libavformat/oggparsespeex.c:64: error: Integer Overflow L1
  (7405290916 + 64):signed32.

libavformat/oggparsespeex.c:49:9: <LHS trace>
47.         int frames_per_packet;
48.         st->codec->codec_type = CODEC_TYPE_AUDIO;
49.         st->codec->codec_id = CODEC_ID_SPEEX;
            ^
50. 
51.         st->codec->sample_rate = AV_RL32(p + 36);

libavformat/oggparsespeex.c:49:9: Assignment
47.         int frames_per_packet;
48.         st->codec->codec_type = CODEC_TYPE_AUDIO;
49.         st->codec->codec_id = CODEC_ID_SPEEX;
            ^
50. 
51.         st->codec->sample_rate = AV_RL32(p + 36);

libavformat/oggparsespeex.c:51:9: Assignment
49.         st->codec->codec_id = CODEC_ID_SPEEX;
50. 
51.         st->codec->sample_rate = AV_RL32(p + 36);
            ^
52.         st->codec->channels = AV_RL32(p + 48);
53. 

libavformat/oggparsespeex.c:52:9: Assignment
50. 
51.         st->codec->sample_rate = AV_RL32(p + 36);
52.         st->codec->channels = AV_RL32(p + 48);
            ^
53. 
54.         /* We treat the whole Speex packet as a single frame everywhere Speex

libavformat/oggparsespeex.c:58:9: Assignment
56.            and joining individual Speex frames, which are not always
57.            byte-aligned. */
58.         st->codec->frame_size = AV_RL32(p + 56);
            ^
59.         frames_per_packet     = AV_RL32(p + 64);
60.         if (frames_per_packet)

libavformat/oggparsespeex.c:61:13: Assignment
59.         frames_per_packet     = AV_RL32(p + 64);
60.         if (frames_per_packet)
61.             st->codec->frame_size *= frames_per_packet;
                ^
62. 
63.         st->codec->extradata_size = os->psize;

libavformat/oggparsespeex.c:63:9: Assignment
61.             st->codec->frame_size *= frames_per_packet;
62. 
63.         st->codec->extradata_size = os->psize;
            ^
64.         st->codec->extradata = av_malloc(st->codec->extradata_size
65.                                          + FF_INPUT_BUFFER_PADDING_SIZE);

libavformat/oggparsespeex.c:64:32: Binary operation: (7405290916 + 64):signed32
62. 
63.         st->codec->extradata_size = os->psize;
64.         st->codec->extradata = av_malloc(st->codec->extradata_size
                                   ^
65.                                          + FF_INPUT_BUFFER_PADDING_SIZE);
66.         memcpy(st->codec->extradata, p, st->codec->extradata_size);

static int speex_header(AVFormatContext *s, int idx) {
    struct ogg *ogg = s->priv_data;
    struct ogg_stream *os = ogg->streams + idx;
    AVStream *st = s->streams[idx];
    uint8_t *p = os->buf + os->pstart;
    if (os->seq > 1)
        return 0;
    if (os->seq == 0) {
        int frames_per_packet;
        st->codec->codec_type = CODEC_TYPE_AUDIO;
        st->codec->codec_id = CODEC_ID_SPEEX;
        st->codec->sample_rate = AV_RL32(p + 36);
        st->codec->channels = AV_RL32(p + 48);
        st->codec->frame_size = AV_RL32(p + 56);
        frames_per_packet     = AV_RL32(p + 64);
        if (frames_per_packet)
            st->codec->frame_size *= frames_per_packet;
        st->codec->extradata_size = os->psize;
        st->codec->extradata = av_malloc(st->codec->extradata_size
                                         + FF_INPUT_BUFFER_PADDING_SIZE);
        memcpy(st->codec->extradata, p, st->codec->extradata_size);
        st->time_base.num = 1;
        st->time_base.den = st->codec->sample_rate;
    } else
        vorbis_comment(s, p, os->psize);
    return 1;
}
['static int speex_header(AVFormatContext *s, int idx) {\n    struct ogg *ogg = s->priv_data;\n    struct ogg_stream *os = ogg->streams + idx;\n    AVStream *st = s->streams[idx];\n    uint8_t *p = os->buf + os->pstart;\n    if (os->seq > 1)\n        return 0;\n    if (os->seq == 0) {\n        int frames_per_packet;\n        st->codec->codec_type = CODEC_TYPE_AUDIO;\n        st->codec->codec_id = CODEC_ID_SPEEX;\n        st->codec->sample_rate = AV_RL32(p + 36);\n        st->codec->channels = AV_RL32(p + 48);\n        st->codec->frame_size = AV_RL32(p + 56);\n        frames_per_packet     = AV_RL32(p + 64);\n        if (frames_per_packet)\n            st->codec->frame_size *= frames_per_packet;\n        st->codec->extradata_size = os->psize;\n        st->codec->extradata = av_malloc(st->codec->extradata_size\n                                         + FF_INPUT_BUFFER_PADDING_SIZE);\n        memcpy(st->codec->extradata, p, st->codec->extradata_size);\n        st->time_base.num = 1;\n        st->time_base.den = st->codec->sample_rate;\n    } else\n        vorbis_comment(s, p, os->psize);\n    return 1;\n}']