libavcodec/4xm.c:900: error: Integer Overflow L2
  ([min(8, `*avpkt->data`), +oo] - [-oo, 134217748]):unsigned32 by call to `decode_p_frame`.

libavcodec/4xm.c:801:1: Parameter `*avpkt->data`
799. }
800. 
801. static int decode_frame(AVCodecContext *avctx, void *data,
     ^
802.                         int *got_frame, AVPacket *avpkt)
803. {

libavcodec/4xm.c:860:9: Assignment
858. 
859.         memcpy(cfrm->data + cfrm->size, buf + 20, data_size);
860.         cfrm->size += data_size;
             ^
861. 
862.         if (cfrm->size >= whole_size) {

libavcodec/4xm.c:864:13: Assignment
862.         if (cfrm->size >= whole_size) {
863.             buf        = cfrm->data;
864.             frame_size = cfrm->size;
                 ^
865. 
866.             if (id != avctx->frame_number)

libavcodec/4xm.c:900:20: Call
898.     } else if (frame_4cc == AV_RL32("pfrm") || frame_4cc == AV_RL32("pfr2")) {
899.         picture->pict_type = AV_PICTURE_TYPE_P;
900.         if ((ret = decode_p_frame(f, picture, buf, frame_size)) < 0)
                        ^
901.             return ret;
902.     } else if (frame_4cc == AV_RL32("snd_")) {

libavcodec/4xm.c:403:1: <LHS trace>
401. }
402. 
403. static int decode_p_frame(FourXContext *f, AVFrame *frame,
     ^
404.                           const uint8_t *buf, int length)
405. {

libavcodec/4xm.c:403:1: Parameter `length`
  401. }
  402. 
  403. static int decode_p_frame(FourXContext *f, AVFrame *frame,
       ^
  404.                           const uint8_t *buf, int length)
  405. {

libavcodec/4xm.c:431:9: <RHS trace>
429.         if (length < 20)
430.             return AVERROR_INVALIDDATA;
431.         extra           = 20;
             ^
432.         bitstream_size  = AV_RL32(buf + 8);
433.         wordstream_size = AV_RL32(buf + 12);

libavcodec/4xm.c:431:9: Assignment
  429.         if (length < 20)
  430.             return AVERROR_INVALIDDATA;
  431.         extra           = 20;
               ^
  432.         bitstream_size  = AV_RL32(buf + 8);
  433.         wordstream_size = AV_RL32(buf + 12);

libavcodec/4xm.c:463:5: Assignment
  461. 
  462.     wordstream_offset = extra + bitstream_size;
  463.     bytestream_offset = extra + bitstream_size + wordstream_size;
           ^
  464.     bytestream2_init(&f->g2, buf + wordstream_offset,
  465.                      length - wordstream_offset);

libavcodec/4xm.c:466:5: Binary operation: ([min(8, *avpkt->data), +oo] - [-oo, 134217748]):unsigned32 by call to `decode_p_frame` 
  464.     bytestream2_init(&f->g2, buf + wordstream_offset,
  465.                      length - wordstream_offset);
  466.     bytestream2_init(&f->g, buf + bytestream_offset,
           ^
  467.                      length - bytestream_offset);
  468. 

