libavcodec/vb.c:67: error: Integer Overflow L2
  ([0, `*c->stream.buffer`] - 1):unsigned32.

libavcodec/vb.c:62:1: <LHS trace>
60. };
61. 
62. static void vb_decode_palette(VBDecContext *c, int data_size)
    ^
63. {
64.     int start, size, i;

libavcodec/vb.c:62:1: Parameter `*c->stream.buffer`
60. };
61. 
62. static void vb_decode_palette(VBDecContext *c, int data_size)
    ^
63. {
64.     int start, size, i;

libavcodec/vb.c:66:13: Call
64.     int start, size, i;
65. 
66.     start = bytestream2_get_byte(&c->stream);
                ^
67.     size  = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;
68.     if (start + size > 255) {

libavcodec/bytestream.h:92:1: Parameter `*g->buffer`
  90. DEF(unsigned int, be24, 3, AV_RB24, AV_WB24)
  91. DEF(unsigned int, be16, 2, AV_RB16, AV_WB16)
  92. DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)
      ^
  93. 
  94. #if HAVE_BIGENDIAN

libavcodec/vb.c:67:14: Call
65. 
66.     start = bytestream2_get_byte(&c->stream);
67.     size  = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;
                 ^
68.     if (start + size > 255) {
69.         av_log(c->avctx, AV_LOG_ERROR, "Palette change runs beyond entry 256\n");

libavcodec/bytestream.h:92:1: Assignment
  90. DEF(unsigned int, be24, 3, AV_RB24, AV_WB24)
  91. DEF(unsigned int, be16, 2, AV_RB16, AV_WB16)
  92. DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)
      ^
  93. 
  94. #if HAVE_BIGENDIAN

libavcodec/vb.c:67:5: Binary operation: ([0, *c->stream.buffer] - 1):unsigned32
65. 
66.     start = bytestream2_get_byte(&c->stream);
67.     size  = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;
        ^
68.     if (start + size > 255) {
69.         av_log(c->avctx, AV_LOG_ERROR, "Palette change runs beyond entry 256\n");

static void vb_decode_palette(VBDecContext *c, int data_size)
{
    int start, size, i;
    start = bytestream2_get_byte(&c->stream);
    size  = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;
    if (start + size > 255) {
        av_log(c->avctx, AV_LOG_ERROR, "Palette change runs beyond entry 256\n");
        return;
    }
    if (size*3+2 > data_size) {
        av_log(c->avctx, AV_LOG_ERROR, "Palette data runs beyond chunk size\n");
        return;
    }
    for (i = start; i <= start + size; i++)
        c->pal[i] = bytestream2_get_be24(&c->stream);
}
['static void vb_decode_palette(VBDecContext *c, int data_size)\n{\n    int start, size, i;\n    start = bytestream2_get_byte(&c->stream);\n    size  = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;\n    if (start + size > 255) {\n        av_log(c->avctx, AV_LOG_ERROR, "Palette change runs beyond entry 256\\n");\n        return;\n    }\n    if (size*3+2 > data_size) {\n        av_log(c->avctx, AV_LOG_ERROR, "Palette data runs beyond chunk size\\n");\n        return;\n    }\n    for (i = start; i <= start + size; i++)\n        c->pal[i] = bytestream2_get_be24(&c->stream);\n}', 'DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)']