libavcodec/vmdav.c:281: error: Integer Overflow L2
  ([0, `s->size` - `s->buf.offset` + `s->buf.offset` - 17] - 4):unsigned32 by call to `lz_unpack`.

libavcodec/vmdav.c:207:1: Parameter `*s->buf`
205. }
206. 
207. static void vmd_decode(VmdVideoContext *s)
     ^
208. {
209.     int i;

libavcodec/vmdav.c:276:9: Assignment
274.         /* originally UnpackFrame in VAG's code */
275.         pb = p;
276.         pb_size = s->buf + s->size - pb;
             ^
277.         if (pb_size < 1)
278.             return;

libavcodec/vmdav.c:279:23: Assignment
277.         if (pb_size < 1)
278.             return;
279.         meth = *pb++; pb_size--;
                           ^
280.         if (meth & 0x80) {
281.             lz_unpack(pb, pb_size,

libavcodec/vmdav.c:281:13: Call
279.         meth = *pb++; pb_size--;
280.         if (meth & 0x80) {
281.             lz_unpack(pb, pb_size,
                 ^
282.                       s->unpack_buffer, s->unpack_buffer_size);
283.             meth &= 0x7F;

libavcodec/vmdav.c:75:1: <LHS trace>
73. #define QUEUE_MASK 0x0FFF
74. 
75. static void lz_unpack(const unsigned char *src, int src_len,
    ^
76.                       unsigned char *dest, int dest_len)
77. {

libavcodec/vmdav.c:75:1: Parameter `src_len`
  73. #define QUEUE_MASK 0x0FFF
  74. 
  75. static void lz_unpack(const unsigned char *src, int src_len,
      ^
  76.                       unsigned char *dest, int dest_len)
  77. {

libavcodec/vmdav.c:92:5: Assignment
  90. 
  91.     s = src;
  92.     s_len = src_len;
          ^
  93.     d = dest;
  94.     d_end = d + dest_len;

libavcodec/vmdav.c:96:13: Binary operation: ([0, s->size - s->buf.offset + s->buf.offset - 17] - 4):unsigned32 by call to `lz_unpack` 
  94.     d_end = d + dest_len;
  95.     dataleft = AV_RL32(s);
  96.     s += 4; s_len -= 4;
                  ^
  97.     memset(queue, 0x20, QUEUE_SIZE);
  98.     if (s_len < 4)

