libavcodec/vorbis_dec.c:836: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned64 by call to `vorbis_parse_setup_hdr_residues`.

libavcodec/vorbis_dec.c:824:9: Call
822.     }
823. 
824.     if (vorbis_parse_setup_hdr_codebooks(vc)) {
             ^
825.         av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (codebooks). \n");
826.         return -2;

libavcodec/vorbis_dec.c:248:10: Assignment
  246.     tmp_vlc_codes = av_mallocz(V_MAX_VLCS * sizeof(uint32_t));
  247. 
  248.     for (cb = 0; cb < vc->codebook_count; ++cb) {
                ^
  249.         vorbis_codebook *codebook_setup = &vc->codebooks[cb];
  250.         uint_fast8_t ordered;

libavcodec/vorbis_dec.c:836:9: Call
834.         return -4;
835.     }
836.     if (vorbis_parse_setup_hdr_residues(vc)) {
             ^
837.         av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (residues). \n");
838.         return -5;

libavcodec/vorbis_dec.c:623:1: <LHS trace>
621. // Process residues part
622. 
623. static int vorbis_parse_setup_hdr_residues(vorbis_context *vc)
     ^
624. {
625.     GetBitContext *gb = &vc->gb;

libavcodec/vorbis_dec.c:623:1: Parameter `vc->codebook_count`
  621. // Process residues part
  622. 
  623. static int vorbis_parse_setup_hdr_residues(vorbis_context *vc)
       ^
  624. {
  625.     GetBitContext *gb = &vc->gb;

libavcodec/vorbis_dec.c:655:9: Binary operation: ([0, +oo] - 1):unsigned64 by call to `vorbis_parse_setup_hdr_residues` 
  653. 
  654.         res_setup->classifications = get_bits(gb, 6) + 1;
  655.         GET_VALIDATED_INDEX(res_setup->classbook, 8, vc->codebook_count)
               ^
  656. 
  657.         AV_DEBUG("    begin %d end %d part.size %d classif.s %d classbook %d \n", res_setup->begin, res_setup->end, res_setup->partition_size,

