libavcodec/indeo3.c:823: error: Integer Overflow L2
  ([0, 247] - [0, 247]):unsigned8 by call to `decode_cell`.

libavcodec/indeo3.c:744:1: Parameter `*ctx->next_cell_data`
742. 
743. 
744. static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
     ^
745.                          Plane *plane, int code, Cell *ref_cell,
746.                          const int depth, const int strip_width)

libavcodec/indeo3.c:823:30: Call
821. 
822.                 CHECK_CELL
823.                 bytes_used = decode_cell(ctx, avctx, plane, &curr_cell,
                                  ^
824.                                          ctx->next_cell_data, ctx->last_byte);
825.                 if (bytes_used < 0)

libavcodec/indeo3.c:574:1: Parameter `*data_ptr`
  572.  *  @return         number of consumed bytes or negative number in case of error
  573.  */
  574. static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
       ^
  575.                        Plane *plane, Cell *cell, const uint8_t *data_ptr,
  576.                        const uint8_t *last_ptr)

libavcodec/indeo3.c:663:17: Call
  661. 
  662.         zoom_fac = mode >= 3;
  663.         error = decode_cell_data(ctx, cell, block, ref_block, plane->pitch,
                       ^
  664.                                  0, zoom_fac, mode, delta, swap_quads,
  665.                                  &data_ptr, last_ptr);

libavcodec/indeo3.c:418:1: <LHS trace>
416. 
417. 
418. static int decode_cell_data(Indeo3DecodeContext *ctx, Cell *cell,
     ^
419.                             uint8_t *block, uint8_t *ref_block,
420.                             ptrdiff_t row_offset, int h_zoom, int v_zoom, int mode,

libavcodec/indeo3.c:418:1: Parameter `(*delta)->num_dyads`
    416. 
    417. 
    418. static int decode_cell_data(Indeo3DecodeContext *ctx, Cell *cell,
         ^
    419.                             uint8_t *block, uint8_t *ref_block,
    420.                             ptrdiff_t row_offset, int h_zoom, int v_zoom, int mode,

libavcodec/indeo3.c:418:1: <RHS trace>
416. 
417. 
418. static int decode_cell_data(Indeo3DecodeContext *ctx, Cell *cell,
     ^
419.                             uint8_t *block, uint8_t *ref_block,
420.                             ptrdiff_t row_offset, int h_zoom, int v_zoom, int mode,

libavcodec/indeo3.c:418:1: Parameter `(*delta)->num_dyads`
    416. 
    417. 
    418. static int decode_cell_data(Indeo3DecodeContext *ctx, Cell *cell,
         ^
    419.                             uint8_t *block, uint8_t *ref_block,
    420.                             ptrdiff_t row_offset, int h_zoom, int v_zoom, int mode,

libavcodec/indeo3.c:472:29: Binary operation: ([0, 247] - [0, 247]):unsigned8 by call to `decode_cell` 
    470.                         } else {
    471.                             /* process QUADS */
    472.                             code -= delta_tab->num_dyads;
                                     ^
    473.                             dyad1 = code / delta_tab->quad_exp;
    474.                             dyad2 = code % delta_tab->quad_exp;

