libavcodec/eatgv.c:226: error: Integer Overflow L2
  ([1, +oo] - [max(1, `buf->l`), 32]):unsigned32 by call to `bitstream_read`.

libavcodec/eatgv.c:148:1: Parameter `buf->l`
146.  * @return 0 on success, -1 on critical buffer underflow
147.  */
148. static int tgv_decode_inter(TgvContext *s, AVFrame *frame,
     ^
149.                             const uint8_t *buf, const uint8_t *buf_end)
150. {

libavcodec/eatgv.c:166:5: Assignment
164.     num_blocks_raw    = AV_RL16(&buf[2]);
165.     num_blocks_packed = AV_RL16(&buf[4]);
166.     vector_bits       = AV_RL16(&buf[6]);
         ^
167.     buf += 12;
168. 

libavcodec/eatgv.c:226:35: Call
224.     for (y = 0; y < s->avctx->height / 4; y++)
225.         for (x = 0; x < s->avctx->width / 4; x++) {
226.             unsigned int vector = bitstream_read(&bc, vector_bits);
                                       ^
227.             const uint8_t *src;
228.             ptrdiff_t src_stride;

libavcodec/bitstream.h:183:1: Parameter `n`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/bitstream.h:194:12: Call
  192.     }
  193. 
  194.     return get_val(bc, n);
                  ^
  195. }
  196. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([1, +oo] - [max(1, buf->l), 32]):unsigned32 by call to `bitstream_read` 
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int tgv_decode_inter(TgvContext *s, AVFrame *frame,\n                            const uint8_t *buf, const uint8_t *buf_end)\n{\n    int num_mvs;\n    int num_blocks_raw;\n    int num_blocks_packed;\n    int vector_bits;\n    int i,j,x,y;\n    BitstreamContext bc;\n    int mvbits;\n    const uint8_t *blocks_raw;\n    if (buf + 12 > buf_end)\n        return AVERROR_INVALIDDATA;\n    num_mvs           = AV_RL16(&buf[0]);\n    num_blocks_raw    = AV_RL16(&buf[2]);\n    num_blocks_packed = AV_RL16(&buf[4]);\n    vector_bits       = AV_RL16(&buf[6]);\n    buf += 12;\n    if (vector_bits > 32 || !vector_bits) {\n        av_log(s->avctx, AV_LOG_ERROR,\n               "Invalid value for motion vector bits: %d\\n", vector_bits);\n        return AVERROR_INVALIDDATA;\n    }\n    if (num_mvs > s->num_mvs) {\n        int err = av_reallocp(&s->mv_codebook, num_mvs * 2 * sizeof(int));\n        if (err < 0)\n            return err;\n        s->num_mvs = num_mvs;\n    }\n    if (num_blocks_packed > s->num_blocks_packed) {\n        int err;\n        if ((err = av_reallocp(&s->block_codebook, num_blocks_packed * 16)) < 0) {\n            s->num_blocks_packed = 0;\n            return err;\n        }\n        s->num_blocks_packed = num_blocks_packed;\n    }\n    mvbits = (num_mvs * 2 * 10 + 31) & ~31;\n    if (buf + (mvbits >> 3) + 16 * num_blocks_raw + 8 * num_blocks_packed > buf_end)\n        return AVERROR_INVALIDDATA;\n    bitstream_init(&bc, buf, mvbits);\n    for (i = 0; i < num_mvs; i++) {\n        s->mv_codebook[i][0] = bitstream_read_signed(&bc, 10);\n        s->mv_codebook[i][1] = bitstream_read_signed(&bc, 10);\n    }\n    buf += mvbits >> 3;\n    blocks_raw = buf;\n    buf       += num_blocks_raw * 16;\n    bitstream_init(&bc, buf, (buf_end - buf) << 3);\n    for (i = 0; i < num_blocks_packed; i++) {\n        int tmp[4];\n        for (j = 0; j < 4; j++)\n            tmp[j] = bitstream_read(&bc, 8);\n        for (j = 0; j < 16; j++)\n            s->block_codebook[i][15-j] = tmp[bitstream_read(&bc, 2)];\n    }\n    if (bitstream_bits_left(&bc) < vector_bits *\n        (s->avctx->height / 4) * (s->avctx->width / 4))\n        return AVERROR_INVALIDDATA;\n    for (y = 0; y < s->avctx->height / 4; y++)\n        for (x = 0; x < s->avctx->width / 4; x++) {\n            unsigned int vector = bitstream_read(&bc, vector_bits);\n            const uint8_t *src;\n            ptrdiff_t src_stride;\n            if (vector < num_mvs) {\n                int mx = x * 4 + s->mv_codebook[vector][0];\n                int my = y * 4 + s->mv_codebook[vector][1];\n                if (mx < 0 || mx + 4 > s->avctx->width ||\n                    my < 0 || my + 4 > s->avctx->height)\n                    continue;\n                src = s->last_frame->data[0] + mx + my * s->last_frame->linesize[0];\n                src_stride = s->last_frame->linesize[0];\n            } else {\n                int offset = vector - num_mvs;\n                if (offset < num_blocks_raw)\n                    src = blocks_raw + 16*offset;\n                else if (offset - num_blocks_raw < num_blocks_packed)\n                    src = s->block_codebook[offset - num_blocks_raw];\n                else\n                    continue;\n                src_stride = 4;\n            }\n            for (j = 0; j < 4; j++)\n                for (i = 0; i < 4; i++)\n                    frame->data[0][(y * 4 + j) * frame->linesize[0] + (x * 4 + i)] =\n                        src[j * src_stride + i];\n    }\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']