libavformat/asfdec.c:1255: error: Integer Overflow L1
  ([max(0, `s->priv_data->nb_mult_left`), min(0, `s->priv_data->nb_mult_left`)] - 1):unsigned64 by call to `asf_read_subpayload`.

libavformat/asfdec.c:1211:1: Parameter `s->priv_data->nb_mult_left`
1209. }
1210. 
1211. static int asf_read_payload(AVFormatContext *s, AVPacket *pkt)
      ^
1212. {
1213.     ASFContext *asf = s->priv_data;

libavformat/asfdec.c:1255:24: Call
1253.             asf->state    = READ_SINGLE;
1254.             pkt->flags    = asf_pkt->flags;
1255.             if ((ret = asf_read_subpayload(s, pkt, 1)) < 0)
                             ^
1256.                 return ret;
1257.         } else {

libavformat/asfdec.c:1035:1: <LHS trace>
1033.     } while(0)
1034. 
1035. static int asf_read_subpayload(AVFormatContext *s, AVPacket *pkt, int is_header)
      ^
1036. {
1037.     ASFContext *asf = s->priv_data;

libavformat/asfdec.c:1035:1: Parameter `s->priv_data->nb_mult_left`
  1033.     } while(0)
  1034. 
  1035. static int asf_read_subpayload(AVFormatContext *s, AVPacket *pkt, int is_header)
        ^
  1036. {
  1037.     ASFContext *asf = s->priv_data;

libavformat/asfdec.c:1070:9: Binary operation: ([max(0, s->priv_data->nb_mult_left), min(0, s->priv_data->nb_mult_left)] - 1):unsigned64 by call to `asf_read_subpayload` 
  1068.                               (asf->sub_header_offset + asf->mult_sub_len))) {
  1069.         asf->sub_left = 0;
  1070.         asf->nb_mult_left--;
                ^
  1071.     }
  1072.     if (avio_tell(pb) >= asf->packet_offset + asf->packet_size - asf->pad_len) {

