libavformat/rtpenc_h263_rfc2190.c:119: error: Integer Overflow L2
  ([0, +oo] - 3):unsigned32 by call to `bitstream_skip`.

libavformat/rtpenc_h263_rfc2190.c:118:9: Call
116.     if (bitstream_read(&bc, 22) == 0x20) { /* Picture Start Code */
117.         info.tr  = bitstream_read(&bc, 8);
118.         bitstream_skip(&bc, 2); /* PTYPE start, H.261 disambiguation */
             ^
119.         bitstream_skip(&bc, 3); /* Split screen, document camera, freeze picture release */
120.         info.src = bitstream_read(&bc, 3);

libavcodec/bitstream.h:247:9: Assignment
  245.         n -= bc->bits_left;
  246.         bc->bits      = 0;
  247.         bc->bits_left = 0;
               ^
  248. 
  249.         if (n >= 64) {

libavcodec/bitstream.h:255:9: Call
  253.             bc->ptr += skip;
  254.         }
  255.         refill_64(bc);
               ^
  256.         if (n)
  257.             skip_remaining(bc, n);

libavcodec/bitstream.h:45:1: Parameter `bc->bits_left`
    43. } BitstreamContext;
    44. 
    45. static inline void refill_64(BitstreamContext *bc)
        ^
    46. {
    47.     if (bc->ptr >= bc->buffer_end)

libavformat/rtpenc_h263_rfc2190.c:119:9: Call
117.         info.tr  = bitstream_read(&bc, 8);
118.         bitstream_skip(&bc, 2); /* PTYPE start, H.261 disambiguation */
119.         bitstream_skip(&bc, 3); /* Split screen, document camera, freeze picture release */
             ^
120.         info.src = bitstream_read(&bc, 3);
121.         info.i   = bitstream_read(&bc, 1);

libavcodec/bitstream.h:240:1: Parameter `n`
  238. 
  239. /* Skip n bits in the buffer. */
  240. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
       ^
  241. {
  242.     if (n < bc->bits_left)

libavcodec/bitstream.h:243:9: Call
  241. {
  242.     if (n < bc->bits_left)
  243.         skip_remaining(bc, n);
               ^
  244.     else {
  245.         n -= bc->bits_left;

libavcodec/bitstream.h:229:1: <LHS trace>
227. }
228. 
229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
230. {
231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: Parameter `bc->bits_left`
    227. }
    228. 
    229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
         ^
    230. {
    231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: <RHS trace>
227. }
228. 
229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
230. {
231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: Parameter `n`
    227. }
    228. 
    229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
         ^
    230. {
    231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:236:5: Binary operation: ([0, +oo] - 3):unsigned32 by call to `bitstream_skip` 
    234.     bc->bits <<= n;
    235. #endif
    236.     bc->bits_left -= n;
             ^
    237. }
    238. 

static inline void skip_remaining(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    bc->bits >>= n;
#else
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
}
['void ff_rtp_send_h263_rfc2190(AVFormatContext *s1, const uint8_t *buf, int size,\n                              const uint8_t *mb_info, int mb_info_size)\n{\n    RTPMuxContext *s = s1->priv_data;\n    int len, sbits = 0, ebits = 0;\n    BitstreamContext bc;\n    struct H263Info info = { 0 };\n    struct H263State state = { 0 };\n    int mb_info_pos = 0, mb_info_count = mb_info_size / 12;\n    const uint8_t *buf_base = buf;\n    s->timestamp = s->cur_timestamp;\n    bitstream_init8(&bc, buf, size);\n    if (bitstream_read(&bc, 22) == 0x20) {\n        info.tr  = bitstream_read(&bc, 8);\n        bitstream_skip(&bc, 2);\n        bitstream_skip(&bc, 3);\n        info.src = bitstream_read(&bc, 3);\n        info.i   = bitstream_read(&bc, 1);\n        info.u   = bitstream_read(&bc, 1);\n        info.s   = bitstream_read(&bc, 1);\n        info.a   = bitstream_read(&bc, 1);\n        info.pb  = bitstream_read(&bc, 1);\n    }\n    while (size > 0) {\n        struct H263State packet_start_state = state;\n        len = FFMIN(s->max_payload_size - 8, size);\n        if (len < size) {\n            const uint8_t *end = ff_h263_find_resync_marker_reverse(buf,\n                                                                    buf + len);\n            len = end - buf;\n            if (len == s->max_payload_size - 8) {\n                while (mb_info_pos < mb_info_count) {\n                    uint32_t pos = AV_RL32(&mb_info[12*mb_info_pos])/8;\n                    if (pos >= buf - buf_base)\n                        break;\n                    mb_info_pos++;\n                }\n                while (mb_info_pos + 1 < mb_info_count) {\n                    uint32_t pos = AV_RL32(&mb_info[12*(mb_info_pos + 1)])/8;\n                    if (pos >= end - buf_base)\n                        break;\n                    mb_info_pos++;\n                }\n                if (mb_info_pos < mb_info_count) {\n                    const uint8_t *ptr = &mb_info[12*mb_info_pos];\n                    uint32_t bit_pos = AV_RL32(ptr);\n                    uint32_t pos = (bit_pos + 7)/8;\n                    if (pos <= end - buf_base) {\n                        state.quant = ptr[4];\n                        state.gobn  = ptr[5];\n                        state.mba   = AV_RL16(&ptr[6]);\n                        state.hmv1  = (int8_t) ptr[8];\n                        state.vmv1  = (int8_t) ptr[9];\n                        state.hmv2  = (int8_t) ptr[10];\n                        state.vmv2  = (int8_t) ptr[11];\n                        ebits = 8 * pos - bit_pos;\n                        len   = pos - (buf - buf_base);\n                        mb_info_pos++;\n                    } else {\n                        av_log(s1, AV_LOG_ERROR,\n                               "Unable to split H.263 packet, use -mb_info %d "\n                               "or lower.\\n", s->max_payload_size - 8);\n                    }\n                } else {\n                    av_log(s1, AV_LOG_ERROR, "Unable to split H.263 packet, "\n                           "use -mb_info %d or -ps 1.\\n",\n                           s->max_payload_size - 8);\n                }\n            }\n        }\n        if (size > 2 && !buf[0] && !buf[1])\n            send_mode_a(s1, &info, buf, len, ebits, len == size);\n        else\n            send_mode_b(s1, &info, &packet_start_state, buf, len, sbits,\n                        ebits, len == size);\n        if (ebits) {\n            sbits = 8 - ebits;\n            len--;\n        } else {\n            sbits = 0;\n        }\n        buf  += len;\n        size -= len;\n        ebits = 0;\n    }\n}', 'static inline void bitstream_skip(BitstreamContext *bc, unsigned n)\n{\n    if (n < bc->bits_left)\n        skip_remaining(bc, n);\n    else {\n        n -= bc->bits_left;\n        bc->bits      = 0;\n        bc->bits_left = 0;\n        if (n >= 64) {\n            unsigned skip = n / 8;\n            n -= skip * 8;\n            bc->ptr += skip;\n        }\n        refill_64(bc);\n        if (n)\n            skip_remaining(bc, n);\n    }\n}', 'static inline void refill_64(BitstreamContext *bc)\n{\n    if (bc->ptr >= bc->buffer_end)\n        return;\n#ifdef BITSTREAM_READER_LE\n    bc->bits       = AV_RL64(bc->ptr);\n#else\n    bc->bits       = AV_RB64(bc->ptr);\n#endif\n    bc->ptr       += 8;\n    bc->bits_left  = 64;\n}', 'static inline void skip_remaining(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    bc->bits >>= n;\n#else\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n}']