libavcodec/vb.c:216: error: Integer Overflow L2
  ([min(0, `avpkt->data->l`), max(0, `avpkt->data->l`)] - 4):unsigned32.

libavcodec/vb.c:187:1: <LHS trace>
185. }
186. 
187. static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt)
     ^
188. {
189.     VBDecContext * const c = avctx->priv_data;

libavcodec/vb.c:187:1: Parameter `avpkt->data->l`
185. }
186. 
187. static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt)
     ^
188. {
189.     VBDecContext * const c = avctx->priv_data;

libavcodec/vb.c:214:16: Call
212.     }
213.     if(flags & VB_HAS_VIDEO){
214.         size = bytestream2_get_le32(&c->stream);
                    ^
215.         vb_decode_framedata(c, offset);
216.         bytestream2_skip(&c->stream, size - 4);

libavcodec/bytestream.h:65:1: Assignment
  63. 
  64. DEF64(le64, 8, AV_RL64, AV_WL64)
  65. DEF  (le32, 4, AV_RL32, AV_WL32)
      ^
  66. DEF  (le24, 3, AV_RL24, AV_WL24)
  67. DEF  (le16, 2, AV_RL16, AV_WL16)

libavcodec/vb.c:214:9: Assignment
212.     }
213.     if(flags & VB_HAS_VIDEO){
214.         size = bytestream2_get_le32(&c->stream);
             ^
215.         vb_decode_framedata(c, offset);
216.         bytestream2_skip(&c->stream, size - 4);

libavcodec/vb.c:216:9: Binary operation: ([min(0, avpkt->data->l), max(0, avpkt->data->l)] - 4):unsigned32
214.         size = bytestream2_get_le32(&c->stream);
215.         vb_decode_framedata(c, offset);
216.         bytestream2_skip(&c->stream, size - 4);
             ^
217.     }
218.     if(flags & VB_HAS_PALETTE){

static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt)
{
    VBDecContext * const c = avctx->priv_data;
    uint8_t *outptr, *srcptr;
    int i, j;
    int flags;
    uint32_t size;
    int offset = 0;
    bytestream2_init(&c->stream, avpkt->data, avpkt->size);
    if(c->pic.data[0])
        avctx->release_buffer(avctx, &c->pic);
    c->pic.reference = 1;
    if(avctx->get_buffer(avctx, &c->pic) < 0){
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        return -1;
    }
    flags = bytestream2_get_le16(&c->stream);
    if(flags & VB_HAS_GMC){
        i = (int16_t)bytestream2_get_le16(&c->stream);
        j = (int16_t)bytestream2_get_le16(&c->stream);
        offset = i + j * avctx->width;
    }
    if(flags & VB_HAS_VIDEO){
        size = bytestream2_get_le32(&c->stream);
        vb_decode_framedata(c, offset);
        bytestream2_skip(&c->stream, size - 4);
    }
    if(flags & VB_HAS_PALETTE){
        size = bytestream2_get_le32(&c->stream);
        vb_decode_palette(c, size);
    }
    memcpy(c->pic.data[1], c->pal, AVPALETTE_SIZE);
    c->pic.palette_has_changed = flags & VB_HAS_PALETTE;
    outptr = c->pic.data[0];
    srcptr = c->frame;
    for(i = 0; i < avctx->height; i++){
        memcpy(outptr, srcptr, avctx->width);
        srcptr += avctx->width;
        outptr += c->pic.linesize[0];
    }
    FFSWAP(uint8_t*, c->frame, c->prev_frame);
    *data_size = sizeof(AVFrame);
    *(AVFrame*)data = c->pic;
    return avpkt->size;
}
['static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt)\n{\n    VBDecContext * const c = avctx->priv_data;\n    uint8_t *outptr, *srcptr;\n    int i, j;\n    int flags;\n    uint32_t size;\n    int offset = 0;\n    bytestream2_init(&c->stream, avpkt->data, avpkt->size);\n    if(c->pic.data[0])\n        avctx->release_buffer(avctx, &c->pic);\n    c->pic.reference = 1;\n    if(avctx->get_buffer(avctx, &c->pic) < 0){\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return -1;\n    }\n    flags = bytestream2_get_le16(&c->stream);\n    if(flags & VB_HAS_GMC){\n        i = (int16_t)bytestream2_get_le16(&c->stream);\n        j = (int16_t)bytestream2_get_le16(&c->stream);\n        offset = i + j * avctx->width;\n    }\n    if(flags & VB_HAS_VIDEO){\n        size = bytestream2_get_le32(&c->stream);\n        vb_decode_framedata(c, offset);\n        bytestream2_skip(&c->stream, size - 4);\n    }\n    if(flags & VB_HAS_PALETTE){\n        size = bytestream2_get_le32(&c->stream);\n        vb_decode_palette(c, size);\n    }\n    memcpy(c->pic.data[1], c->pal, AVPALETTE_SIZE);\n    c->pic.palette_has_changed = flags & VB_HAS_PALETTE;\n    outptr = c->pic.data[0];\n    srcptr = c->frame;\n    for(i = 0; i < avctx->height; i++){\n        memcpy(outptr, srcptr, avctx->width);\n        srcptr += avctx->width;\n        outptr += c->pic.linesize[0];\n    }\n    FFSWAP(uint8_t*, c->frame, c->prev_frame);\n    *data_size = sizeof(AVFrame);\n    *(AVFrame*)data = c->pic;\n    return avpkt->size;\n}', 'DEF  (le32, 4, AV_RL32, AV_WL32)']