static void lz_unpack(const unsigned char *src, int src_len,
                      unsigned char *dest, int dest_len)
{
    const unsigned char *s;
    unsigned int s_len;
    unsigned char *d;
    unsigned char *d_end;
    unsigned char queue[QUEUE_SIZE];
    unsigned int qpos;
    unsigned int dataleft;
    unsigned int chainofs;
    unsigned int chainlen;
    unsigned int speclen;
    unsigned char tag;
    unsigned int i, j;
    s = src;
    s_len = src_len;
    d = dest;
    d_end = d + dest_len;
    dataleft = AV_RL32(s);
    s += 4; s_len -= 4;
    memset(queue, 0x20, QUEUE_SIZE);
    if (s_len < 4)
        return;
    if (AV_RL32(s) == 0x56781234) {
        s += 4; s_len -= 4;
        qpos = 0x111;
        speclen = 0xF + 3;
    } else {
        qpos = 0xFEE;
        speclen = 100;
    }
    while (dataleft > 0 && s_len > 0) {
        tag = *s++; s_len--;
        if ((tag == 0xFF) && (dataleft > 8)) {
            if (d + 8 > d_end || s_len < 8)
                return;
            for (i = 0; i < 8; i++) {
                queue[qpos++] = *d++ = *s++;
                qpos &= QUEUE_MASK;
            }
            s_len -= 8;
            dataleft -= 8;
        } else {
            for (i = 0; i < 8; i++) {
                if (dataleft == 0)
                    break;
                if (tag & 0x01) {
                    if (d + 1 > d_end || s_len < 1)
                        return;
                    queue[qpos++] = *d++ = *s++;
                    qpos &= QUEUE_MASK;
                    dataleft--;
                    s_len--;
                } else {
                    if (s_len < 2)
                        return;
                    chainofs = *s++;
                    chainofs |= ((*s & 0xF0) << 4);
                    chainlen = (*s++ & 0x0F) + 3;
                    s_len -= 2;
                    if (chainlen == speclen) {
                        if (s_len < 1)
                            return;
                        chainlen = *s++ + 0xF + 3;
                        s_len--;
                    }
                    if (d + chainlen > d_end)
                        return;
                    for (j = 0; j < chainlen; j++) {
                        *d = queue[chainofs++ & QUEUE_MASK];
                        queue[qpos++] = *d++;
                        qpos &= QUEUE_MASK;
                    }
                    dataleft -= chainlen;
                }
                tag >>= 1;
            }
        }
    }
}
['static void vmd_decode(VmdVideoContext *s)\n{\n    int i;\n    unsigned int *palette32;\n    unsigned char r, g, b;\n    const unsigned char *p = s->buf + 16;\n    const unsigned char *pb;\n    unsigned int pb_size;\n    unsigned char meth;\n    unsigned char *dp;\n    unsigned char *pp;\n    unsigned char len;\n    int ofs;\n    int frame_x, frame_y;\n    int frame_width, frame_height;\n    frame_x = AV_RL16(&s->buf[6]);\n    frame_y = AV_RL16(&s->buf[8]);\n    frame_width = AV_RL16(&s->buf[10]) - frame_x + 1;\n    frame_height = AV_RL16(&s->buf[12]) - frame_y + 1;\n    if (frame_x < 0 || frame_width < 0 ||\n        frame_x >= s->avctx->width ||\n        frame_width > s->avctx->width ||\n        frame_x + frame_width > s->avctx->width)\n        return;\n    if (frame_y < 0 || frame_height < 0 ||\n        frame_y >= s->avctx->height ||\n        frame_height > s->avctx->height ||\n        frame_y + frame_height > s->avctx->height)\n        return;\n    if ((frame_width == s->avctx->width && frame_height == s->avctx->height) &&\n        (frame_x || frame_y)) {\n        s->x_off = frame_x;\n        s->y_off = frame_y;\n    }\n    frame_x -= s->x_off;\n    frame_y -= s->y_off;\n    if (s->prev_frame.data[0] &&\n        (frame_x || frame_y || (frame_width != s->avctx->width) ||\n        (frame_height != s->avctx->height))) {\n        memcpy(s->frame.data[0], s->prev_frame.data[0],\n            s->avctx->height * s->frame.linesize[0]);\n    }\n    if (s->buf[15] & 0x02) {\n        p += 2;\n        palette32 = (unsigned int *)s->palette;\n        for (i = 0; i < PALETTE_COUNT; i++) {\n            r = *p++ * 4;\n            g = *p++ * 4;\n            b = *p++ * 4;\n            palette32[i] = (r << 16) | (g << 8) | (b);\n        }\n        s->size -= (256 * 3 + 2);\n    }\n    if (s->size > 0) {\n        pb = p;\n        pb_size = s->buf + s->size - pb;\n        if (pb_size < 1)\n            return;\n        meth = *pb++; pb_size--;\n        if (meth & 0x80) {\n            lz_unpack(pb, pb_size,\n                      s->unpack_buffer, s->unpack_buffer_size);\n            meth &= 0x7F;\n            pb = s->unpack_buffer;\n            pb_size = s->unpack_buffer_size;\n        }\n        dp = &s->frame.data[0][frame_y * s->frame.linesize[0] + frame_x];\n        pp = &s->prev_frame.data[0][frame_y * s->prev_frame.linesize[0] + frame_x];\n        switch (meth) {\n        case 1:\n            for (i = 0; i < frame_height; i++) {\n                ofs = 0;\n                do {\n                    if (pb_size < 1)\n                        return;\n                    len = *pb++;\n                    pb_size--;\n                    if (len & 0x80) {\n                        len = (len & 0x7F) + 1;\n                        if (ofs + len > frame_width || pb_size < len)\n                            return;\n                        