static int decode_cell_data(Indeo3DecodeContext *ctx, Cell *cell,
                            uint8_t *block, uint8_t *ref_block,
                            ptrdiff_t row_offset, int h_zoom, int v_zoom, int mode,
                            const vqEntry *delta[2], int swap_quads[2],
                            const uint8_t **data_ptr, const uint8_t *last_ptr)
{
    int           x, y, line, num_lines;
    int           rle_blocks = 0;
    uint8_t       code, *dst, *ref;
    const vqEntry *delta_tab;
    unsigned int  dyad1, dyad2;
    uint64_t      pix64;
    int           skip_flag = 0, is_top_of_cell, is_first_row = 1;
    int           blk_row_offset, line_offset;
    blk_row_offset = (row_offset << (2 + v_zoom)) - (cell->width << 2);
    line_offset    = v_zoom ? row_offset : 0;
    if (cell->height & v_zoom || cell->width & h_zoom)
        return IV3_BAD_DATA;
    for (y = 0; y < cell->height; is_first_row = 0, y += 1 + v_zoom) {
        for (x = 0; x < cell->width; x += 1 + h_zoom) {
            ref = ref_block;
            dst = block;
            if (rle_blocks > 0) {
                if (mode <= 4) {
                    RLE_BLOCK_COPY;
                } else if (mode == 10 && !cell->mv_ptr) {
                    RLE_BLOCK_COPY_8;
                }
                rle_blocks--;
            } else {
                for (line = 0; line < 4;) {
                    num_lines = 1;
                    is_top_of_cell = is_first_row && !line;
                    if (mode <= 4)
                        delta_tab = delta[line & 1];
                    else
                        delta_tab = delta[1];
                    BUFFER_PRECHECK;
                    code = bytestream_get_byte(data_ptr);
                    if (code < 248) {
                        if (code < delta_tab->num_dyads) {
                            BUFFER_PRECHECK;
                            dyad1 = bytestream_get_byte(data_ptr);
                            dyad2 = code;
                            if (dyad1 >= delta_tab->num_dyads || dyad1 >= 248)
                                return IV3_BAD_DATA;
                        } else {
                            code -= delta_tab->num_dyads;
                            dyad1 = code / delta_tab->quad_exp;
                            dyad2 = code % delta_tab->quad_exp;
                            if (swap_quads[line & 1])
                                FFSWAP(unsigned int, dyad1, dyad2);
                        }
                        if (mode <= 4) {
                            APPLY_DELTA_4;
                        } else if (mode == 10 && !cell->mv_ptr) {
                            APPLY_DELTA_8;
                        } else {
                            APPLY_DELTA_1011_INTER;
                        }
                    } else {
                        switch (code) {
                        case RLE_ESC_FC:
                            skip_flag  = 0;
                            rle_blocks = 1;
                            code       = 253;
                        case RLE_ESC_FF:
                        case RLE_ESC_FE:
                        case RLE_ESC_FD:
                            num_lines = 257 - code - line;
                            if (num_lines <= 0)
                                return IV3_BAD_RLE;
                            if (mode <= 4) {
                                RLE_LINES_COPY;
                            } else if (mode == 10 && !cell->mv_ptr) {
                                RLE_LINES_COPY_M10;
                            }
                            break;
                        case RLE_ESC_FB:
                            BUFFER_PRECHECK;
                            code = bytestream_get_byte(data_ptr);
                            rle_blocks = (code & 0x1F) - 1;
                            if (code >= 64 || rle_blocks < 0)
                                return IV3_BAD_COUNTER;
                            skip_flag = code & 0x20;
                            num_lines = 4 - line;
                            if (mode >= 10 || (cell->mv_ptr || !skip_flag)) {
                                if (mode <= 4) {
                                    RLE_LINES_COPY;
                                } else if (mode == 10 && !cell->mv_ptr) {
                                    RLE_LINES_COPY_M10;
                                }
                            }
                            break;
                        case RLE_ESC_F9:
                            skip_flag  = 1;
                            rle_blocks = 1;
                        case RLE_ESC_FA:
                            if (line)
                                return IV3_BAD_RLE;
                            num_lines = 4;
                            if (cell->mv_ptr) {
                                if (mode <= 4) {
                                    RLE_LINES_COPY;
