libavformat/wv.c:237: error: Integer Overflow L2
  ([min(0, `s->priv_data->blksize`), max(1047576, `s->priv_data->blksize`)] - 24):unsigned32.

libavformat/wv.c:225:1: <LHS trace>
223. }
224. 
225. static int wv_read_header(AVFormatContext *s)
     ^
226. {
227.     AVIOContext *pb = s->pb;

libavformat/wv.c:225:1: Parameter `s->priv_data->blksize`
223. }
224. 
225. static int wv_read_header(AVFormatContext *s)
     ^
226. {
227.     AVIOContext *pb = s->pb;

libavformat/wv.c:234:20: Call
232.     wc->block_parsed = 0;
233.     for (;;) {
234.         if ((ret = wv_read_block_header(s, pb)) < 0)
                        ^
235.             return ret;
236.         if (!AV_RL32(wc->block_header + 20))

libavformat/wv.c:83:1: Parameter `ctx->priv_data->blksize`
  81. }
  82. 
  83. static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb)
      ^
  84. {
  85.     WVContext *wc = ctx->priv_data;

libavformat/wv.c:237:13: Binary operation: ([min(0, s->priv_data->blksize), max(1047576, s->priv_data->blksize)] - 24):unsigned32
235.             return ret;
236.         if (!AV_RL32(wc->block_header + 20))
237.             avio_skip(pb, wc->blksize - 24);
                 ^
238.         else
239.             break;

