libavcodec/mlp_parser.c:158: error: Integer Overflow L2
  ([0, 2⋅`*gb->buffer` + 28] - 2):unsigned32 by call to `ff_mlp_checksum16`.

libavcodec/mlp_parser.c:145:1: Parameter `*gb->buffer`
143.  */
144. 
145. int ff_mlp_read_major_sync(void *log, MLPHeaderInfo *mh, GetBitContext *gb)
     ^
146. {
147.     int ratebits, channel_arrangement, header_size;

libavcodec/mlp_parser.c:152:19: Call
150.     assert(get_bits_count(gb) == 0);
151. 
152.     header_size = ff_mlp_get_major_sync_size(gb->buffer, gb->size_in_bits >> 3);
                       ^
153.     if (header_size < 0 || gb->size_in_bits < header_size << 3) {
154.         av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\n");

libavcodec/mlp_parser.c:127:9: Assignment
  125.     int size = 28;
  126.     if (bufsize < 28)
  127.         return -1;
               ^
  128. 
  129.     if (AV_RB32(buf) == 0xf8726fba) {

libavcodec/mlp_parser.c:152:5: Assignment
150.     assert(get_bits_count(gb) == 0);
151. 
152.     header_size = ff_mlp_get_major_sync_size(gb->buffer, gb->size_in_bits >> 3);
         ^
153.     if (header_size < 0 || gb->size_in_bits < header_size << 3) {
154.         av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\n");

libavcodec/mlp_parser.c:158:16: Call
156.     }
157. 
158.     checksum = ff_mlp_checksum16(gb->buffer, header_size - 2);
                    ^
159.     if (checksum != AV_RL16(gb->buffer+header_size-2)) {
160.         av_log(log, AV_LOG_ERROR, "major sync info header checksum error\n");

libavcodec/mlp.c:64:1: <LHS trace>
62. }
63. 
64. uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)
    ^
65. {
66.     uint16_t crc;

libavcodec/mlp.c:64:1: Parameter `buf_size`
  62. }
  63. 
  64. uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)
      ^
  65. {
  66.     uint16_t crc;

libavcodec/mlp.c:68:11: Binary operation: ([0, 2⋅*gb->buffer + 28] - 2):unsigned32 by call to `ff_mlp_checksum16` 
  66.     uint16_t crc;
  67. 
  68.     crc = av_crc(crc_2D, 0, buf, buf_size - 2);
                ^
  69.     crc ^= AV_RL16(buf + buf_size - 2);
  70.     return crc;

uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)
{
    uint16_t crc;
    crc = av_crc(crc_2D, 0, buf, buf_size - 2);
    crc ^= AV_RL16(buf + buf_size - 2);
    return crc;
}
['int ff_mlp_read_major_sync(void *log, MLPHeaderInfo *mh, GetBitContext *gb)\n{\n    int ratebits, channel_arrangement, header_size;\n    uint16_t checksum;\n    assert(get_bits_count(gb) == 0);\n    header_size = ff_mlp_get_major_sync_size(gb->buffer, gb->size_in_bits >> 3);\n    if (header_size < 0 || gb->size_in_bits < header_size << 3) {\n        av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\\n");\n        return -1;\n    }\n    checksum = ff_mlp_checksum16(gb->buffer, header_size - 2);\n    if (checksum != AV_RL16(gb->buffer+header_size-2)) {\n        av_log(log, AV_LOG_ERROR, "major sync info header checksum error\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (get_bits_long(gb, 24) != 0xf8726f)\n        return AVERROR_INVALIDDATA;\n    mh->stream_type = get_bits(gb, 8);\n    mh->header_size = header_size;\n    if (mh->stream_type == 0xbb) {\n        mh->group1_bits = mlp_quants[get_bits(gb, 4)];\n        mh->group2_bits = mlp_quants[get_bits(gb, 4)];\n        ratebits = get_bits(gb, 4);\n        mh->group1_samplerate = mlp_samplerate(ratebits);\n        mh->group2_samplerate = mlp_samplerate(get_bits(gb, 4));\n        skip_bits(gb, 11);\n        channel_arrangement    = get_bits(gb, 5);\n        mh->channels_mlp       = mlp_channels[channel_arrangement];\n        mh->channel_layout_mlp = mlp_layout[channel_arrangement];\n    } else if (mh->stream_type == 0xba) {\n        mh->group1_bits = 24;\n        mh->group2_bits = 0;\n        ratebits = get_bits(gb, 4);\n        mh->group1_samplerate = mlp_samplerate(ratebits);\n        mh->group2_samplerate = 0;\n        skip_bits(gb, 4);\n        mh->channel_modifier_thd_stream0 = get_bits(gb, 2);\n        mh->channel_modifier_thd_stream1 = get_bits(gb, 2);\n        channel_arrangement            = get_bits(gb, 5);\n        mh->channels_thd_stream1       = truehd_channels(channel_arrangement);\n        mh->channel_layout_thd_stream1 = truehd_layout(channel_arrangement);\n        mh->channel_modifier_thd_stream2 = get_bits(gb, 2);\n        channel_arrangement            = get_bits(gb, 13);\n        mh->channels_thd_stream2       = truehd_channels(channel_arrangement);\n        mh->channel_layout_thd_stream2 = truehd_layout(channel_arrangement);\n    } else\n        return AVERROR_INVALIDDATA;\n    mh->access_unit_size = 40 << (ratebits & 7);\n    mh->access_unit_size_pow2 = 64 << (ratebits & 7);\n    skip_bits_long(gb, 48);\n    mh->is_vbr = get_bits1(gb);\n    mh->peak_bitrate = (get_bits(gb, 15) * mh->group1_samplerate + 8) >> 4;\n    mh->num_substreams = get_bits(gb, 4);\n    skip_bits_long(gb, 4 + (header_size - 17) * 8);\n    return 0;\n}', 'static int ff_mlp_get_major_sync_size(const uint8_t * buf, int bufsize)\n{\n    int has_extension, extensions = 0;\n    int size = 28;\n    if (bufsize < 28)\n        return -1;\n    if (AV_RB32(buf) == 0xf8726fba) {\n        has_extension = buf[25] & 1;\n        if (has_extension) {\n            extensions = buf[26] >> 4;\n            size += 2 + extensions * 2;\n        }\n    }\n    return size;\n}', 'uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)\n{\n    uint16_t crc;\n    crc = av_crc(crc_2D, 0, buf, buf_size - 2);\n    crc ^= AV_RL16(buf + buf_size - 2);\n    return crc;\n}']