libavcodec/qtrle.c:170: error: Integer Overflow L2
  ([0, `*s->g.buffer`] - 1):unsigned32.

libavcodec/qtrle.c:160:1: <LHS trace>
158. }
159. 
160. static void qtrle_decode_8bpp(QtrleContext *s, int row_ptr, int lines_to_change)
     ^
161. {
162.     int rle_code;

libavcodec/qtrle.c:160:1: Parameter `*s->g.buffer`
158. }
159. 
160. static void qtrle_decode_8bpp(QtrleContext *s, int row_ptr, int lines_to_change)
     ^
161. {
162.     int rle_code;

libavcodec/qtrle.c:170:37: Call
168. 
169.     while (lines_to_change--) {
170.         pixel_ptr = row_ptr + (4 * (bytestream2_get_byte(&s->g) - 1));
                                         ^
171. 
172.         while ((rle_code = (signed char)bytestream2_get_byte(&s->g)) != -1) {

libavcodec/bytestream.h:96:1: Assignment
  94. DEF  (be24, 3, AV_RB24, AV_WB24)
  95. DEF  (be16, 2, AV_RB16, AV_WB16)
  96. DEF  (byte, 1, AV_RB8 , AV_WB8 )
      ^
  97. 
  98. #undef DEF

libavcodec/qtrle.c:170:9: Binary operation: ([0, *s->g.buffer] - 1):unsigned32
168. 
169.     while (lines_to_change--) {
170.         pixel_ptr = row_ptr + (4 * (bytestream2_get_byte(&s->g) - 1));
             ^
171. 
172.         while ((rle_code = (signed char)bytestream2_get_byte(&s->g)) != -1) {

static void qtrle_decode_8bpp(QtrleContext *s, int row_ptr, int lines_to_change)
{
    int rle_code;
    int pixel_ptr;
    int row_inc = s->frame.linesize[0];
    unsigned char pi1, pi2, pi3, pi4;
    unsigned char *rgb = s->frame.data[0];
    int pixel_limit = s->frame.linesize[0] * s->avctx->height;
    while (lines_to_change--) {
        pixel_ptr = row_ptr + (4 * (bytestream2_get_byte(&s->g) - 1));
        while ((rle_code = (signed char)bytestream2_get_byte(&s->g)) != -1) {
            if (rle_code == 0) {
                pixel_ptr += (4 * (bytestream2_get_byte(&s->g) - 1));
                CHECK_PIXEL_PTR(0);
            } else if (rle_code < 0) {
                rle_code = -rle_code;
                pi1 = bytestream2_get_byte(&s->g);
                pi2 = bytestream2_get_byte(&s->g);
                pi3 = bytestream2_get_byte(&s->g);
                pi4 = bytestream2_get_byte(&s->g);
                CHECK_PIXEL_PTR(rle_code * 4);
                while (rle_code--) {
                    rgb[pixel_ptr++] = pi1;
                    rgb[pixel_ptr++] = pi2;
                    rgb[pixel_ptr++] = pi3;
                    rgb[pixel_ptr++] = pi4;
                }
            } else {
                rle_code *= 4;
                CHECK_PIXEL_PTR(rle_code);
                while (rle_code--) {
                    rgb[pixel_ptr++] = bytestream2_get_byte(&s->g);
                }
            }
        }
        row_ptr += row_inc;
    }
}
['static void qtrle_decode_8bpp(QtrleContext *s, int row_ptr, int lines_to_change)\n{\n    int rle_code;\n    int pixel_ptr;\n    int row_inc = s->frame.linesize[0];\n    unsigned char pi1, pi2, pi3, pi4;\n    unsigned char *rgb = s->frame.data[0];\n    int pixel_limit = s->frame.linesize[0] * s->avctx->height;\n    while (lines_to_change--) {\n        pixel_ptr = row_ptr + (4 * (bytestream2_get_byte(&s->g) - 1));\n        while ((rle_code = (signed char)bytestream2_get_byte(&s->g)) != -1) {\n            if (rle_code == 0) {\n                pixel_ptr += (4 * (bytestream2_get_byte(&s->g) - 1));\n                CHECK_PIXEL_PTR(0);\n            } else if (rle_code < 0) {\n                rle_code = -rle_code;\n                pi1 = bytestream2_get_byte(&s->g);\n                pi2 = bytestream2_get_byte(&s->g);\n                pi3 = bytestream2_get_byte(&s->g);\n                pi4 = bytestream2_get_byte(&s->g);\n                CHECK_PIXEL_PTR(rle_code * 4);\n                while (rle_code--) {\n                    rgb[pixel_ptr++] = pi1;\n                    rgb[pixel_ptr++] = pi2;\n                    rgb[pixel_ptr++] = pi3;\n                    rgb[pixel_ptr++] = pi4;\n                }\n            } else {\n                rle_code *= 4;\n                CHECK_PIXEL_PTR(rle_code);\n                while (rle_code--) {\n                    rgb[pixel_ptr++] = bytestream2_get_byte(&s->g);\n                }\n            }\n        }\n        row_ptr += row_inc;\n    }\n}', 'DEF  (byte, 1, AV_RB8 , AV_WB8 )']