libavformat/idroq.c:186: error: Integer Overflow L2
  ([-oo, 2147483655] + 64):signed32 by call to `av_new_packet`.

libavformat/idroq.c:123:9: Assignment
121. 
122.         chunk_type = AV_RL16(&preamble[0]);
123.         chunk_size = AV_RL32(&preamble[2]);
             ^
124.         if(chunk_size > INT_MAX)
125.             return AVERROR_INVALIDDATA;

libavformat/idroq.c:186:17: Call
184.         case RoQ_QUAD_VQ:
185.             /* load up the packet */
186.             if (av_new_packet(pkt, chunk_size + RoQ_CHUNK_PREAMBLE_SIZE))
                     ^
187.                 return AVERROR(EIO);
188.             /* copy over preamble */

libavcodec/avpacket.c:48:1: <LHS trace>
46. }
47. 
48. int av_new_packet(AVPacket *pkt, int size)
    ^
49. {
50.     uint8_t *data= NULL;

libavcodec/avpacket.c:48:1: Parameter `size`
  46. }
  47. 
  48. int av_new_packet(AVPacket *pkt, int size)
      ^
  49. {
  50.     uint8_t *data= NULL;

libavcodec/avpacket.c:52:16: Binary operation: ([-oo, 2147483655] + 64):signed32 by call to `av_new_packet` 
  50.     uint8_t *data= NULL;
  51.     if((unsigned)size < (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE)
  52.         data = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);
                     ^
  53.     if (data){
  54.         memset(data + size, 0, FF_INPUT_BUFFER_PADDING_SIZE);

int av_new_packet(AVPacket *pkt, int size)
{
    uint8_t *data= NULL;
    if((unsigned)size < (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE)
        data = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);
    if (data){
        memset(data + size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
    }else
        size=0;
    av_init_packet(pkt);
    pkt->data = data;
    pkt->size = size;
    pkt->destruct = av_destruct_packet;
    if(!data)
        return AVERROR(ENOMEM);
    return 0;
}
['static int roq_read_packet(AVFormatContext *s,\n                           AVPacket *pkt)\n{\n    RoqDemuxContext *roq = s->priv_data;\n    ByteIOContext *pb = s->pb;\n    int ret = 0;\n    unsigned int chunk_size;\n    unsigned int chunk_type;\n    unsigned int codebook_size;\n    unsigned char preamble[RoQ_CHUNK_PREAMBLE_SIZE];\n    int packet_read = 0;\n    int64_t codebook_offset;\n    while (!packet_read) {\n        if (url_feof(s->pb))\n            return AVERROR(EIO);\n        if ((ret = get_buffer(pb, preamble, RoQ_CHUNK_PREAMBLE_SIZE)) !=\n            RoQ_CHUNK_PREAMBLE_SIZE)\n            return AVERROR(EIO);\n        chunk_type = AV_RL16(&preamble[0]);\n        chunk_size = AV_RL32(&preamble[2]);\n        if(chunk_size > INT_MAX)\n            return AVERROR_INVALIDDATA;\n        switch (chunk_type) {\n        case RoQ_INFO:\n            if (!roq->width || !roq->height) {\n                AVStream *st = s->streams[roq->video_stream_index];\n                if (get_buffer(pb, preamble, RoQ_CHUNK_PREAMBLE_SIZE) != RoQ_CHUNK_PREAMBLE_SIZE)\n                    return AVERROR(EIO);\n                st->codec->width  = roq->width  = AV_RL16(preamble);\n                st->codec->height = roq->height = AV_RL16(preamble + 2);\n                break;\n            }\n            url_fseek(pb, RoQ_CHUNK_PREAMBLE_SIZE, SEEK_CUR);\n            break;\n        case RoQ_QUAD_CODEBOOK:\n            codebook_offset = url_ftell(pb) - RoQ_CHUNK_PREAMBLE_SIZE;\n            codebook_size = chunk_size;\n            url_fseek(pb, codebook_size, SEEK_CUR);\n            if (get_buffer(pb, preamble, RoQ_CHUNK_PREAMBLE_SIZE) !=\n                RoQ_CHUNK_PREAMBLE_SIZE)\n                return AVERROR(EIO);\n            chunk_size = AV_RL32(&preamble[2]) + RoQ_CHUNK_PREAMBLE_SIZE * 2 +\n                codebook_size;\n            url_fseek(pb, codebook_offset, SEEK_SET);\n            ret= av_get_packet(pb, pkt, chunk_size);\n            if (ret != chunk_size)\n                return AVERROR(EIO);\n            pkt->stream_index = roq->video_stream_index;\n            pkt->pts = roq->video_pts++;\n            packet_read = 1;\n            break;\n        case RoQ_SOUND_MONO:\n        case RoQ_SOUND_STEREO:\n            if (roq->audio_stream_index == -1) {\n                AVStream *st = av_new_stream(s, 1);\n                if (!st)\n                    return AVERROR(ENOMEM);\n                av_set_pts_info(st, 32, 1, RoQ_AUDIO_SAMPLE_RATE);\n                roq->audio_stream_index = st->index;\n                st->codec->codec_type = CODEC_TYPE_AUDIO;\n                st->codec->codec_id = CODEC_ID_ROQ_DPCM;\n                st->codec->codec_tag = 0;\n                st->codec->channels = roq->audio_channels = chunk_type == RoQ_SOUND_STEREO ? 2 : 1;\n                st->codec->sample_rate = RoQ_AUDIO_SAMPLE_RATE;\n                st->codec->bits_per_coded_sample = 16;\n                st->codec->bit_rate = st->codec->channels * st->codec->sample_rate *\n                    st->codec->bits_per_coded_sample;\n                st->codec->block_align = st->codec->channels * st->codec->bits_per_coded_sample;\n            }\n        case RoQ_QUAD_VQ:\n            if (av_new_packet(pkt, chunk_size + RoQ_CHUNK_PREAMBLE_SIZE))\n                return AVERROR(EIO);\n            memcpy(pkt->data, preamble, RoQ_CHUNK_PREAMBLE_SIZE);\n            if (chunk_type == RoQ_QUAD_VQ) {\n                pkt->stream_index = roq->video_stream_index;\n                pkt->pts = roq->video_pts++;\n            } else {\n                pkt->stream_index = roq->audio_stream_index;\n                pkt->pts = roq->audio_frame_count;\n                roq->audio_frame_count += (chunk_size / roq->audio_channels);\n            }\n            pkt->pos= url_ftell(pb);\n            ret = get_buffer(pb, pkt->data + RoQ_CHUNK_PREAMBLE_SIZE,\n                chunk_size);\n            if (ret != chunk_size)\n                ret = AVERROR(EIO);\n            packet_read = 1;\n            break;\n        default:\n            av_log(s, AV_LOG_ERROR, "  unknown RoQ chunk (%04X)\\n", chunk_type);\n            return AVERROR_INVALIDDATA;\n            break;\n        }\n    }\n    return ret;\n}', 'int av_new_packet(AVPacket *pkt, int size)\n{\n    uint8_t *data= NULL;\n    if((unsigned)size < (unsigned)size + FF_INPUT_BUFFER_PADDING_SIZE)\n        data = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE);\n    if (data){\n        memset(data + size, 0, FF_INPUT_BUFFER_PADDING_SIZE);\n    }else\n        size=0;\n    av_init_packet(pkt);\n    pkt->data = data;\n    pkt->size = size;\n    pkt->destruct = av_destruct_packet;\n    if(!data)\n        return AVERROR(ENOMEM);\n    return 0;\n}']