libavcodec/tscc2.c:207: error: Integer Overflow L2
  ([-1, +oo] - 1):unsigned32 by call to `tscc2_decode_mb`.

libavcodec/tscc2.c:198:5: Call
196.     int off;
197. 
198.     bitstream_init(&c->bc, buf, buf_size * 8);
         ^
199. 
200.     for (mb_x = 0; mb_x < c->mb_width; mb_x++) {

libavcodec/bitstream.h:85:9: Assignment
  83.         bc->buffer    =
  84.         bc->ptr       = NULL;
  85.         bc->bits_left = 0;
              ^
  86.         return AVERROR_INVALIDDATA;
  87.     }

libavcodec/tscc2.c:207:19: Call
205.         for (i = 0; i < 3; i++) {
206.             off = mb_x * 16 + mb_y * 8 * c->pic->linesize[i];
207.             ret = tscc2_decode_mb(c, c->q[q - 1], c->quant[q - 1] - 2,
                       ^
208.                                   c->pic->data[i] + off, c->pic->linesize[i], i);
209.             if (ret)

libavcodec/tscc2.c:127:1: Parameter `c->bc.bits_left`
  125. }
  126. 
  127. static int tscc2_decode_mb(TSCC2Context *c, int *q, int vlc_set,
       ^
  128.                            uint8_t *dst, int stride, int plane)
  129. {

libavcodec/tscc2.c:134:9: Call
  132.     int i, j, k, l;
  133. 
  134.     if (bitstream_read_bit(bc)) {
               ^
  135.         if (bitstream_read_bit(bc)) {
  136.             val = bitstream_read(bc, 8);

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

libavcodec/tscc2.c:135:13: Call
  133. 
  134.     if (bitstream_read_bit(bc)) {
  135.         if (bitstream_read_bit(bc)) {
                   ^
  136.             val = bitstream_read(bc, 8);
  137.             for (i = 0; i < 8; i++, dst += stride)

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([-1, +oo] - 1):unsigned32 by call to `tscc2_decode_mb` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int tscc2_decode_slice(TSCC2Context *c, int mb_y,\n                              const uint8_t *buf, int buf_size)\n{\n    int i, mb_x, q, ret;\n    int off;\n    bitstream_init(&c->bc, buf, buf_size * 8);\n    for (mb_x = 0; mb_x < c->mb_width; mb_x++) {\n        q = c->slice_quants[mb_x + c->mb_width * mb_y];\n        if (q == 0 || q == 3)\n            continue;\n        for (i = 0; i < 3; i++) {\n            off = mb_x * 16 + mb_y * 8 * c->pic->linesize[i];\n            ret = tscc2_decode_mb(c, c->q[q - 1], c->quant[q - 1] - 2,\n                                  c->pic->data[i] + off, c->pic->linesize[i], i);\n            if (ret)\n                return ret;\n        }\n    }\n    return 0;\n}', 'static inline int bitstream_init(BitstreamContext *bc, const uint8_t *buffer,\n                                 unsigned bit_size)\n{\n    unsigned buffer_size;\n    if (bit_size > INT_MAX - 7 || !buffer) {\n        buffer        =\n        bc->buffer    =\n        bc->ptr       = NULL;\n        bc->bits_left = 0;\n        return AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    bc->buffer       = buffer;\n    bc->buffer_end   = buffer + buffer_size;\n    bc->ptr          = bc->buffer;\n    bc->size_in_bits = bit_size;\n    bc->bits_left    = 0;\n    bc->bits         = 0;\n    refill_64(bc);\n    return 0;\n}', 'static int tscc2_decode_mb(TSCC2Context *c, int *q, int vlc_set,\n                           uint8_t *dst, int stride, int plane)\n{\n    BitstreamContext *bc = &c->bc;\n    int prev_dc, dc, nc, ac, bpos, val;\n    int i, j, k, l;\n    if (bitstream_read_bit(bc)) {\n        if (bitstream_read_bit(bc)) {\n            val = bitstream_read(bc, 8);\n            for (i = 0; i < 8; i++, dst += stride)\n                memset(dst, val, 16);\n        } else {\n            if (bitstream_bits_left(bc) < 16 * 8 * 8)\n                return AVERROR_INVALIDDATA;\n            for (i = 0; i < 8; i++) {\n                for (j = 0; j < 16; j++)\n                    dst[j] = bitstream_read(bc, 8);\n                dst += stride;\n            }\n        }\n        return 0;\n    }\n    prev_dc = 0;\n    for (j = 0; j < 2; j++) {\n        for (k = 0; k < 4; k++) {\n            if (!(j | k)) {\n                dc = bitstream_read(bc, 8);\n            } else {\n                dc = bitstream_read_vlc(bc, c->dc_vlc.table, 9, 2);\n                if (dc == -1)\n                    return AVERROR_INVALIDDATA;\n                if (dc == 0x100)\n                    dc = bitstream_read(bc, 8);\n            }\n            dc          = (dc + prev_dc) & 0xFF;\n            prev_dc     = dc;\n            c->block[0] = dc;\n            nc = bitstream_read_vlc(bc, c->nc_vlc[vlc_set].table, 9, 1);\n            if (nc == -1)\n                return AVERROR_INVALIDDATA;\n            bpos = 1;\n            memset(c->block + 1, 0, 15 * sizeof(*c->block));\n            for (l = 0; l < nc; l++) {\n                ac = bitstream_read_vlc(bc, c->ac_vlc[vlc_set].table, 9, 2);\n                if (ac == -1)\n                    return AVERROR_INVALIDDATA;\n                if (ac == 0x1000)\n                    ac = bitstream_read(bc, 12);\n                bpos += ac & 0xF;\n                if (bpos >= 16)\n                    return AVERROR_INVALIDDATA;\n                val = sign_extend(ac >> 4, 8);\n                c->block[ff_zigzag_scan[bpos++]] = val;\n            }\n            tscc2_idct4_put(c->block, q, dst + k * 4, stride);\n        }\n        dst += 4 * stride;\n    }\n    return 0;\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']