static int decode_p_frame(FourXContext *f, AVFrame *frame,
                          const uint8_t *buf, int length)
{
    int x, y;
    const int width  = f->avctx->width;
    const int height = f->avctx->height;
    uint16_t *dst    = (uint16_t *)frame->data[0];
    const int stride =             frame->linesize[0] >> 1;
    uint16_t *src;
    unsigned int bitstream_size, bytestream_size, wordstream_size, extra,
                 bytestream_offset, wordstream_offset;
    int ret;
    if (!f->last_picture->data[0]) {
        if ((ret = ff_get_buffer(f->avctx, f->last_picture,
                                 AV_GET_BUFFER_FLAG_REF)) < 0) {
            av_log(f->avctx, AV_LOG_ERROR, "get_buffer() failed\n");
            return ret;
        }
        memset(f->last_picture->data[0], 0,
               f->avctx->height * FFABS(f->last_picture->linesize[0]));
    }
    src = (uint16_t *)f->last_picture->data[0];
    if (f->version > 1) {
        if (length < 20)
            return AVERROR_INVALIDDATA;
        extra           = 20;
        bitstream_size  = AV_RL32(buf + 8);
        wordstream_size = AV_RL32(buf + 12);
        bytestream_size = AV_RL32(buf + 16);
    } else {
        extra           = 0;
        bitstream_size  = AV_RL16(buf - 4);
        wordstream_size = AV_RL16(buf - 2);
        bytestream_size = FFMAX(length - bitstream_size - wordstream_size, 0);
    }
    if (bitstream_size + bytestream_size + wordstream_size + extra != length
        || bitstream_size  > (1 << 26)
        || bytestream_size > (1 << 26)
        || wordstream_size > (1 << 26)) {
        av_log(f->avctx, AV_LOG_ERROR, "lengths %d %d %d %d\n",
               bitstream_size, bytestream_size, wordstream_size,
               bitstream_size + bytestream_size + wordstream_size - length);
        return AVERROR_INVALIDDATA;
    }
    av_fast_malloc(&f->bitstream_buffer, &f->bitstream_buffer_size,
                   bitstream_size + FF_INPUT_BUFFER_PADDING_SIZE);
    if (!f->bitstream_buffer)
        return AVERROR(ENOMEM);
    f->dsp.bswap_buf(f->bitstream_buffer, (const uint32_t*)(buf + extra),
                     bitstream_size / 4);
    memset((uint8_t*)f->bitstream_buffer + bitstream_size,
           0, FF_INPUT_BUFFER_PADDING_SIZE);
    init_get_bits(&f->gb, f->bitstream_buffer, 8 * bitstream_size);
    wordstream_offset = extra + bitstream_size;
    bytestream_offset = extra + bitstream_size + wordstream_size;
    bytestream2_init(&f->g2, buf + wordstream_offset,
                     length - wordstream_offset);
    bytestream2_init(&f->g, buf + bytestream_offset,
                     length - bytestream_offset);
    init_mv(f, frame->linesize[0]);
    for (y = 0; y < height; y += 8) {
        for (x = 0; x < width; x += 8)
            if ((ret = decode_p_block(f, dst + x, src + x, 3, 3, stride)) < 0)
                return ret;
        src += 8 * stride;
        dst += 8 * stride;
    }
    return 0;
}
['static int decode_frame(AVCodecContext *avctx, void *data,\n                        int *got_frame, AVPacket *avpkt)\n{\n    const uint8_t *buf    = avpkt->data;\n    int buf_size          = avpkt->size;\n    FourXContext *const f = avctx->priv_data;\n    AVFrame *picture      = data;\n    int i, frame_4cc, frame_size, ret;\n    if (buf_size < 20)\n        return AVERROR_INVALIDDATA;\n    if (buf_size < AV_RL32(buf + 4) + 8) {\n        av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d\\n",\n               buf_size, AV_RL32(buf + 4));\n        return AVERROR_INVALIDDATA;\n    }\n    frame_4cc = AV_RL32(buf);\n    if (frame_4cc == AV_RL32("cfrm")) {\n        int free_index       = -1;\n        int id, whole_size;\n        const int data_size  = buf_size - 20;\n        CFrameBuffer *cfrm;\n        if (data_size < 0)\n            return AVERROR_INVALIDDATA;\n        id         = AV_RL32(buf + 12);\n        whole_size = AV_RL32(buf + 16);\n        for (i = 0; i < CFRAME_BUFFER_COUNT; i++)\n            if (f->cfrm[i].id && f->cfrm[i].id < avctx->frame_number)\n                av_log(f->avctx, AV_LOG_ERROR, "lost c frame %d\\n",\n                       f->cfrm[i].id);\n        for (i = 0; i < CFRAME_BUFFER_COUNT; i++) {\n            if (f->cfrm[i].id == id)\n                break;\n            if (f->cfrm[i].size == 0)\n                free_index = i;\n        }\n        if (i >= CFRAME_BUFFER_COUNT) {\n            i             = free_index;\n            f->cfrm[i].id = id;\n        }\n        cfrm = &f->cfrm[i];\n        cfrm->data = av_fast_realloc(cfrm->data, &cfrm->allocated_size,\n                                     cfrm->size + data_size + FF_INPUT_BUFFER_PADDING_SIZE);\n        if (!cfrm->data) {\n            av_log(f->avctx, AV_LOG_ERROR, "realloc failure");\n            return AVERROR(ENOMEM);\n        }\n        memcpy(cfrm->data + cfrm->size, buf + 20, data_size);\n        cfrm->size += data_size;\n        