static int vorbis_parse_setup_hdr_residues(vorbis_context *vc)
{
    GetBitContext *gb = &vc->gb;
    uint_fast8_t i, j, k;
    vc->residue_count = get_bits(gb, 6)+1;
    vc->residues      = av_mallocz(vc->residue_count * sizeof(vorbis_residue));
    AV_DEBUG(" There are %d residues. \n", vc->residue_count);
    for (i = 0; i < vc->residue_count; ++i) {
        vorbis_residue *res_setup = &vc->residues[i];
        uint_fast8_t cascade[64];
        uint_fast8_t high_bits;
        uint_fast8_t low_bits;
        res_setup->type = get_bits(gb, 16);
        AV_DEBUG(" %d. residue type %d \n", i, res_setup->type);
        res_setup->begin          = get_bits(gb, 24);
        res_setup->end            = get_bits(gb, 24);
        res_setup->partition_size = get_bits(gb, 24) + 1;
        if (res_setup->begin>res_setup->end ||
            res_setup->end>vc->blocksize[1] / (res_setup->type == 2 ? 1 : 2) ||
            (res_setup->end-res_setup->begin) / res_setup->partition_size > V_MAX_PARTITIONS) {
            av_log(vc->avccontext, AV_LOG_ERROR, "partition out of bounds: type, begin, end, size, blocksize: %"PRIdFAST16", %"PRIdFAST32", %"PRIdFAST32", %"PRIdFAST32", %"PRIdFAST32"\n", res_setup->type, res_setup->begin, res_setup->end, res_setup->partition_size, vc->blocksize[1] / 2);
            return -1;
        }
        res_setup->classifications = get_bits(gb, 6) + 1;
        GET_VALIDATED_INDEX(res_setup->classbook, 8, vc->codebook_count)
        AV_DEBUG("    begin %d end %d part.size %d classif.s %d classbook %d \n", res_setup->begin, res_setup->end, res_setup->partition_size,
          res_setup->classifications, res_setup->classbook);
        for (j = 0; j < res_setup->classifications; ++j) {
            high_bits = 0;
            low_bits  = get_bits(gb, 3);
            if (get_bits1(gb))
                high_bits = get_bits(gb, 5);
            cascade[j] = (high_bits << 3) + low_bits;
            AV_DEBUG("     %d class casscade depth: %d \n", j, ilog(cascade[j]));
        }
        res_setup->maxpass = 0;
        for (j = 0; j < res_setup->classifications; ++j) {
            for (k = 0; k < 8; ++k) {
                if (cascade[j]&(1 << k)) {
                    GET_VALIDATED_INDEX(res_setup->books[j][k], 8, vc->codebook_count)
                    AV_DEBUG("     %d class casscade depth %d book: %d \n", j, k, res_setup->books[j][k]);
                    if (k>res_setup->maxpass)
                        res_setup->maxpass = k;
                } else {
                    res_setup->books[j][k] = -1;
                }
            }
        }
    }
    return 0;
}
['static int vorbis_parse_setup_hdr(vorbis_context *vc)\n{\n    GetBitContext *gb = &vc->gb;\n    if ((get_bits(gb, 8) != \'v\') || (get_bits(gb, 8) != \'o\') ||\n        (get_bits(gb, 8) != \'r\') || (get_bits(gb, 8) != \'b\') ||\n        (get_bits(gb, 8) != \'i\') || (get_bits(gb, 8) != \'s\')) {\n        av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (no vorbis signature). \\n");\n        return -1;\n    }\n    if (vorbis_parse_setup_hdr_codebooks(vc)) {\n        av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (codebooks). \\n");\n        return -2;\n    }\n    if (vorbis_parse_setup_hdr_tdtransforms(vc)) {\n        av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (time domain transforms). \\n");\n        return -3;\n    }\n    if (vorbis_parse_setup_hdr_floors(vc)) {\n        av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (floors). \\n");\n        return -4;\n    }\n    if (vorbis_parse_setup_hdr_residues(vc)) {\n        av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (residues). \\n");\n        return -5;\n    }\n    if (vorbis_parse_setup_hdr_mappings(vc)) {\n        av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (mappings). \\n");\n        return -6;\n    }\n    if (vorbis_parse_setup_hdr_modes(vc)) {\n        av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (modes). \\n");\n        return -7;\n    }\n    if (!get_bits1(gb)) {\n        av_log(vc->avccontext, AV_LOG_ERROR, " Vorbis setup header packet corrupt (framing flag). \\n");\n        return -8;\n    }\n    return 0;\n}', 'static int vorbis_parse_setup_hdr_codebooks(vorbis_context *vc)\n{\n    uint_fast16_t cb;\n    uint8_t  *tmp_vlc_bits;\n    uint32_t *tmp_vlc_codes;\n    GetBitContext *gb = &vc->gb;\n    vc->codebook_count = get_bits(gb, 8) + 1;\n    AV_DEBUG(" Codebooks: %d \\n", vc->codebook_count);\n    vc->codebooks = av_mallocz(vc->codebook_count * sizeof(vorbis_codebook));\n    tmp_vlc_bits  = av_mallocz(V_MAX_VLCS * sizeof(uint8_t));\n    tmp_vlc_codes = av_mallocz(V_MAX_VLCS * sizeof(uint32_t));\n    for (cb = 0; cb < vc->codebook_count; ++cb) {\n        vorbis_codebook *codebook_setup = &vc->codebooks[cb];\n        uint_fast8_t ordered;\n        uint_fast32_t t, used_entries = 0;\n        uint_fast32_t entries;\n        AV_DEBUG(" %d. Codebook \\n", cb);\n        if (get_bits(gb, 24) != 0x564342) {\n            av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook setup data corrupt. \\n", cb);\n            goto error;\n        }\n        codebook_setup->dimensions=get_bits(gb, 16);\n        if (codebook_setup->dimensions > 16 || codebook_setup->dimensions == 0) {\n            av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook\'s dimension is invalid (%d). \\n", cb, codebook_setup->dimensions);\n            goto error;\n        }\n        entries = get_bits(gb, 24);\n        if (entries > V_MAX_VLCS) {\n            av_log(vc->avccontext, AV_LOG_ERROR, " %"PRIdFAST16". Codebook has too many entries (%"PRIdFAST32"). \\n", cb, entries);\n            goto error;\n        }\n        ordered = get_bits1(gb);\n        AV_DEBUG(" codebook_dimensions %d, codebook_entries %d \\n", codebook_setup->dimensions, entries);\n        if (!ordered) {\n            uint_fast16_t ce;\n            uint_fast8_t  flag;\n            uint_fast8_t  sparse = get_bits1(gb);\n            AV_DEBUG(" not ordered \\n");\n            if (sparse) {\n                AV_DEBUG(" sparse \\n");\n                used_entries = 0;\n                for (ce = 0; ce < entries; ++ce) {\n                    flag = get_bits1(gb);\n                    if (flag) {\n                        tmp_vlc_bits[ce] = get_bits(gb, 5) + 1;\n                        ++used_entries;\n                    } else\n                        tmp_vlc_bits[ce] = 0;\n                }\n            } else {\n                AV_DEBUG(" not sparse \\n");\n                used_entries = entries;\n                for (ce = 0; ce < entries; ++ce)\n                    tmp_vlc_bits[ce] = get_bits(gb, 5) + 1;\n            }\n        } else {\n            uint_fast16_t current_entry = 0;\n            uint_fast8_t current_length = get_bits(gb, 5)+1;\n            AV_DEBUG(" ordered, current length: %d \\n", current_length);\n            used_entries = entries;\n            for (; current_entry < used_entries && current_length <= 32; ++current_length) {\n                uint_fast16_t i, number;\n                AV_DEBUG(" number bits: %d ", ilog(entries - current_entry));\n                number = get_bits(gb, ilog(entries - current_entry));\n                AV_DEBUG(" number: %d \\n", number);\n                for (i = current_entry; i < number+current_entry; ++i)\n                    if (i < used_entries)\n                        tmp_vlc_bits[i] = current_length;\n                current_entry+=number;\n            }\n            if (current_entry>used_entries) {\n                av_log(vc->avccontext, AV_LOG_ERROR, " More codelengths than codes in codebook. \\n");\n                goto error;\n            }\n        }\n        codebook_setup->lookup_type = get_bits(gb, 4);\n        AV_DEBUG(" lookup type: %d : %s \\n", codebook_setup->lookup_type, codebook_setup->lookup_type ? "vq" : "no lookup");\n        if (codebook_setup->lookup_type == 1) {\n            uint_fast16_t i, j, k;\n            uint_fast16_t codebook_lookup_values = ff_vorbis_nth_root(entries, codebook_setup->dimensions);\n            uint_fast16_t codebook_multiplicands[codebook_lookup_values];\n            float codebook_minimum_value = vorbisfloat2float(get_bits_long(gb, 32));\n            float codebook_delta_value   = vorbisfloat2float(get_bits_long(gb, 32));\n            uint_fast8_t codebook_value_bits = get_bits(gb, 4)+1;\n            uint_fast8_t codebook_sequence_p = get_bits1(gb);\n            AV_DEBUG(" We expect %d numbers for building the codevectors. \\n", codebook_lookup_values);\n            AV_DEBUG("  delta %f minmum %f \\n", codebook_delta_value, codebook_minimum_value);\n            for (i = 0; i < codebook_lookup_values; ++i) {\n                codebook_multiplicands[i] = get_bits(gb, codebook_value_bits);\n                AV_DEBUG(" multiplicands*delta+minmum : %e \\n", (float)codebook_multiplicands[i]*codebook_delta_value+codebook_minimum_value);\n                AV_DEBUG(" multiplicand %d \\n", codebook_multiplicands[i]);\n            }\n            codebook_setup->codevectors = used_entries ? av_mallocz(used_entries*codebook_setup->dimensions * sizeof(float)) : NULL;\n            for (j = 0, i = 0; i < entries; ++i) {\n                uint_fast8_t dim = codebook_setup->dimensions;\n                if (tmp_vlc_bits[i]) {\n                    float last = 0.0;\n                    uint_fast32_t lookup_offset = i;\n#ifdef V_DEBUG\n                    av_log(vc->avccontext, AV_LOG_INFO, "Lookup offset %d ,", i);\n#endif\n                    for (k = 0; k < dim; ++k) {\n                        uint_fast32_t multiplicand_offset = lookup_offset % codebook_lookup_values;\n                        codebook_setup->codevectors[j * dim + k] = codebook_multiplicands[multiplicand_offset] * codebook_delta_value + codebook_minimum_value + last;\n                        if (codebook_sequence_p)\n                            last = codebook_setup->codevectors[j * dim + k];\n                        lookup_offset/=codebook_lookup_values;\n                    }\n                    tmp_vlc_bits[j] = tmp_vlc_bits[i];\n#ifdef V_DEBUG\n                    av_log(vc->avccontext, AV_LOG_INFO, "real lookup offset %d, vector: ", j);\n                    for (k = 0; k < dim; ++k)\n                        av_log(vc->avccontext, AV_LOG_INFO, " %f ", codebook_setup->codevectors[j * dim + k]);\n                    av_log(vc->avccontext, AV_LOG_INFO, "\\n");\n#endif\n                    ++j;\n                }\n            }\n            if (j != used_entries) {\n                av_log(vc->avccontext, AV_LOG_ERROR, "Bug in codevector vector building code. \\n");\n                goto error;\n            }\n            entries = used_entries;\n        } else if (codebook_setup->lookup_type >= 2) {\n            av_log(vc->avccontext, AV_LOG_ERROR, "Codebook lookup type not supported. \\n");\n            goto error;\n        }\n        if (ff_vorbis_len2vlc(tmp_vlc_bits, tmp_vlc_codes, entries)) {\n            av_log(vc->avccontext, AV_LOG_ERROR, " Invalid code lengths while generating vlcs. \\n");\n            goto error;\n        }\n        codebook_setup->maxdepth = 0;\n        for (t = 0; t < entries; ++t)\n            if (tmp_vlc_bits[t] >= codebook_setup->maxdepth)\n                codebook_setup->maxdepth = tmp_vlc_bits[t];\n        if (codebook_setup->maxdepth > 3 * V_NB_BITS)\n            codebook_setup->nb_bits = V_NB_BITS2;\n        else\n            codebook_setup->nb_bits = V_NB_BITS;\n        codebook_setup->maxdepth = (codebook_setup->maxdepth+codebook_setup->nb_bits - 1) / codebook_setup->nb_bits;\n        if (init_vlc(&codebook_setup->vlc, codebook_setup->nb_bits, entries, tmp_vlc_bits, sizeof(*tmp_vlc_bits), sizeof(*tmp_vlc_bits), tmp_vlc_codes, sizeof(*tmp_vlc_codes), sizeof(*tmp_vlc_codes), INIT_VLC_LE)) {\n            av_log(vc->avccontext, AV_LOG_ERROR, " Error generating vlc tables. \\n");\n            goto error;\n        }\n    }\n    av_free(tmp_vlc_bits);\n    av_free(tmp_vlc_codes);\n    return 0;\nerror:\n    av_free(tmp_vlc_bits);\n    av_free(tmp_vlc_codes);\n    return -1;\n}', 'static int vorbis_parse_setup_hdr_residues(vorbis_context *vc)\n{\n    GetBitContext *gb = &vc->gb;\n    uint_fast8_t i, j, k;\n    vc->residue_count = get_bits(gb, 6)+1;\n    vc->residues      = av_mallocz(vc->residue_count * sizeof(vorbis_residue));\n    AV_DEBUG(" There are %d residues. \\n", vc->residue_count);\n    for (i = 0; i < vc->residue_count; ++i) {\n        vorbis_residue *res_setup = &vc->residues[i];\n        uint_fast8_t cascade[64];\n        uint_fast8_t high_bits;\n        uint_fast8_t low_bits;\n        res_setup->type = get_bits(gb, 16);\n        AV_DEBUG(" %d. residue type %d \\n", i, res_setup->type);\n        res_setup->begin          = get_bits(gb, 24);\n        res_setup->end            = get_bits(gb, 24);\n        res_setup->partition_size = get_bits(gb, 24) + 1;\n        if (res_setup->begin>res_setup->end ||\n            res_setup->end>vc->blocksize[1] / (res_setup->type == 2 ? 1 : 2) ||\n            (res_setup->end-res_setup->begin) / res_setup->partition_size > V_MAX_PARTITIONS) {\n            av_log(vc->avccontext, AV_LOG_ERROR, "partition out of bounds: type, begin, end, size, blocksize: %"PRIdFAST16", %"PRIdFAST32", %"PRIdFAST32", %"PRIdFAST32", %"PRIdFAST32"\\n", res_setup->type, res_setup->begin, res_setup->end, res_setup->partition_size, vc->blocksize[1] / 2);\n            return -1;\n        }\n        res_setup->classifications = get_bits(gb, 6) + 1;\n        GET_VALIDATED_INDEX(res_setup->classbook, 8, vc->codebook_count)\n        AV_DEBUG("    begin %d end %d part.size %d classif.s %d classbook %d \\n", res_setup->begin, res_setup->end, res_setup->partition_size,\n          res_setup->classifications, res_setup->classbook);\n        for (j = 0; j < res_setup->classifications; ++j) {\n            high_bits = 0;\n            low_bits  = get_bits(gb, 3);\n            if (get_bits1(gb))\n                high_bits = get_bits(gb, 5);\n            cascade[j] = (high_bits << 3) + low_bits;\n            AV_DEBUG("     %d class casscade depth: %d \\n", j, ilog(cascade[j]));\n        }\n        res_setup->maxpass = 0;\n        for (j = 0; j < res_setup->classifications; ++j) {\n            for (k = 0; k < 8; ++k) {\n                if (cascade[j]&(1 << k)) {\n                    GET_VALIDATED_INDEX(res_setup->books[j][k], 8, vc->codebook_count)\n                    AV_DEBUG("     %d class casscade depth %d book: %d \\n", j, k, res_setup->books[j][k]);\n                    if (k>res_setup->maxpass)\n                        res_setup->maxpass = k;\n                } else {\n                    res_setup->books[j][k] = -1;\n                }\n            }\n        }\n    }\n    return 0;\n}']