libavcodec/dfa.c:334: error: Integer Overflow L2
  ([min(0, `avpkt->data->l`), max(0, `avpkt->data->l`)] - 2):unsigned32.

libavcodec/dfa.c:297:1: <LHS trace>
295. };
296. 
297. static int dfa_decode_frame(AVCodecContext *avctx,
     ^
298.                             void *data, int *data_size,
299.                             AVPacket *avpkt)

libavcodec/dfa.c:297:1: Parameter `avpkt->data->l`
295. };
296. 
297. static int dfa_decode_frame(AVCodecContext *avctx,
     ^
298.                             void *data, int *data_size,
299.                             AVPacket *avpkt)

libavcodec/dfa.c:321:22: Call
319.         bytestream2_skip(&gb, 4);
320.         chunk_size = bytestream2_get_le32(&gb);
321.         chunk_type = bytestream2_get_le32(&gb);
                          ^
322.         if (!chunk_type)
323.             break;

libavcodec/bytestream.h:89:1: Assignment
  87. 
  88. DEF64(le64, 8, AV_RL64, AV_WL64)
  89. DEF  (le32, 4, AV_RL32, AV_WL32)
      ^
  90. DEF  (le24, 3, AV_RL24, AV_WL24)
  91. DEF  (le16, 2, AV_RL16, AV_WL16)

libavcodec/dfa.c:321:9: Assignment
319.         bytestream2_skip(&gb, 4);
320.         chunk_size = bytestream2_get_le32(&gb);
321.         chunk_type = bytestream2_get_le32(&gb);
             ^
322.         if (!chunk_type)
323.             break;

libavcodec/dfa.c:334:24: Binary operation: ([min(0, avpkt->data->l), max(0, avpkt->data->l)] - 2):unsigned32
332.             if (decoder[chunk_type - 2](&gb, s->frame_buf, avctx->width, avctx->height)) {
333.                 av_log(avctx, AV_LOG_ERROR, "Error decoding %s chunk\n",
334.                        chunk_name[chunk_type - 2]);
                            ^
335.                 return -1;
336.             }

static int dfa_decode_frame(AVCodecContext *avctx,
                            void *data, int *data_size,
                            AVPacket *avpkt)
{
    DfaContext *s = avctx->priv_data;
    GetByteContext gb;
    const uint8_t *buf = avpkt->data;
    uint32_t chunk_type, chunk_size;
    uint8_t *dst;
    int ret;
    int i, pal_elems;
    if (s->pic.data[0])
        avctx->release_buffer(avctx, &s->pic);
    if ((ret = avctx->get_buffer(avctx, &s->pic))) {
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        return ret;
    }
    bytestream2_init(&gb, avpkt->data, avpkt->size);
    while (bytestream2_get_bytes_left(&gb) > 0) {
        bytestream2_skip(&gb, 4);
        chunk_size = bytestream2_get_le32(&gb);
        chunk_type = bytestream2_get_le32(&gb);
        if (!chunk_type)
            break;
        if (chunk_type == 1) {
            pal_elems = FFMIN(chunk_size / 3, 256);
            for (i = 0; i < pal_elems; i++) {
                s->pal[i] = bytestream2_get_be24(&gb) << 2;
                s->pal[i] |= (s->pal[i] >> 6) & 0x333;
            }
            s->pic.palette_has_changed = 1;
        } else if (chunk_type <= 9) {
            if (decoder[chunk_type - 2](&gb, s->frame_buf, avctx->width, avctx->height)) {
                av_log(avctx, AV_LOG_ERROR, "Error decoding %s chunk\n",
                       chunk_name[chunk_type - 2]);
                return -1;
            }
        } else {
            av_log(avctx, AV_LOG_WARNING, "Ignoring unknown chunk type %d\n",
                   chunk_type);
        }
        buf += chunk_size;
    }
    buf = s->frame_buf;
    dst = s->pic.data[0];
    for (i = 0; i < avctx->height; i++) {
        memcpy(dst, buf, avctx->width);
        dst += s->pic.linesize[0];
        buf += avctx->width;
    }
    memcpy(s->pic.data[1], s->pal, sizeof(s->pal));
    *data_size = sizeof(AVFrame);
    *(AVFrame*)data = s->pic;
    return avpkt->size;
}
['static int dfa_decode_frame(AVCodecContext *avctx,\n                            void *data, int *data_size,\n                            AVPacket *avpkt)\n{\n    DfaContext *s = avctx->priv_data;\n    GetByteContext gb;\n    const uint8_t *buf = avpkt->data;\n    uint32_t chunk_type, chunk_size;\n    uint8_t *dst;\n    int ret;\n    int i, pal_elems;\n    if (s->pic.data[0])\n        avctx->release_buffer(avctx, &s->pic);\n    if ((ret = avctx->get_buffer(avctx, &s->pic))) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    bytestream2_init(&gb, avpkt->data, avpkt->size);\n    while (bytestream2_get_bytes_left(&gb) > 0) {\n        bytestream2_skip(&gb, 4);\n        chunk_size = bytestream2_get_le32(&gb);\n        chunk_type = bytestream2_get_le32(&gb);\n        if (!chunk_type)\n            break;\n        if (chunk_type == 1) {\n            pal_elems = FFMIN(chunk_size / 3, 256);\n            for (i = 0; i < pal_elems; i++) {\n                s->pal[i] = bytestream2_get_be24(&gb) << 2;\n                s->pal[i] |= (s->pal[i] >> 6) & 0x333;\n            }\n            s->pic.palette_has_changed = 1;\n        } else if (chunk_type <= 9) {\n            if (decoder[chunk_type - 2](&gb, s->frame_buf, avctx->width, avctx->height)) {\n                av_log(avctx, AV_LOG_ERROR, "Error decoding %s chunk\\n",\n                       chunk_name[chunk_type - 2]);\n                return -1;\n            }\n        } else {\n            av_log(avctx, AV_LOG_WARNING, "Ignoring unknown chunk type %d\\n",\n                   chunk_type);\n        }\n        buf += chunk_size;\n    }\n    buf = s->frame_buf;\n    dst = s->pic.data[0];\n    for (i = 0; i < avctx->height; i++) {\n        memcpy(dst, buf, avctx->width);\n        dst += s->pic.linesize[0];\n        buf += avctx->width;\n    }\n    memcpy(s->pic.data[1], s->pal, sizeof(s->pal));\n    *data_size = sizeof(AVFrame);\n    *(AVFrame*)data = s->pic;\n    return avpkt->size;\n}', 'DEF  (le32, 4, AV_RL32, AV_WL32)']