if (cfrm->size >= whole_size) {\n            buf        = cfrm->data;\n            frame_size = cfrm->size;\n            if (id != avctx->frame_number)\n                av_log(f->avctx, AV_LOG_ERROR, "cframe id mismatch %d %d\\n",\n                       id, avctx->frame_number);\n            if (f->version <= 1)\n                return AVERROR_INVALIDDATA;\n            cfrm->size = cfrm->id = 0;\n            frame_4cc  = AV_RL32("pfrm");\n        } else\n            return buf_size;\n    } else {\n        buf        = buf      + 12;\n        frame_size = buf_size - 12;\n    }\n    avctx->flags |= CODEC_FLAG_EMU_EDGE;\n    if ((ret = ff_get_buffer(avctx, picture, AV_GET_BUFFER_FLAG_REF)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    if (frame_4cc == AV_RL32("ifr2")) {\n        picture->pict_type = AV_PICTURE_TYPE_I;\n        if ((ret = decode_i2_frame(f, picture, buf - 4, frame_size + 4)) < 0)\n            return ret;\n    } else if (frame_4cc == AV_RL32("ifrm")) {\n        picture->pict_type = AV_PICTURE_TYPE_I;\n        if ((ret = decode_i_frame(f, picture, buf, frame_size)) < 0)\n            return ret;\n    } else if (frame_4cc == AV_RL32("pfrm") || frame_4cc == AV_RL32("pfr2")) {\n        picture->pict_type = AV_PICTURE_TYPE_P;\n        if ((ret = decode_p_frame(f, picture, buf, frame_size)) < 0)\n            return ret;\n    } else if (frame_4cc == AV_RL32("snd_")) {\n        av_log(avctx, AV_LOG_ERROR, "ignoring snd_ chunk length:%d\\n",\n               buf_size);\n    } else {\n        av_log(avctx, AV_LOG_ERROR, "ignoring unknown chunk length:%d\\n",\n               buf_size);\n    }\n    picture->key_frame = picture->pict_type == AV_PICTURE_TYPE_I;\n    av_frame_unref(f->last_picture);\n    if ((ret = av_frame_ref(f->last_picture, picture)) < 0)\n        return ret;\n    *got_frame = 1;\n    emms_c();\n    return buf_size;\n}', 'static int decode_p_frame(FourXContext *f, AVFrame *frame,\n                          const uint8_t *buf, int length)\n{\n    int x, y;\n    const int width  = f->avctx->width;\n    const int height = f->avctx->height;\n    uint16_t *dst    = (uint16_t *)frame->data[0];\n    const int stride =             frame->linesize[0] >> 1;\n    uint16_t *src;\n    unsigned int bitstream_size, bytestream_size, wordstream_size, extra,\n                 bytestream_offset, wordstream_offset;\n    int ret;\n    if (!f->last_picture->data[0]) {\n        if ((ret = ff_get_buffer(f->avctx, f->last_picture,\n                                 AV_GET_BUFFER_FLAG_REF)) < 0) {\n            av_log(f->avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n            return ret;\n        }\n        memset(f->last_picture->data[0], 0,\n               f->avctx->height * FFABS(f->last_picture->linesize[0]));\n    }\n    src = (uint16_t *)f->last_picture->data[0];\n    if (f->version > 1) {\n        if (length < 20)\n            return AVERROR_INVALIDDATA;\n        extra           = 20;\n        bitstream_size  = AV_RL32(buf + 8);\n        wordstream_size = AV_RL32(buf + 12);\n        bytestream_size = AV_RL32(buf + 16);\n    } else {\n        extra           = 0;\n        bitstream_size  = AV_RL16(buf - 4);\n        wordstream_size = AV_RL16(buf - 2);\n        bytestream_size = FFMAX(length - bitstream_size - wordstream_size, 0);\n    }\n    if (bitstream_size + bytestream_size + wordstream_size + extra != length\n        || bitstream_size  > (1 << 26)\n        || bytestream_size > (1 << 26)\n        || wordstream_size > (1 << 26)) {\n        av_log(f->avctx, AV_LOG_ERROR, "lengths %d %d %d %d\\n",\n               bitstream_size, bytestream_size, wordstream_size,\n               bitstream_size + bytestream_size + wordstream_size - length);\n        return AVERROR_INVALIDDATA;\n    }\n    av_fast_malloc(&f->bitstream_buffer, &f->bitstream_buffer_size,\n                   bitstream_size + FF_INPUT_BUFFER_PADDING_SIZE);\n    if (!f->bitstream_buffer)\n        return AVERROR(ENOMEM);\n    f->dsp.bswap_buf(f->bitstream_buffer, (const uint32_t*)(buf + extra),\n                     bitstream_size / 4);\n    memset((uint8_t*)f->bitstream_buffer + bitstream_size,\n           0, FF_INPUT_BUFFER_PADDING_SIZE);\n    init_get_bits(&f->gb, f->bitstream_buffer, 8 * bitstream_size);\n    wordstream_offset = extra + bitstream_size;\n    bytestream_offset = extra + bitstream_size + wordstream_size;\n    bytestream2_init(&f->g2, buf + wordstream_offset,\n                     length - wordstream_offset);\n    bytestream2_init(&f->g, buf + bytestream_offset,\n                     length - bytestream_offset);\n    init_mv(f, frame->linesize[0]);\n    for (y = 0; y < height; y += 8) {\n        for (x = 0; x < width; x += 8)\n            if ((ret = decode_p_block(f, dst + x, src + x, 3, 3, stride)) < 0)\n                return ret;\n        src += 8 * stride;\n        dst += 8 * stride;\n    }\n    return 0;\n}']