static int asf_read_subpayload(AVFormatContext *s, AVPacket *pkt, int is_header)
{
    ASFContext *asf = s->priv_data;
    AVIOContext *pb = s->pb;
    uint8_t sub_len;
    int ret, i;
    if (is_header) {
        asf->dts_delta = avio_r8(pb);
        if (asf->nb_mult_left) {
            asf->mult_sub_len = avio_rl16(pb);
        }
        asf->sub_header_offset = avio_tell(pb);
        asf->nb_sub = 0;
        asf->sub_left = 1;
    }
    sub_len = avio_r8(pb);
    if ((ret = av_get_packet(pb, pkt, sub_len)) < 0)
        return ret;
    for (i = 0; i < asf->nb_streams; i++) {
        if (asf->stream_index == asf->asf_st[i]->stream_index) {
            pkt->stream_index  = asf->asf_st[i]->index;
            break;
        }
    }
    asf->return_subpayload = 1;
    if (!sub_len)
        asf->return_subpayload = 0;
    if (sub_len)
        asf->nb_sub++;
    pkt->dts = asf->sub_dts + (asf->nb_sub - 1) * asf->dts_delta - asf->preroll;
    if (asf->nb_mult_left && (avio_tell(pb) >=
                              (asf->sub_header_offset + asf->mult_sub_len))) {
        asf->sub_left = 0;
        asf->nb_mult_left--;
    }
    if (avio_tell(pb) >= asf->packet_offset + asf->packet_size - asf->pad_len) {
        asf->sub_left = 0;
        if (!asf->nb_mult_left) {
            avio_skip(pb, asf->pad_len);
            if (avio_tell(pb) != asf->packet_offset + asf->packet_size) {
                if (!asf->packet_size)
                    return AVERROR_INVALIDDATA;
                av_log(s, AV_LOG_WARNING,
                       "Position %"PRId64" wrong, should be %"PRId64"\n",
                       avio_tell(pb), asf->packet_offset + asf->packet_size);
                avio_seek(pb, asf->packet_offset + asf->packet_size, SEEK_SET);
            }
        }
    }
    return 0;
}
['static int asf_read_payload(AVFormatContext *s, AVPacket *pkt)\n{\n    ASFContext *asf = s->priv_data;\n    AVIOContext *pb = s->pb;\n    int ret, i;\n    ASFPacket *asf_pkt = NULL;\n    if (!asf->sub_left) {\n        uint32_t off_len, media_len;\n        uint8_t stream_num;\n        stream_num = avio_r8(pb);\n        asf->stream_index = stream_num & ASF_STREAM_NUM;\n        for (i = 0; i < asf->nb_streams; i++) {\n            if (asf->stream_index == asf->asf_st[i]->stream_index) {\n                asf_pkt               = &asf->asf_st[i]->pkt;\n                asf_pkt->stream_index = asf->asf_st[i]->index;\n                asf_pkt->dts          = asf->dts;\n                break;\n            }\n        }\n        if (!asf_pkt)\n            return AVERROR_INVALIDDATA;\n        if (stream_num >> 7)\n            asf_pkt->flags |= AV_PKT_FLAG_KEY;\n        READ_LEN(asf->prop_flags & ASF_PL_MASK_MEDIA_OBJECT_NUMBER_LENGTH_FIELD_SIZE,\n                 ASF_PL_FLAG_MEDIA_OBJECT_NUMBER_LENGTH_FIELD_, media_len);\n        READ_LEN(asf->prop_flags & ASF_PL_MASK_OFFSET_INTO_MEDIA_OBJECT_LENGTH_FIELD_SIZE,\n                 ASF_PL_FLAG_OFFSET_INTO_MEDIA_OBJECT_LENGTH_FIELD_, off_len);\n        READ_LEN(asf->prop_flags & ASF_PL_MASK_REPLICATED_DATA_LENGTH_FIELD_SIZE,\n                 ASF_PL_FLAG_REPLICATED_DATA_LENGTH_FIELD_, asf->rep_data_len);\n        if (asf_pkt->size_left && (asf_pkt->frame_num != media_len)) {\n            av_log(s, AV_LOG_WARNING, "Unfinished frame will be ignored\\n");\n            reset_packet(asf_pkt);\n        }\n        asf_pkt->frame_num = media_len;\n        asf->sub_dts = off_len;\n        if (asf->nb_mult_left) {\n            if ((ret = asf_read_multiple_payload(s, pkt, asf_pkt)) < 0)\n                return ret;\n        } else if (asf->rep_data_len == 1) {\n            asf->sub_left = 1;\n            asf->state    = READ_SINGLE;\n            pkt->flags    = asf_pkt->flags;\n            if ((ret = asf_read_subpayload(s, pkt, 1)) < 0)\n                return ret;\n        } else {\n            if ((ret = asf_read_single_payload(s, pkt, asf_pkt)) < 0)\n                return ret;\n        }\n    } else {\n        for (i = 0; i <= asf->nb_streams; i++) {\n            if (asf->stream_index == asf->asf_st[i]->stream_index) {\n                asf_pkt = &asf->asf_st[i]->pkt;\n                break;\n            }\n        }\n        if (!asf_pkt)\n            return AVERROR_INVALIDDATA;\n        pkt->flags         = asf_pkt->flags;\n        pkt->dts           = asf_pkt->dts;\n        pkt->stream_index  = asf->asf_st[i]->index;\n        if ((ret = asf_read_subpayload(s, pkt, 0)) < 0)\n            return ret;\n    }\n    return 0;\n}', 'static int asf_read_subpayload(AVFormatContext *s, AVPacket *pkt, int is_header)\n{\n    ASFContext *asf = s->priv_data;\n    AVIOContext *pb = s->pb;\n    uint8_t sub_len;\n    int ret, i;\n    if (is_header) {\n        asf->dts_delta = avio_r8(pb);\n        if (asf->nb_mult_left) {\n            asf->mult_sub_len = avio_rl16(pb);\n        }\n        asf->sub_header_offset = avio_tell(pb);\n        asf->nb_sub = 0;\n        asf->sub_left = 1;\n    }\n    sub_len = avio_r8(pb);\n    if ((ret = av_get_packet(pb, pkt, sub_len)) < 0)\n        return ret;\n    for (i = 0; i < asf->nb_streams; i++) {\n        if (asf->stream_index == asf->asf_st[i]->stream_index) {\n            pkt->stream_index  = asf->asf_st[i]->index;\n            break;\n        }\n    }\n    asf->return_subpayload = 1;\n    if (!sub_len)\n        asf->return_subpayload = 0;\n    if (sub_len)\n        asf->nb_sub++;\n    pkt->dts = asf->sub_dts + (asf->nb_sub - 1) * asf->dts_delta - asf->preroll;\n    if (asf->nb_mult_left && (avio_tell(pb) >=\n                              (asf->sub_header_offset + asf->mult_sub_len))) {\n        asf->sub_left = 0;\n        asf->nb_mult_left--;\n    }\n    if (avio_tell(pb) >= asf->packet_offset + asf->packet_size - asf->pad_len) {\n        asf->sub_left = 0;\n        if (!asf->nb_mult_left) {\n            avio_skip(pb, asf->pad_len);\n            if (avio_tell(pb) != asf->packet_offset + asf->packet_size) {\n                if (!asf->packet_size)\n                    return AVERROR_INVALIDDATA;\n                av_log(s, AV_LOG_WARNING,\n                       "Position %"PRId64" wrong, should be %"PRId64"\\n",\n                       avio_tell(pb), asf->packet_offset + asf->packet_size);\n                avio_seek(pb, asf->packet_offset + asf->packet_size, SEEK_SET);\n            }\n        }\n    }\n    return 0;\n}']