                                } else if (mode == 10 && !cell->mv_ptr) {
                                    RLE_LINES_COPY_M10;
                                }
                            }
                            break;
                        default:
                            return IV3_UNSUPPORTED;
                        }
                    }
                    line += num_lines;
                    ref  += row_offset * (num_lines << v_zoom);
                    dst  += row_offset * (num_lines << v_zoom);
                }
            }
            block     += 4 << h_zoom;
            ref_block += 4 << h_zoom;
        }
        ref_block += blk_row_offset;
        block     += blk_row_offset;
    }
    return IV3_NOERR;
}
['static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,\n                         Plane *plane, int code, Cell *ref_cell,\n                         const int depth, const int strip_width)\n{\n    Cell    curr_cell;\n    int     bytes_used, ret;\n    if (depth <= 0) {\n        av_log(avctx, AV_LOG_ERROR, "Stack overflow (corrupted binary tree)!\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    curr_cell = *ref_cell;\n    if (code == H_SPLIT) {\n        SPLIT_CELL(ref_cell->height, curr_cell.height);\n        ref_cell->ypos   += curr_cell.height;\n        ref_cell->height -= curr_cell.height;\n        if (ref_cell->height <= 0 || curr_cell.height <= 0)\n            return AVERROR_INVALIDDATA;\n    } else if (code == V_SPLIT) {\n        if (curr_cell.width > strip_width) {\n            curr_cell.width = (curr_cell.width <= (strip_width << 1) ? 1 : 2) * strip_width;\n        } else\n            SPLIT_CELL(ref_cell->width, curr_cell.width);\n        ref_cell->xpos  += curr_cell.width;\n        ref_cell->width -= curr_cell.width;\n        if (ref_cell->width <= 0 || curr_cell.width <= 0)\n            return AVERROR_INVALIDDATA;\n    }\n    while (1) {\n        RESYNC_BITSTREAM;\n        switch (code = bitstream_read(&ctx->bc, 2)) {\n        case H_SPLIT:\n        case V_SPLIT:\n            if (parse_bintree(ctx, avctx, plane, code, &curr_cell, depth - 1, strip_width))\n                return AVERROR_INVALIDDATA;\n            break;\n        case INTRA_NULL:\n            if (!curr_cell.tree) {\n                curr_cell.mv_ptr = 0;\n                curr_cell.tree   = 1;\n            } else {\n                RESYNC_BITSTREAM;\n                code = bitstream_read(&ctx->bc, 2);\n                if (code >= 2) {\n                    av_log(avctx, AV_LOG_ERROR, "Invalid VQ_NULL code: %d\\n", code);\n                    return AVERROR_INVALIDDATA;\n                }\n                if (code == 1)\n                    av_log(avctx, AV_LOG_ERROR, "SkipCell procedure not implemented yet!\\n");\n                CHECK_CELL\n                if (!curr_cell.mv_ptr)\n                    return AVERROR_INVALIDDATA;\n                ret = copy_cell(ctx, plane, &curr_cell);\n                return ret;\n            }\n            break;\n        case INTER_DATA:\n            if (!curr_cell.tree) {\n                unsigned mv_idx;\n                if (!ctx->need_resync)\n                    ctx->next_cell_data = &ctx->bc.buffer[(bitstream_tell(&ctx->bc) + 7) >> 3];\n                mv_idx = *(ctx->next_cell_data++);\n                if (mv_idx >= ctx->num_vectors) {\n                    av_log(avctx, AV_LOG_ERROR, "motion vector index out of range\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                curr_cell.mv_ptr = &ctx->mc_vectors[mv_idx << 1];\n                curr_cell.tree   = 1;\n                UPDATE_BITPOS(8);\n            } else {\n                if (!ctx->need_resync)\n                    ctx->next_cell_data = &ctx->bc.buffer[(bitstream_tell(&ctx->bc) + 7) >> 3];\n                CHECK_CELL\n                bytes_used = decode_cell(ctx, avctx, plane, &curr_cell,\n                                         ctx->next_cell_data, ctx->last_byte);\n                if (bytes_used < 0)\n                    return AVERROR_INVALIDDATA;\n                UPDATE_BITPOS(bytes_used << 3);\n                ctx->next_cell_data += bytes_used;\n                return 0;\n            }\n            break;\n        }\n    }\n}', 'static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx,\n                       Plane *plane, Cell *cell, const uint8_t *data_ptr,\n                       const uint8_t *last_ptr)\n{\n    int           x, mv_x, mv_y, mode, vq_index, prim_indx, second_indx;\n    int           zoom_fac;\n    int           offset, error = 0, swap_quads[2];\n    uint8_t       code, *block, *ref_block = 0;\n    const vqEntry *delta[2];\n    const uint8_t *data_start = data_ptr;\n    code     = *data_ptr++;\n    mode     = code >> 4;\n    vq_index = code & 0xF;\n    offset = (cell->ypos << 2) * plane->pitch + (cell->xpos << 2);\n    block  =  plane->pixels[ctx->buf_sel] + offset;\n    if (!cell->mv_ptr) {\n        ref_block = block - plane->pitch;\n    } else if (mode >= 10) {\n        int ret = copy_cell(ctx, plane, cell);\n        if (ret < 0)\n            return ret;\n    } else {\n        mv_y      = cell->mv_ptr[0];\n        mv_x      = cell->mv_ptr[1];\n        if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 ||\n            ((cell->ypos + cell->height) << 2) + mv_y > plane->height     ||\n            ((cell->xpos + cell->width)  << 2) + mv_x > plane->width) {\n            av_log(ctx->avctx, AV_LOG_ERROR,\n                   "Motion vectors point out of the frame.