static int wv_read_header(AVFormatContext *s)
{
    AVIOContext *pb = s->pb;
    WVContext *wc = s->priv_data;
    AVStream *st;
    int ret;
    wc->block_parsed = 0;
    for (;;) {
        if ((ret = wv_read_block_header(s, pb)) < 0)
            return ret;
        if (!AV_RL32(wc->block_header + 20))
            avio_skip(pb, wc->blksize - 24);
        else
            break;
    }
    st = avformat_new_stream(s, NULL);
    if (!st)
        return AVERROR(ENOMEM);
    st->codec->codec_type            = AVMEDIA_TYPE_AUDIO;
    st->codec->codec_id              = AV_CODEC_ID_WAVPACK;
    st->codec->channels              = wc->chan;
    st->codec->channel_layout        = wc->chmask;
    st->codec->sample_rate           = wc->rate;
    st->codec->bits_per_coded_sample = wc->bpp;
    avpriv_set_pts_info(st, 64, 1, wc->rate);
    st->start_time = 0;
    st->duration   = wc->samples;
    if (s->pb->seekable) {
        int64_t cur = avio_tell(s->pb);
        wc->apetag_start = ff_ape_parse_tag(s);
        if (!av_dict_get(s->metadata, "", NULL, AV_DICT_IGNORE_SUFFIX))
            ff_id3v1_read(s);
        avio_seek(s->pb, cur, SEEK_SET);
    }
    return 0;
}
['static int wv_read_header(AVFormatContext *s)\n{\n    AVIOContext *pb = s->pb;\n    WVContext *wc = s->priv_data;\n    AVStream *st;\n    int ret;\n    wc->block_parsed = 0;\n    for (;;) {\n        if ((ret = wv_read_block_header(s, pb)) < 0)\n            return ret;\n        if (!AV_RL32(wc->block_header + 20))\n            avio_skip(pb, wc->blksize - 24);\n        else\n            break;\n    }\n    st = avformat_new_stream(s, NULL);\n    if (!st)\n        return AVERROR(ENOMEM);\n    st->codec->codec_type            = AVMEDIA_TYPE_AUDIO;\n    st->codec->codec_id              = AV_CODEC_ID_WAVPACK;\n    st->codec->channels              = wc->chan;\n    st->codec->channel_layout        = wc->chmask;\n    st->codec->sample_rate           = wc->rate;\n    st->codec->bits_per_coded_sample = wc->bpp;\n    avpriv_set_pts_info(st, 64, 1, wc->rate);\n    st->start_time = 0;\n    st->duration   = wc->samples;\n    if (s->pb->seekable) {\n        int64_t cur = avio_tell(s->pb);\n        wc->apetag_start = ff_ape_parse_tag(s);\n        if (!av_dict_get(s->metadata, "", NULL, AV_DICT_IGNORE_SUFFIX))\n            ff_id3v1_read(s);\n        avio_seek(s->pb, cur, SEEK_SET);\n    }\n    return 0;\n}', 'static int wv_read_block_header(AVFormatContext *ctx, AVIOContext *pb)\n{\n    WVContext *wc = ctx->priv_data;\n    uint32_t ver;\n    int size, ret;\n    int rate, bpp, chan;\n    uint32_t chmask;\n    wc->pos = avio_tell(pb);\n    if (wc->apetag_start && wc->pos >= wc->apetag_start)\n        return AVERROR_EOF;\n    ret = avio_read(pb, wc->block_header, WV_HEADER_SIZE);\n    if (ret != WV_HEADER_SIZE)\n        return (ret < 0) ? ret : AVERROR_EOF;\n    if (AV_RL32(wc->block_header) != MKTAG(\'w\', \'v\', \'p\', \'k\'))\n        return AVERROR_INVALIDDATA;\n    size = AV_RL32(wc->block_header + 4);\n    if (size < 24 || size > WV_BLOCK_LIMIT) {\n        av_log(ctx, AV_LOG_ERROR, "Incorrect block size %i\\n", size);\n        return AVERROR_INVALIDDATA;\n    }\n    wc->blksize = size;\n    ver = AV_RL32(wc->block_header + 8);\n    if (ver < 0x402 || ver > 0x410) {\n        av_log(ctx, AV_LOG_ERROR, "Unsupported version %03X\\n", ver);\n        return AVERROR_PATCHWELCOME;\n    }\n    wc->samples = AV_RL32(wc->block_header + 12);\n    wc->soff    = AV_RL32(wc->block_header + 16);\n    wc->flags   = AV_RL32(wc->block_header + 24);\n    if (!AV_RN32(wc->block_header + 20))\n        return 0;\n    bpp    = ((wc->flags & 3) + 1) << 3;\n    chan   = 1 + !(wc->flags & WV_MONO);\n    chmask = wc->flags & WV_MONO ? AV_CH_LAYOUT_MONO : AV_CH_LAYOUT_STEREO;\n    rate   = wv_rates[(wc->flags >> 23) & 0xF];\n    wc->multichannel = !!((wc->flags & WV_SINGLE_BLOCK) != WV_SINGLE_BLOCK);\n    if (wc->multichannel) {\n        chan   = wc->chan;\n        chmask = wc->chmask;\n    }\n    if ((rate == -1 || !chan) && !wc->block_parsed) {\n        int64_t block_end = avio_tell(pb) + wc->blksize - 24;\n        if (!pb->seekable) {\n            av_log(ctx, AV_LOG_ERROR,\n                   "Cannot determine additional parameters\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        while (avio_tell(pb) < block_end) {\n            int id, size;\n            id   = avio_r8(pb);\n            size = (id & 0x80) ? avio_rl24(pb) : avio_r8(pb);\n            size <<= 1;\n            if (id & 0x40)\n                size--;\n            switch (id & 0x3F) {\n            case 0xD:\n                if (size <= 1) {\n                    av_log(ctx, AV_LOG_ERROR,\n                           "Insufficient channel information\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                chan = avio_r8(pb);\n                switch (size - 2) {\n                case 0:\n                    chmask = avio_r8(pb);\n                    break;\n                case 1:\n                    chmask = avio_rl16(pb);\n                    break;\n                case 2:\n                    chmask = avio_rl24(pb);\n                    break;\n                case 3:\n                    chmask = avio_rl32(pb);\n                    break;\n                case 5:\n                    avio_skip(pb, 1);\n                    chan  |= (avio_r8(pb) & 0xF) << 8;\n                    chmask = avio_rl24(pb);\n                    break;\n                default:\n                    av_log(ctx, AV_LOG_ERROR,\n                           "Invalid channel info size %d\\n", size);\n                    return AVERROR_INVALIDDATA;\n                }\n                break;\n            case 0x27:\n                rate = avio_rl24(pb);\n                break;\n            default:\n                avio_skip(pb, size);\n            }\n            if (id & 0x40)\n                avio_skip(pb, 1);\n        }\n        if (rate == -1) {\n            av_log(ctx, AV_LOG_ERROR,\n                   "Cannot determine custom sampling rate\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        avio_seek(pb, block_end - wc->blksize + 24, SEEK_SET);\n    }\n    if (!wc->bpp)\n        wc->bpp    = bpp;\n    if (!wc->chan)\n        wc->chan   = chan;\n    if (!wc->chmask)\n        wc->chmask = chmask;\n    if (!wc->rate)\n        wc->rate   = rate;\n    if (wc->flags && bpp != wc->bpp) {\n        av_log(ctx, AV_LOG_ERROR,\n               "Bits per sample differ, this block: %i, header block: %i\\n",\n               bpp, wc->bpp);\n        return AVERROR_INVALIDDATA;\n    }\n    if (wc->flags && !wc->multichannel && chan != wc->chan) {\n        av_log(ctx, AV_LOG_ERROR,\n               "Channels differ, this block: %i, header block: %i\\n",\n               chan, wc->chan);\n        return AVERROR_INVALIDDATA;\n    }\n    if (wc->flags && rate != -1 && rate != wc->rate) {\n        av_log(ctx, AV_LOG_ERROR,\n               "Sampling rate differ, this block: %i, header block: %i\\n",\n               rate, wc->rate);\n        return AVERROR_INVALIDDATA;\n    }\n    wc->blksize = size - 24;\n    return 0;\n}']