libavcodec/vb.c:215: error: Integer Overflow L2
  ([min(0, `avpkt->data->l`), max(0, `avpkt->data->l`)] - 4):unsigned32.

libavcodec/vb.c:187:1: <LHS trace>
185. }
186. 
187. static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     ^
188.                         AVPacket *avpkt)
189. {

libavcodec/vb.c:187:1: Parameter `avpkt->data->l`
185. }
186. 
187. static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     ^
188.                         AVPacket *avpkt)
189. {

libavcodec/vb.c:213:16: Call
211.     }
212.     if (flags & VB_HAS_VIDEO) {
213.         size = bytestream2_get_le32(&c->stream);
                    ^
214.         vb_decode_framedata(c, offset);
215.         bytestream2_skip(&c->stream, size - 4);

libavcodec/bytestream.h:85:1: Assignment
  83. 
  84. DEF(uint64_t,     le64, 8, AV_RL64, AV_WL64)
  85. DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)
      ^
  86. DEF(unsigned int, le24, 3, AV_RL24, AV_WL24)
  87. DEF(unsigned int, le16, 2, AV_RL16, AV_WL16)

libavcodec/vb.c:213:9: Assignment
211.     }
212.     if (flags & VB_HAS_VIDEO) {
213.         size = bytestream2_get_le32(&c->stream);
             ^
214.         vb_decode_framedata(c, offset);
215.         bytestream2_skip(&c->stream, size - 4);

libavcodec/vb.c:215:9: Binary operation: ([min(0, avpkt->data->l), max(0, avpkt->data->l)] - 4):unsigned32
213.         size = bytestream2_get_le32(&c->stream);
214.         vb_decode_framedata(c, offset);
215.         bytestream2_skip(&c->stream, size - 4);
             ^
216.     }
217.     if (flags & VB_HAS_PALETTE) {

static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
                        AVPacket *avpkt)
{
    VBDecContext * const c = avctx->priv_data;
    AVFrame *frame         = data;
    uint8_t *outptr, *srcptr;
    int i, j, ret;
    int flags;
    uint32_t size;
    int offset = 0;
    bytestream2_init(&c->stream, avpkt->data, avpkt->size);
    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        return ret;
    }
    flags = bytestream2_get_le16(&c->stream);
    if (flags & VB_HAS_GMC) {
        i = (int16_t)bytestream2_get_le16(&c->stream);
        j = (int16_t)bytestream2_get_le16(&c->stream);
        offset = i + j * avctx->width;
    }
    if (flags & VB_HAS_VIDEO) {
        size = bytestream2_get_le32(&c->stream);
        vb_decode_framedata(c, offset);
        bytestream2_skip(&c->stream, size - 4);
    }
    if (flags & VB_HAS_PALETTE) {
        size = bytestream2_get_le32(&c->stream);
        vb_decode_palette(c, size);
    }
    memcpy(frame->data[1], c->pal, AVPALETTE_SIZE);
    frame->palette_has_changed = flags & VB_HAS_PALETTE;
    outptr = frame->data[0];
    srcptr = c->frame;
    for (i = 0; i < avctx->height; i++) {
        memcpy(outptr, srcptr, avctx->width);
        srcptr += avctx->width;
        outptr += frame->linesize[0];
    }
    FFSWAP(uint8_t*, c->frame, c->prev_frame);
    *got_frame = 1;
    return avpkt->size;
}
['static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,\n                        AVPacket *avpkt)\n{\n    VBDecContext * const c = avctx->priv_data;\n    AVFrame *frame         = data;\n    uint8_t *outptr, *srcptr;\n    int i, j, ret;\n    int flags;\n    uint32_t size;\n    int offset = 0;\n    bytestream2_init(&c->stream, avpkt->data, avpkt->size);\n    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    flags = bytestream2_get_le16(&c->stream);\n    if (flags & VB_HAS_GMC) {\n        i = (int16_t)bytestream2_get_le16(&c->stream);\n        j = (int16_t)bytestream2_get_le16(&c->stream);\n        offset = i + j * avctx->width;\n    }\n    if (flags & VB_HAS_VIDEO) {\n        size = bytestream2_get_le32(&c->stream);\n        vb_decode_framedata(c, offset);\n        bytestream2_skip(&c->stream, size - 4);\n    }\n    if (flags & VB_HAS_PALETTE) {\n        size = bytestream2_get_le32(&c->stream);\n        vb_decode_palette(c, size);\n    }\n    memcpy(frame->data[1], c->pal, AVPALETTE_SIZE);\n    frame->palette_has_changed = flags & VB_HAS_PALETTE;\n    outptr = frame->data[0];\n    srcptr = c->frame;\n    for (i = 0; i < avctx->height; i++) {\n        memcpy(outptr, srcptr, avctx->width);\n        srcptr += avctx->width;\n        outptr += frame->linesize[0];\n    }\n    FFSWAP(uint8_t*, c->frame, c->prev_frame);\n    *got_frame = 1;\n    return avpkt->size;\n}', 'DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)']