libavformat/avidec.c:1163: error: Integer Overflow L2
  ([0, 255] - 48):unsigned32.

libavformat/avidec.c:1156:15: <LHS trace>
1154.     /* Read the entries and sort them in each stream component. */
1155.     for(i = 0; i < nb_index_entries; i++) {
1156.         tag = avio_rl32(pb);
                    ^
1157.         flags = avio_rl32(pb);
1158.         pos = avio_rl32(pb);

libavformat/avidec.c:1156:15: Call
1154.     /* Read the entries and sort them in each stream component. */
1155.     for(i = 0; i < nb_index_entries; i++) {
1156.         tag = avio_rl32(pb);
                    ^
1157.         flags = avio_rl32(pb);
1158.         pos = avio_rl32(pb);

libavformat/aviobuf.c:709:11: Call
  707. {
  708.     unsigned int val;
  709.     val = avio_rl16(s);
                 ^
  710.     val |= avio_rl16(s) << 16;
  711.     return val;

libavformat/aviobuf.c:693:11: Call
    691. {
    692.     unsigned int val;
    693.     val = avio_r8(s);
                   ^
    694.     val |= avio_r8(s) << 8;
    695.     return val;

libavformat/aviobuf.c:606:5: Assignment
      604.     if (s->buf_ptr < s->buf_end)
      605.         return *s->buf_ptr++;
      606.     return 0;
               ^
      607. }
      608. 

libavformat/aviobuf.c:693:5: Assignment
    691. {
    692.     unsigned int val;
    693.     val = avio_r8(s);
             ^
    694.     val |= avio_r8(s) << 8;
    695.     return val;

libavformat/aviobuf.c:694:5: Assignment
    692.     unsigned int val;
    693.     val = avio_r8(s);
    694.     val |= avio_r8(s) << 8;
             ^
    695.     return val;
    696. }

libavformat/aviobuf.c:695:5: Assignment
    693.     val = avio_r8(s);
    694.     val |= avio_r8(s) << 8;
    695.     return val;
             ^
    696. }
    697. 

libavformat/aviobuf.c:709:5: Assignment
  707. {
  708.     unsigned int val;
  709.     val = avio_rl16(s);
           ^
  710.     val |= avio_rl16(s) << 16;
  711.     return val;

libavformat/aviobuf.c:710:5: Assignment
  708.     unsigned int val;
  709.     val = avio_rl16(s);
  710.     val |= avio_rl16(s) << 16;
           ^
  711.     return val;
  712. }

libavformat/aviobuf.c:711:5: Assignment
  709.     val = avio_rl16(s);
  710.     val |= avio_rl16(s) << 16;
  711.     return val;
           ^
  712. }
  713. 

libavformat/avidec.c:1156:9: Assignment
1154.     /* Read the entries and sort them in each stream component. */
1155.     for(i = 0; i < nb_index_entries; i++) {
1156.         tag = avio_rl32(pb);
              ^
1157.         flags = avio_rl32(pb);
1158.         pos = avio_rl32(pb);

libavformat/avidec.c:1163:9: Binary operation: ([0, 255] - 48):unsigned32
1161.                 i, tag, flags, pos, len);
1162. 
1163.         index = ((tag & 0xff) - '0') * 10;
              ^
1164.         index += ((tag >> 8) & 0xff) - '0';
1165.         if (index >= s->nb_streams)

