libavcodec/opus_celt.c:1807: error: Integer Overflow L2
  ([0, +oo] - 3):unsigned32 by call to `opus_getrawbits`.

libavcodec/opus_celt.c:1805:22: Call
1803.             int tapset, octave, period;
1804. 
1805.             octave = opus_rc_unimodel(rc, 6);
                           ^
1806.             period = (16 << octave) + opus_getrawbits(rc, 4 + octave) - 1;
1807.             gain   = 0.09375f * (opus_getrawbits(rc, 3) + 1);

libavcodec/opus.h:286:1: Parameter `rc->rb.cachelen`
  284.  * CELT: read a uniform distribution
  285.  */
  286. static av_always_inline unsigned int opus_rc_unimodel(OpusRangeCoder *rc, unsigned int size)
       ^
  287. {
  288.     unsigned int bits, k, scale, total;

libavcodec/opus_celt.c:1806:39: Call
1804. 
1805.             octave = opus_rc_unimodel(rc, 6);
1806.             period = (16 << octave) + opus_getrawbits(rc, 4 + octave) - 1;
                                            ^
1807.             gain   = 0.09375f * (opus_getrawbits(rc, 3) + 1);
1808.             tapset = (opus_rc_tell(rc) + 2 <= s->framebits) ?

libavcodec/opus.h:265:1: Parameter `count`
  263.  * CELT: read 1-25 raw bits at the end of the frame, backwards byte-wise
  264.  */
  265. static av_always_inline unsigned int opus_getrawbits(OpusRangeCoder *rc, unsigned int count)
       ^
  266. {
  267.     unsigned int value = 0;

libavcodec/opus.h:277:5: Assignment
  275.     value = rc->rb.cacheval & ((1<<count)-1);
  276.     rc->rb.cacheval    >>= count;
  277.     rc->rb.cachelen     -= count;
           ^
  278.     rc->total_read_bits += count;
  279. 

libavcodec/opus_celt.c:1807:34: Call
1805.             octave = opus_rc_unimodel(rc, 6);
1806.             period = (16 << octave) + opus_getrawbits(rc, 4 + octave) - 1;
1807.             gain   = 0.09375f * (opus_getrawbits(rc, 3) + 1);
                                       ^
1808.             tapset = (opus_rc_tell(rc) + 2 <= s->framebits) ?
1809.                      opus_rc_getsymbol(rc, celt_model_tapset) : 0;

libavcodec/opus.h:265:1: <LHS trace>
263.  * CELT: read 1-25 raw bits at the end of the frame, backwards byte-wise
264.  */
265. static av_always_inline unsigned int opus_getrawbits(OpusRangeCoder *rc, unsigned int count)
     ^
266. {
267.     unsigned int value = 0;

libavcodec/opus.h:265:1: Parameter `count`
  263.  * CELT: read 1-25 raw bits at the end of the frame, backwards byte-wise
  264.  */
  265. static av_always_inline unsigned int opus_getrawbits(OpusRangeCoder *rc, unsigned int count)
       ^
  266. {
  267.     unsigned int value = 0;

libavcodec/opus.h:265:1: <RHS trace>
263.  * CELT: read 1-25 raw bits at the end of the frame, backwards byte-wise
264.  */
265. static av_always_inline unsigned int opus_getrawbits(OpusRangeCoder *rc, unsigned int count)
     ^
266. {
267.     unsigned int value = 0;

libavcodec/opus.h:265:1: Parameter `count`
  263.  * CELT: read 1-25 raw bits at the end of the frame, backwards byte-wise
  264.  */
  265. static av_always_inline unsigned int opus_getrawbits(OpusRangeCoder *rc, unsigned int count)
       ^
  266. {
  267.     unsigned int value = 0;

libavcodec/opus.h:277:5: Binary operation: ([0, +oo] - 3):unsigned32 by call to `opus_getrawbits` 
  275.     value = rc->rb.cacheval & ((1<<count)-1);
  276.     rc->rb.cacheval    >>= count;
  277.     rc->rb.cachelen     -= count;
           ^
  278.     rc->total_read_bits += count;
  279. 

