libavformat/asfdec.c:133: error: Integer Overflow L2
  (2 × [`len`, min(2147483646, `len`)]):signed32.

libavformat/asfdec.c:125:1: <RHS trace>
123. }
124. 
125. static void get_tag(AVFormatContext *s, const char *key, int type, int len)
     ^
126. {
127.     char *value;

libavformat/asfdec.c:125:1: Parameter `len`
123. }
124. 
125. static void get_tag(AVFormatContext *s, const char *key, int type, int len)
     ^
126. {
127.     char *value;

libavformat/asfdec.c:133:13: Binary operation: (2 × [len, min(2147483646, len)]):signed32
131.         return;
132. 
133.     value = av_malloc(2*len+1);
                 ^
134.     if (!value)
135.         goto finish;

static void get_tag(AVFormatContext *s, const char *key, int type, int len)
{
    char *value;
    int64_t off = url_ftell(s->pb);
    if ((unsigned)len >= (UINT_MAX - 1)/2)
        return;
    value = av_malloc(2*len+1);
    if (!value)
        goto finish;
    if (type == 0) {
        avio_get_str16le(s->pb, len, value, 2*len + 1);
    } else if (type > 1 && type <= 5) {
        uint64_t num = get_value(s->pb, type);
        snprintf(value, len, "%"PRIu64, num);
    } else {
        av_log(s, AV_LOG_DEBUG, "Unsupported value type %d in tag %s.\n", type, key);
        goto finish;
    }
    av_metadata_set2(&s->metadata, key, value, 0);
finish:
    av_freep(&value);
    url_fseek(s->pb, off + len, SEEK_SET);
}
['static void get_tag(AVFormatContext *s, const char *key, int type, int len)\n{\n    char *value;\n    int64_t off = url_ftell(s->pb);\n    if ((unsigned)len >= (UINT_MAX - 1)/2)\n        return;\n    value = av_malloc(2*len+1);\n    if (!value)\n        goto finish;\n    if (type == 0) {\n        avio_get_str16le(s->pb, len, value, 2*len + 1);\n    } else if (type > 1 && type <= 5) {\n        uint64_t num = get_value(s->pb, type);\n        snprintf(value, len, "%"PRIu64, num);\n    } else {\n        av_log(s, AV_LOG_DEBUG, "Unsupported value type %d in tag %s.\\n", type, key);\n        goto finish;\n    }\n    av_metadata_set2(&s->metadata, key, value, 0);\nfinish:\n    av_freep(&value);\n    url_fseek(s->pb, off + len, SEEK_SET);\n}']