memcpy(&dp[ofs], pb, len);\n                        pb += len;\n                        pb_size -= len;\n                        ofs += len;\n                    } else {\n                        if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])\n                            return;\n                        memcpy(&dp[ofs], &pp[ofs], len + 1);\n                        ofs += len + 1;\n                    }\n                } while (ofs < frame_width);\n                if (ofs > frame_width) {\n                    av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\\n",\n                        ofs, frame_width);\n                    break;\n                }\n                dp += s->frame.linesize[0];\n                pp += s->prev_frame.linesize[0];\n            }\n            break;\n        case 2:\n            for (i = 0; i < frame_height; i++) {\n                if (pb_size < frame_width)\n                    return;\n                memcpy(dp, pb, frame_width);\n                pb += frame_width;\n                pb_size -= frame_width;\n                dp += s->frame.linesize[0];\n                pp += s->prev_frame.linesize[0];\n            }\n            break;\n        case 3:\n            for (i = 0; i < frame_height; i++) {\n                ofs = 0;\n                do {\n                    if (pb_size < 1)\n                        return;\n                    len = *pb++;\n                    pb_size--;\n                    if (len & 0x80) {\n                        len = (len & 0x7F) + 1;\n                        if (pb_size < 1)\n                            return;\n                        if (*pb++ == 0xFF)\n                            len = rle_unpack(pb, &dp[ofs], len, pb_size, frame_width - ofs);\n                        else {\n                            if (pb_size < len)\n                                return;\n                            memcpy(&dp[ofs], pb, len);\n                        }\n                        pb += len;\n                        pb_size -= 1 + len;\n                        ofs += len;\n                    } else {\n                        if (ofs + len + 1 > frame_width || !s->prev_frame.data[0])\n                            return;\n                        memcpy(&dp[ofs], &pp[ofs], len + 1);\n                        ofs += len + 1;\n                    }\n                } while (ofs < frame_width);\n                if (ofs > frame_width) {\n                    av_log(s->avctx, AV_LOG_ERROR, "VMD video: offset > width (%d > %d)\\n",\n                        ofs, frame_width);\n                }\n                dp += s->frame.linesize[0];\n                pp += s->prev_frame.linesize[0];\n            }\n            break;\n        }\n    }\n}', 'static void lz_unpack(const unsigned char *src, int src_len,\n                      unsigned char *dest, int dest_len)\n{\n    const unsigned char *s;\n    unsigned int s_len;\n    unsigned char *d;\n    unsigned char *d_end;\n    unsigned char queue[QUEUE_SIZE];\n    unsigned int qpos;\n    unsigned int dataleft;\n    unsigned int chainofs;\n    unsigned int chainlen;\n    unsigned int speclen;\n    unsigned char tag;\n    unsigned int i, j;\n    s = src;\n    s_len = src_len;\n    d = dest;\n    d_end = d + dest_len;\n    dataleft = AV_RL32(s);\n    s += 4; s_len -= 4;\n    memset(queue, 0x20, QUEUE_SIZE);\n    if (s_len < 4)\n        return;\n    if (AV_RL32(s) == 0x56781234) {\n        s += 4; s_len -= 4;\n        qpos = 0x111;\n        speclen = 0xF + 3;\n    } else {\n        qpos = 0xFEE;\n        speclen = 100;\n    }\n    while (dataleft > 0 && s_len > 0) {\n        tag = *s++; s_len--;\n        if ((tag == 0xFF) && (dataleft > 8)) {\n            if (d + 8 > d_end || s_len < 8)\n                return;\n            for (i = 0; i < 8; i++) {\n                queue[qpos++] = *d++ = *s++;\n                qpos &= QUEUE_MASK;\n            }\n            s_len -= 8;\n            dataleft -= 8;\n        } else {\n            for (i = 0; i < 8; i++) {\n                if (dataleft == 0)\n                    break;\n                if (tag & 0x01) {\n                    if (d + 1 > d_end || s_len < 1)\n                        return;\n                    queue[qpos++] = *d++ = *s++;\n                    qpos &= QUEUE_MASK;\n                    dataleft--;\n                    s_len--;\n                } else {\n                    if (s_len < 2)\n                        return;\n                    chainofs = *s++;\n                    chainofs |= ((*s & 0xF0) << 4);\n                    chainlen = (*s++ & 0x0F) + 3;\n                    s_len -= 2;\n                    if (chainlen == speclen) {\n                        if (s_len < 1)\n                            return;\n                        chainlen = *s++ + 0xF + 3;\n                        s_len--;\n                    }\n                    if (d + chainlen > d_end)\n                        return;\n                    for (j = 0; j < chainlen; j++) {\n                        *d = queue[chainofs++ & QUEUE_MASK];\n                        queue[qpos++] = *d++;\n                        qpos &= QUEUE_MASK;\n                    }\n                    dataleft -= chainlen;\n                }\n                tag >>= 1;\n            }\n        }\n    }\n}']