\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        offset   += mv_y * plane->pitch + mv_x;\n        ref_block = plane->pixels[ctx->buf_sel ^ 1] + offset;\n    }\n    if (mode == 1 || mode == 4) {\n        code        = ctx->alt_quant[vq_index];\n        prim_indx   = (code >> 4)  + ctx->cb_offset;\n        second_indx = (code & 0xF) + ctx->cb_offset;\n    } else {\n        vq_index += ctx->cb_offset;\n        prim_indx = second_indx = vq_index;\n    }\n    if (prim_indx >= 24 || second_indx >= 24) {\n        av_log(avctx, AV_LOG_ERROR, "Invalid VQ table indexes! Primary: %d, secondary: %d!\\n",\n               prim_indx, second_indx);\n        return AVERROR_INVALIDDATA;\n    }\n    delta[0] = &vq_tab[second_indx];\n    delta[1] = &vq_tab[prim_indx];\n    swap_quads[0] = second_indx >= 16;\n    swap_quads[1] = prim_indx   >= 16;\n    if (vq_index >= 8 && ref_block) {\n        for (x = 0; x < cell->width << 2; x++)\n            ref_block[x] = requant_tab[vq_index & 7][ref_block[x]];\n    }\n    error = IV3_NOERR;\n    switch (mode) {\n    case 0:\n    case 1:\n    case 3:\n    case 4:\n        if (mode >= 3 && cell->mv_ptr) {\n            av_log(avctx, AV_LOG_ERROR, "Attempt to apply Mode 3/4 to an INTER cell!\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        zoom_fac = mode >= 3;\n        error = decode_cell_data(ctx, cell, block, ref_block, plane->pitch,\n                                 0, zoom_fac, mode, delta, swap_quads,\n                                 &data_ptr, last_ptr);\n        break;\n    case 10:\n    case 11:\n        if (mode == 10 && !cell->mv_ptr) {\n            error = decode_cell_data(ctx, cell, block, ref_block, plane->pitch,\n                                     1, 1, mode, delta, swap_quads,\n                                     &data_ptr, last_ptr);\n        } else {\n            if (mode == 11 && !cell->mv_ptr) {\n               av_log(avctx, AV_LOG_ERROR, "Attempt to use Mode 11 for an INTRA cell!\\n");\n               return AVERROR_INVALIDDATA;\n            }\n            zoom_fac = mode == 10;\n            error = decode_cell_data(ctx, cell, block, ref_block, plane->pitch,\n                                     zoom_fac, 1, mode, delta, swap_quads,\n                                     &data_ptr, last_ptr);\n        }\n        break;\n    default:\n        av_log(avctx, AV_LOG_ERROR, "Unsupported coding mode: %d\\n", mode);\n        return AVERROR_INVALIDDATA;\n    }\n    switch (error) {\n    case IV3_BAD_RLE:\n        av_log(avctx, AV_LOG_ERROR, "Mode %d: RLE code %X is not allowed at the current line\\n",\n               mode, data_ptr[-1]);\n        return AVERROR_INVALIDDATA;\n    case IV3_BAD_DATA:\n        av_log(avctx, AV_LOG_ERROR, "Mode %d: invalid VQ data\\n", mode);\n        return AVERROR_INVALIDDATA;\n    case IV3_BAD_COUNTER:\n        av_log(avctx, AV_LOG_ERROR, "Mode %d: RLE-FB invalid counter: %d\\n", mode, code);\n        return AVERROR_INVALIDDATA;\n    case IV3_UNSUPPORTED:\n        av_log(avctx, AV_LOG_ERROR, "Mode %d: unsupported RLE code: %X\\n", mode, data_ptr[-1]);\n        return AVERROR_INVALIDDATA;\n    case IV3_OUT_OF_DATA:\n        av_log(avctx, AV_LOG_ERROR, "Mode %d: attempt to read past end of buffer\\n", mode);\n        return AVERROR_INVALIDDATA;\n    }\n    return data_ptr - data_start;\n}', 'static int decode_cell_data(Indeo3DecodeContext *ctx, Cell *cell,\n                            uint8_t *block, uint8_t *ref_block,\n                            ptrdiff_t row_offset, int h_zoom, int v_zoom, int mode,\n                            const vqEntry *delta[2], int swap_quads[2],\n                            const uint8_t **data_ptr, const uint8_t *last_ptr)\n{\n    int           x, y, line, num_lines;\n    int           rle_blocks = 0;\n    uint8_t       code, *dst, *ref;\n    const vqEntry *delta_tab;\n    unsigned int  dyad1, dyad2;\n    uint64_t      pix64;\n    int           skip_flag = 0, is_top_of_cell, is_first_row = 1;\n    int           blk_row_offset, line_offset;\n    blk_row_offset = (row_offset << (2 + v_zoom)) - (cell->width << 2);\n    line_offset    = v_zoom ? row_offset : 0;\n    if (cell->height & v_zoom || cell->width & h_zoom)\n        