libavformat/xmv.c:536: error: Integer Overflow L2
  ([8, +oo] - [8, 524292]):unsigned32.

libavformat/xmv.c:498:20: <LHS trace>
496. 
497.     /* Read the frame header */
498.     frame_header = avio_rl32(pb);
                        ^
499. 
500.     frame_size      = (frame_header & 0x1FFFF) * 4 + 4;

libavformat/xmv.c:498:20: Call
496. 
497.     /* Read the frame header */
498.     frame_header = avio_rl32(pb);
                        ^
499. 
500.     frame_size      = (frame_header & 0x1FFFF) * 4 + 4;

libavformat/aviobuf.c:668:11: Call
  666. {
  667.     unsigned int val;
  668.     val = avio_rl16(s);
                 ^
  669.     val |= avio_rl16(s) << 16;
  670.     return val;

libavformat/aviobuf.c:652:11: Call
    650. {
    651.     unsigned int val;
    652.     val = avio_r8(s);
                   ^
    653.     val |= avio_r8(s) << 8;
    654.     return val;

libavformat/aviobuf.c:542:5: Assignment
      540.     if (s->buf_ptr < s->buf_end)
      541.         return *s->buf_ptr++;
      542.     return 0;
               ^
      543. }
      544. 

libavformat/aviobuf.c:652:5: Assignment
    650. {
    651.     unsigned int val;
    652.     val = avio_r8(s);
             ^
    653.     val |= avio_r8(s) << 8;
    654.     return val;

libavformat/aviobuf.c:653:5: Assignment
    651.     unsigned int val;
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
             ^
    654.     return val;
    655. }

libavformat/aviobuf.c:654:5: Assignment
    652.     val = avio_r8(s);
    653.     val |= avio_r8(s) << 8;
    654.     return val;
             ^
    655. }
    656. 

libavformat/aviobuf.c:668:5: Assignment
  666. {
  667.     unsigned int val;
  668.     val = avio_rl16(s);
           ^
  669.     val |= avio_rl16(s) << 16;
  670.     return val;

libavformat/aviobuf.c:669:5: Assignment
  667.     unsigned int val;
  668.     val = avio_rl16(s);
  669.     val |= avio_rl16(s) << 16;
           ^
  670.     return val;
  671. }

libavformat/aviobuf.c:670:5: Assignment
  668.     val = avio_rl16(s);
  669.     val |= avio_rl16(s) << 16;
  670.     return val;
           ^
  671. }
  672. 

libavformat/xmv.c:498:5: Assignment
496. 
497.     /* Read the frame header */
498.     frame_header = avio_rl32(pb);
         ^
499. 
500.     frame_size      = (frame_header & 0x1FFFF) * 4 + 4;

libavformat/xmv.c:500:5: Assignment
498.     frame_header = avio_rl32(pb);
499. 
500.     frame_size      = (frame_header & 0x1FFFF) * 4 + 4;
         ^
501.     frame_timestamp = (frame_header >> 17);
502. 

libavformat/xmv.c:515:10: <RHS trace>
513.      * TODO: This manual swap is of course suboptimal.
514.      */
515.     for (i = 0; i < frame_size; i += 4) {
              ^
516.         uint32_t val = avio_rl32(pb);
517.         AV_WB32(pkt->data + i, val);

libavformat/xmv.c:515:10: Assignment
513.      * TODO: This manual swap is of course suboptimal.
514.      */
515.     for (i = 0; i < frame_size; i += 4) {
              ^
516.         uint32_t val = avio_rl32(pb);
517.         AV_WB32(pkt->data + i, val);

libavformat/xmv.c:536:5: Binary operation: ([8, +oo] - [8, 524292]):unsigned32
534. 
535.     /* Advance offset */
536.     video->data_size   -= frame_size + 4;
         ^
537.     video->data_offset += frame_size + 4;
538. 

static int xmv_fetch_video_packet(AVFormatContext *s,
                                  AVPacket *pkt)
{
    XMVDemuxContext *xmv   = s->priv_data;
    AVIOContext     *pb    = s->pb;
    XMVVideoPacket  *video = &xmv->video;
    int result;
    uint32_t frame_header;
    uint32_t frame_size, frame_timestamp;
    uint32_t i;
    if (avio_seek(pb, video->data_offset, SEEK_SET) != video->data_offset)
        return AVERROR(EIO);
    frame_header = avio_rl32(pb);
    frame_size      = (frame_header & 0x1FFFF) * 4 + 4;
    frame_timestamp = (frame_header >> 17);
    if ((frame_size + 4) > video->data_size)
        return AVERROR(EIO);
    result = av_new_packet(pkt, frame_size);
    if (result)
        return result;
    for (i = 0; i < frame_size; i += 4) {
        uint32_t val = avio_rl32(pb);
        AV_WB32(pkt->data + i, val);
    }
    pkt->stream_index = video->stream_index;
    video->last_pts = frame_timestamp + video->pts;
    pkt->duration = 0;
    pkt->pts      = video->last_pts;
    pkt->dts      = AV_NOPTS_VALUE;
    video->pts += frame_timestamp;
    pkt->flags = (pkt->data[0] & 0x80) ? 0 : AV_PKT_FLAG_KEY;
    video->data_size   -= frame_size + 4;
    video->data_offset += frame_size + 4;
    return 0;
}
['static int xmv_fetch_video_packet(AVFormatContext *s,\n                                  AVPacket *pkt)\n{\n    XMVDemuxContext *xmv   = s->priv_data;\n    AVIOContext     *pb    = s->pb;\n    XMVVideoPacket  *video = &xmv->video;\n    int result;\n    uint32_t frame_header;\n    uint32_t frame_size, frame_timestamp;\n    uint32_t i;\n    if (avio_seek(pb, video->data_offset, SEEK_SET) != video->data_offset)\n        return AVERROR(EIO);\n    frame_header = avio_rl32(pb);\n    frame_size      = (frame_header & 0x1FFFF) * 4 + 4;\n    frame_timestamp = (frame_header >> 17);\n    if ((frame_size + 4) > video->data_size)\n        return AVERROR(EIO);\n    result = av_new_packet(pkt, frame_size);\n    if (result)\n        return result;\n    for (i = 0; i < frame_size; i += 4) {\n        uint32_t val = avio_rl32(pb);\n        AV_WB32(pkt->data + i, val);\n    }\n    pkt->stream_index = video->stream_index;\n    video->last_pts = frame_timestamp + video->pts;\n    pkt->duration = 0;\n    pkt->pts      = video->last_pts;\n    pkt->dts      = AV_NOPTS_VALUE;\n    video->pts += frame_timestamp;\n    pkt->flags = (pkt->data[0] & 0x80) ? 0 : AV_PKT_FLAG_KEY;\n    video->data_size   -= frame_size + 4;\n    video->data_offset += frame_size + 4;\n    return 0;\n}', 'unsigned int avio_rl32(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rl16(s);\n    val |= avio_rl16(s) << 16;\n    return val;\n}', 'unsigned int avio_rl16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s);\n    val |= avio_r8(s) << 8;\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}']