static av_always_inline unsigned int opus_getrawbits(OpusRangeCoder *rc, unsigned int count)
{
    unsigned int value = 0;
    while (rc->rb.bytes && rc->rb.cachelen < count) {
        rc->rb.cacheval |= *--rc->rb.position << rc->rb.cachelen;
        rc->rb.cachelen += 8;
        rc->rb.bytes--;
    }
    value = rc->rb.cacheval & ((1<<count)-1);
    rc->rb.cacheval    >>= count;
    rc->rb.cachelen     -= count;
    rc->total_read_bits += count;
    return value;
}
['static int parse_postfilter(CeltContext *s, OpusRangeCoder *rc, int consumed)\n{\n    static const float postfilter_taps[3][3] = {\n        { 0.3066406250f, 0.2170410156f, 0.1296386719f },\n        { 0.4638671875f, 0.2680664062f, 0.0           },\n        { 0.7998046875f, 0.1000976562f, 0.0           }\n    };\n    int i;\n    memset(s->frame[0].pf_gains_new, 0, sizeof(s->frame[0].pf_gains_new));\n    memset(s->frame[1].pf_gains_new, 0, sizeof(s->frame[1].pf_gains_new));\n    if (s->startband == 0 && consumed + 16 <= s->framebits) {\n        int has_postfilter = opus_rc_p2model(rc, 1);\n        if (has_postfilter) {\n            float gain;\n            int tapset, octave, period;\n            octave = opus_rc_unimodel(rc, 6);\n            period = (16 << octave) + opus_getrawbits(rc, 4 + octave) - 1;\n            gain   = 0.09375f * (opus_getrawbits(rc, 3) + 1);\n            tapset = (opus_rc_tell(rc) + 2 <= s->framebits) ?\n                     opus_rc_getsymbol(rc, celt_model_tapset) : 0;\n            for (i = 0; i < 2; i++) {\n                CeltFrame *frame = &s->frame[i];\n                frame->pf_period_new = FFMAX(period, CELT_POSTFILTER_MINPERIOD);\n                frame->pf_gains_new[0] = gain * postfilter_taps[tapset][0];\n                frame->pf_gains_new[1] = gain * postfilter_taps[tapset][1];\n                frame->pf_gains_new[2] = gain * postfilter_taps[tapset][2];\n            }\n        }\n        consumed = opus_rc_tell(rc);\n    }\n    return consumed;\n}', 'static av_always_inline unsigned int opus_rc_unimodel(OpusRangeCoder *rc, unsigned int size)\n{\n    unsigned int bits, k, scale, total;\n    bits  = opus_ilog(size - 1);\n    total = (bits > 8) ? ((size - 1) >> (bits - 8)) + 1 : size;\n    scale  = rc->range / total;\n    k      = rc->value / scale + 1;\n    k      = total - FFMIN(k, total);\n    opus_rc_update(rc, scale, k, k + 1, total);\n    if (bits > 8) {\n        k = k << (bits - 8) | opus_getrawbits(rc, bits - 8);\n        return FFMIN(k, size - 1);\n    } else\n        return k;\n}', 'static av_always_inline unsigned int opus_getrawbits(OpusRangeCoder *rc, unsigned int count)\n{\n    unsigned int value = 0;\n    while (rc->rb.bytes && rc->rb.cachelen < count) {\n        rc->rb.cacheval |= *--rc->rb.position << rc->rb.cachelen;\n        rc->rb.cachelen += 8;\n        rc->rb.bytes--;\n    }\n    value = rc->rb.cacheval & ((1<<count)-1);\n    rc->rb.cacheval    >>= count;\n    rc->rb.cachelen     -= count;\n    rc->total_read_bits += count;\n    return value;\n}']