return IV3_BAD_DATA;\n    for (y = 0; y < cell->height; is_first_row = 0, y += 1 + v_zoom) {\n        for (x = 0; x < cell->width; x += 1 + h_zoom) {\n            ref = ref_block;\n            dst = block;\n            if (rle_blocks > 0) {\n                if (mode <= 4) {\n                    RLE_BLOCK_COPY;\n                } else if (mode == 10 && !cell->mv_ptr) {\n                    RLE_BLOCK_COPY_8;\n                }\n                rle_blocks--;\n            } else {\n                for (line = 0; line < 4;) {\n                    num_lines = 1;\n                    is_top_of_cell = is_first_row && !line;\n                    if (mode <= 4)\n                        delta_tab = delta[line & 1];\n                    else\n                        delta_tab = delta[1];\n                    BUFFER_PRECHECK;\n                    code = bytestream_get_byte(data_ptr);\n                    if (code < 248) {\n                        if (code < delta_tab->num_dyads) {\n                            BUFFER_PRECHECK;\n                            dyad1 = bytestream_get_byte(data_ptr);\n                            dyad2 = code;\n                            if (dyad1 >= delta_tab->num_dyads || dyad1 >= 248)\n                                return IV3_BAD_DATA;\n                        } else {\n                            code -= delta_tab->num_dyads;\n                            dyad1 = code / delta_tab->quad_exp;\n                            dyad2 = code % delta_tab->quad_exp;\n                            if (swap_quads[line & 1])\n                                FFSWAP(unsigned int, dyad1, dyad2);\n                        }\n                        if (mode <= 4) {\n                            APPLY_DELTA_4;\n                        } else if (mode == 10 && !cell->mv_ptr) {\n                            APPLY_DELTA_8;\n                        } else {\n                            APPLY_DELTA_1011_INTER;\n                        }\n                    } else {\n                        switch (code) {\n                        case RLE_ESC_FC:\n                            skip_flag  = 0;\n                            rle_blocks = 1;\n                            code       = 253;\n                        case RLE_ESC_FF:\n                        case RLE_ESC_FE:\n                        case RLE_ESC_FD:\n                            num_lines = 257 - code - line;\n                            if (num_lines <= 0)\n                                return IV3_BAD_RLE;\n                            if (mode <= 4) {\n                                RLE_LINES_COPY;\n                            } else if (mode == 10 && !cell->mv_ptr) {\n                                RLE_LINES_COPY_M10;\n                            }\n                            break;\n                        case RLE_ESC_FB:\n                            BUFFER_PRECHECK;\n                            code = bytestream_get_byte(data_ptr);\n                            rle_blocks = (code & 0x1F) - 1;\n                            if (code >= 64 || rle_blocks < 0)\n                                return IV3_BAD_COUNTER;\n                            skip_flag = code & 0x20;\n                            num_lines = 4 - line;\n                            if (mode >= 10 || (cell->mv_ptr || !skip_flag)) {\n                                if (mode <= 4) {\n                                    RLE_LINES_COPY;\n                                } else if (mode == 10 && !cell->mv_ptr) {\n                                    RLE_LINES_COPY_M10;\n                                }\n                            }\n                            break;\n                        case RLE_ESC_F9:\n                            skip_flag  = 1;\n                            rle_blocks = 1;\n                        case RLE_ESC_FA:\n                            if (line)\n                                return IV3_BAD_RLE;\n                            num_lines = 4;\n                            if (cell->mv_ptr) {\n                                if (mode <= 4) {\n                                    RLE_LINES_COPY;\n                                } else if (mode == 10 && !cell->mv_ptr) {\n                                    RLE_LINES_COPY_M10;\n                                }\n                            }\n                            break;\n                        default:\n                            return IV3_UNSUPPORTED;\n                        }\n                    }\n                    line += num_lines;\n                    ref  += row_offset * (num_lines << v_zoom);\n                    dst  += row_offset * (num_lines << v_zoom);\n                }\n            }\n            block     += 4 << h_zoom;\n            ref_block += 4 << h_zoom;\n        }\n        ref_block += blk_row_offset;\n        block     += blk_row_offset;\n    }\n    return IV3_NOERR;\n}']