libavformat/rtpenc_h263_rfc2190.c:118: error: Integer Overflow L2
  ([0, +oo] - 2):unsigned32 by call to `bitstream_skip`.

libavformat/rtpenc_h263_rfc2190.c:117:20: Call
115.     bitstream_init(&bc, buf, size * 8);
116.     if (bitstream_read(&bc, 22) == 0x20) { /* Picture Start Code */
117.         info.tr  = bitstream_read(&bc, 8);
                        ^
118.         bitstream_skip(&bc, 2); /* PTYPE start, H.261 disambiguation */
119.         bitstream_skip(&bc, 3); /* Split screen, document camera, freeze picture release */

libavcodec/bitstream.h:183:1: Parameter `bc->bits_left`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavformat/rtpenc_h263_rfc2190.c:118:9: Call
116.     if (bitstream_read(&bc, 22) == 0x20) { /* Picture Start Code */
117.         info.tr  = bitstream_read(&bc, 8);
118.         bitstream_skip(&bc, 2); /* PTYPE start, H.261 disambiguation */
             ^
119.         bitstream_skip(&bc, 3); /* Split screen, document camera, freeze picture release */
120.         info.src = bitstream_read(&bc, 3);

libavcodec/bitstream.h:241:1: Parameter `n`
  239. 
  240. /* Skip n bits in the buffer. */
  241. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
       ^
  242. {
  243.     if (n <= bc->bits_left)

libavcodec/bitstream.h:244:9: Call
  242. {
  243.     if (n <= bc->bits_left)
  244.         skip_remaining(bc, n);
               ^
  245.     else {
  246.         n -= bc->bits_left;

libavcodec/bitstream.h:230:1: <LHS trace>
228. }
229. 
230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
231. {
232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: Parameter `bc->bits_left`
    228. }
    229. 
    230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
         ^
    231. {
    232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: <RHS trace>
228. }
229. 
230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
231. {
232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: Parameter `n`
    228. }
    229. 
    230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
         ^
    231. {
    232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:237:5: Binary operation: ([0, +oo] - 2):unsigned32 by call to `bitstream_skip` 
    235.     bc->bits <<= n;
    236. #endif
    237.     bc->bits_left -= n;
             ^
    238. }
    239. 

static inline void skip_remaining(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    bc->bits >>= n;
#else
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
}
['void ff_rtp_send_h263_rfc2190(AVFormatContext *s1, const uint8_t *buf, int size,\n                              const uint8_t *mb_info, int mb_info_size)\n{\n    RTPMuxContext *s = s1->priv_data;\n    int len, sbits = 0, ebits = 0;\n    BitstreamContext bc;\n    struct H263Info info = { 0 };\n    struct H263State state = { 0 };\n    int mb_info_pos = 0, mb_info_count = mb_info_size / 12;\n    const uint8_t *buf_base = buf;\n    s->timestamp = s->cur_timestamp;\n    bitstream_init(&bc, buf, size * 8);\n    if (bitstream_read(&bc, 22) == 0x20) {\n        info.tr  = bitstream_read(&bc, 8);\n        bitstream_skip(&bc, 2);\n        bitstream_skip(&bc, 3);\n        info.src = bitstream_read(&bc, 3);\n        info.i   = bitstream_read(&bc, 1);\n        info.u   = bitstream_read(&bc, 1);\n        info.s   = bitstream_read(&bc, 1);\n        info.a   = bitstream_read(&bc, 1);\n        info.pb  = bitstream_read(&bc, 1);\n    }\n    while (size > 0) {\n        struct H263State packet_start_state = state;\n        len = FFMIN(s->max_payload_size - 8, size);\n        if (len < size) {\n            const uint8_t *end = ff_h263_find_resync_marker_reverse(buf,\n                                                                    buf + len);\n            len = end - buf;\n            if (len == s->max_payload_size - 8) {\n                while (mb_info_pos < mb_info_count) {\n                    uint32_t pos = AV_RL32(&mb_info[12*mb_info_pos])/8;\n                    if (pos >= buf - buf_base)\n                        break;\n                    mb_info_pos++;\n                }\n                while (mb_info_pos + 1 < mb_info_count) {\n                    uint32_t pos = AV_RL32(&mb_info[12*(mb_info_pos + 1)])/8;\n                    if (pos >= end - buf_base)\n                        break;\n                    mb_info_pos++;\n                }\n                if (mb_info_pos < mb_info_count) {\n                    const uint8_t *ptr = &mb_info[12*mb_info_pos];\n                    uint32_t bit_pos = AV_RL32(ptr);\n                    uint32_t pos = (bit_pos + 7)/8;\n                    if (pos <= end - buf_base) {\n                        state.quant = ptr[4];\n                        state.gobn  = ptr[5];\n                        state.mba   = AV_RL16(&ptr[6]);\n                        state.hmv1  = (int8_t) ptr[8];\n                        state.vmv1  = (int8_t) ptr[9];\n                        state.hmv2  = (int8_t) ptr[10];\n                        state.vmv2  = (int8_t) ptr[11];\n                        ebits = 8 * pos - bit_pos;\n                        len   = pos - (buf - buf_base);\n                        mb_info_pos++;\n                    } else {\n                        av_log(s1, AV_LOG_ERROR,\n                               "Unable to split H.263 packet, use -mb_info %d "\n                               "or lower.\\n", s->max_payload_size - 8);\n                    }\n                } else {\n                    av_log(s1, AV_LOG_ERROR, "Unable to split H.263 packet, "\n                           "use -mb_info %d or -ps 1.\\n",\n                           s->max_payload_size - 8);\n                }\n            }\n        }\n        if (size > 2 && !buf[0] && !buf[1])\n            send_mode_a(s1, &info, buf, len, ebits, len == size);\n        else\n            send_mode_b(s1, &info, &packet_start_state, buf, len, sbits,\n                        ebits, len == size);\n        if (ebits) {\n            sbits = 8 - ebits;\n            len--;\n        } else {\n            sbits = 0;\n        }\n        buf  += len;\n        size -= len;\n        ebits = 0;\n    }\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline void bitstream_skip(BitstreamContext *bc, unsigned n)\n{\n    if (n <= bc->bits_left)\n        skip_remaining(bc, n);\n    else {\n        n -= bc->bits_left;\n        skip_remaining(bc, bc->bits_left);\n        if (n >= 64) {\n            unsigned skip = n / 8;\n            n -= skip * 8;\n            bc->ptr += skip;\n        }\n        refill_64(bc);\n        if (n)\n            skip_remaining(bc, n);\n    }\n}', 'static inline void skip_remaining(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    bc->bits >>= n;\n#else\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n}']