkt->stream_index = roq->video_stream_index;\n                pkt->pts = roq->video_pts++;\n            } else {\n                pkt->stream_index = roq->audio_stream_index;\n                pkt->pts = roq->audio_frame_count;\n                roq->audio_frame_count += (chunk_size / roq->audio_channels);\n            }\n            pkt->pos= avio_tell(pb);\n            ret = avio_read(pb, pkt->data + RoQ_CHUNK_PREAMBLE_SIZE,\n                chunk_size);\n            if (ret != chunk_size)\n                ret = AVERROR(EIO);\n            packet_read = 1;\n            break;\n        default:\n            av_log(s, AV_LOG_ERROR, "  unknown RoQ chunk (%04X)\\n", chunk_type);\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    return ret;\n}', 'int av_new_packet(AVPacket *pkt, int size)\n{\n    AVBufferRef *buf = NULL;\n    int ret = packet_alloc(&buf, size);\n    if (ret < 0)\n        return ret;\n    av_init_packet(pkt);\n    pkt->buf      = buf;\n    pkt->data     = buf->data;\n    pkt->size     = size;\n#if FF_API_DESTRUCT_PACKET\nFF_DISABLE_DEPRECATION_WARNINGS\n    pkt->destruct = dummy_destruct_packet;\nFF_ENABLE_DEPRECATION_WARNINGS\n#endif\n    return 0;\n}', 'static int packet_alloc(AVBufferRef **buf, int size)\n{\n    int ret;\n    if ((unsigned)size >= (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE)\n        return AVERROR(EINVAL);\n    ret = av_buffer_realloc(buf, size + FF_INPUT_BUFFER_PADDING_SIZE);\n    if (ret < 0)\n        return ret;\n    memset((*buf)->data + size, 0, FF_INPUT_BUFFER_PADDING_SIZE);\n    return 0;\n}']