static int avi_read_idx1(AVFormatContext *s, int size)
{
    AVIContext *avi = s->priv_data;
    AVIOContext *pb = s->pb;
    int nb_index_entries, i;
    AVStream *st;
    AVIStream *ast;
    unsigned int index, tag, flags, pos, len, first_packet = 1;
    unsigned last_pos= -1;
    int64_t idx1_pos, first_packet_pos = 0, data_offset = 0;
    nb_index_entries = size / 16;
    if (nb_index_entries <= 0)
        return -1;
    idx1_pos = avio_tell(pb);
    avio_seek(pb, avi->movi_list+4, SEEK_SET);
    if (avi_sync(s, 1) == 0) {
        first_packet_pos = avio_tell(pb) - 8;
    }
    avi->stream_index = -1;
    avio_seek(pb, idx1_pos, SEEK_SET);
    for(i = 0; i < nb_index_entries; i++) {
        tag = avio_rl32(pb);
        flags = avio_rl32(pb);
        pos = avio_rl32(pb);
        len = avio_rl32(pb);
        av_dlog(s, "%d: tag=0x%x flags=0x%x pos=0x%x len=%d/",
                i, tag, flags, pos, len);
        index = ((tag & 0xff) - '0') * 10;
        index += ((tag >> 8) & 0xff) - '0';
        if (index >= s->nb_streams)
            continue;
        st = s->streams[index];
        ast = st->priv_data;
        if(first_packet && first_packet_pos && len) {
            data_offset = first_packet_pos - pos;
            first_packet = 0;
        }
        pos += data_offset;
        av_dlog(s, "%d cum_len=%"PRId64"\n", len, ast->cum_len);
        if(pb->eof_reached)
            return -1;
        if(last_pos == pos)
            avi->non_interleaved= 1;
        else if(len || !ast->sample_size)
            av_add_index_entry(st, pos, ast->cum_len, len, 0, (flags&AVIIF_INDEX) ? AVINDEX_KEYFRAME : 0);
        ast->cum_len += get_duration(ast, len);
        last_pos= pos;
    }
    return 0;
}
['static int avi_read_idx1(AVFormatContext *s, int size)\n{\n    AVIContext *avi = s->priv_data;\n    AVIOContext *pb = s->pb;\n    int nb_index_entries, i;\n    AVStream *st;\n    AVIStream *ast;\n    unsigned int index, tag, flags, pos, len, first_packet = 1;\n    unsigned last_pos= -1;\n    int64_t idx1_pos, first_packet_pos = 0, data_offset = 0;\n    nb_index_entries = size / 16;\n    if (nb_index_entries <= 0)\n        return -1;\n    idx1_pos = avio_tell(pb);\n    avio_seek(pb, avi->movi_list+4, SEEK_SET);\n    if (avi_sync(s, 1) == 0) {\n        first_packet_pos = avio_tell(pb) - 8;\n    }\n    avi->stream_index = -1;\n    avio_seek(pb, idx1_pos, SEEK_SET);\n    for(i = 0; i < nb_index_entries; i++) {\n        tag = avio_rl32(pb);\n        flags = avio_rl32(pb);\n        pos = avio_rl32(pb);\n        len = avio_rl32(pb);\n        av_dlog(s, "%d: tag=0x%x flags=0x%x pos=0x%x len=%d/",\n                i, tag, flags, pos, len);\n        index = ((tag & 0xff) - \'0\') * 10;\n        index += ((tag >> 8) & 0xff) - \'0\';\n        if (index >= s->nb_streams)\n            continue;\n        st = s->streams[index];\n        ast = st->priv_data;\n        if(first_packet && first_packet_pos && len) {\n            data_offset = first_packet_pos - pos;\n            first_packet = 0;\n        }\n        pos += data_offset;\n        av_dlog(s, "%d cum_len=%"PRId64"\\n", len, ast->cum_len);\n        if(pb->eof_reached)\n            return -1;\n        if(last_pos == pos)\n            avi->non_interleaved= 1;\n        else if(len || !ast->sample_size)\n            av_add_index_entry(st, pos, ast->cum_len, len, 0, (flags&AVIIF_INDEX) ? AVINDEX_KEYFRAME : 0);\n        ast->cum_len += get_duration(ast, len);\n        last_pos= pos;\n    }\n    return 0;\n}', 'unsigned int avio_rl32(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rl16(s);\n    val |= avio_rl16(s) << 16;\n    return val;\n}', 'unsigned int avio_rl16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s);\n    val |= avio_r8(s) << 8;\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}']