libavcodec/png_parser.c:86: error: Integer Overflow L2
  ([-oo, 2147483647] + 4):signed32.

libavcodec/png_parser.c:79:9: <LHS trace>
77. 
78.     for (; ppc->pc.frame_start_found && i < buf_size; i++) {
79.         ppc->pc.state = (ppc->pc.state << 8) | buf[i];
            ^
80.         if (ppc->chunk_pos == 3) {
81.             ppc->chunk_length = ppc->pc.state;

libavcodec/png_parser.c:79:9: Assignment
77. 
78.     for (; ppc->pc.frame_start_found && i < buf_size; i++) {
79.         ppc->pc.state = (ppc->pc.state << 8) | buf[i];
            ^
80.         if (ppc->chunk_pos == 3) {
81.             ppc->chunk_length = ppc->pc.state;

libavcodec/png_parser.c:79:9: Assignment
77. 
78.     for (; ppc->pc.frame_start_found && i < buf_size; i++) {
79.         ppc->pc.state = (ppc->pc.state << 8) | buf[i];
            ^
80.         if (ppc->chunk_pos == 3) {
81.             ppc->chunk_length = ppc->pc.state;

libavcodec/png_parser.c:81:13: Assignment
79.         ppc->pc.state = (ppc->pc.state << 8) | buf[i];
80.         if (ppc->chunk_pos == 3) {
81.             ppc->chunk_length = ppc->pc.state;
                ^
82.             if (ppc->chunk_length > 0x7fffffff) {
83.                 ppc->chunk_pos = ppc->pc.frame_start_found = 0;

libavcodec/png_parser.c:86:13: Binary operation: ([-oo, 2147483647] + 4):signed32
84.                 goto flush;
85.             }
86.             ppc->chunk_length += 4;
                ^
87.         } else if (ppc->chunk_pos == 7) {
88.             if (ppc->chunk_length >= buf_size - i)

static int png_parse(AVCodecParserContext *s, AVCodecContext *avctx,
                     const uint8_t **poutbuf, int *poutbuf_size,
                     const uint8_t *buf, int buf_size)
{
    PNGParseContext *ppc = s->priv_data;
    int next = END_NOT_FOUND;
    int i = 0;
    *poutbuf_size = 0;
    if (buf_size == 0)
        return 0;
    if (!ppc->pc.frame_start_found) {
        uint64_t state64 = ppc->pc.state64;
        for (; i < buf_size; i++) {
            state64 = (state64 << 8) | buf[i];
            if (state64 == PNG_SIGNATURE ||
                state64 == MNG_SIGNATURE) {
                i++;
                ppc->pc.frame_start_found = 1;
                break;
            }
        }
        ppc->pc.state64 = state64;
    } else if (ppc->remaining_size) {
        i = FFMIN(ppc->remaining_size, buf_size);
        ppc->remaining_size -= i;
        if (ppc->remaining_size)
            goto flush;
        if (ppc->chunk_pos == -1) {
            next = i;
            goto flush;
        }
    }
    for (; ppc->pc.frame_start_found && i < buf_size; i++) {
        ppc->pc.state = (ppc->pc.state << 8) | buf[i];
        if (ppc->chunk_pos == 3) {
            ppc->chunk_length = ppc->pc.state;
            if (ppc->chunk_length > 0x7fffffff) {
                ppc->chunk_pos = ppc->pc.frame_start_found = 0;
                goto flush;
            }
            ppc->chunk_length += 4;
        } else if (ppc->chunk_pos == 7) {
            if (ppc->chunk_length >= buf_size - i)
                ppc->remaining_size = ppc->chunk_length - buf_size + i + 1;
            if (ppc->pc.state == MKBETAG('I', 'E', 'N', 'D')) {
                if (ppc->remaining_size)
                    ppc->chunk_pos = -1;
                else
                    next = ppc->chunk_length + i + 1;
                break;
            } else {
                ppc->chunk_pos = 0;
                if (ppc->remaining_size)
                    break;
                else
                    i += ppc->chunk_length;
                continue;
            }
        }
        ppc->chunk_pos++;
    }
flush:
    if (ff_combine_frame(&ppc->pc, next, &buf, &buf_size) < 0)
        return buf_size;
    ppc->chunk_pos = ppc->pc.frame_start_found = 0;
    *poutbuf      = buf;
    *poutbuf_size = buf_size;
    return next;
}
["static int png_parse(AVCodecParserContext *s, AVCodecContext *avctx,\n                     const uint8_t **poutbuf, int *poutbuf_size,\n                     const uint8_t *buf, int buf_size)\n{\n    PNGParseContext *ppc = s->priv_data;\n    int next = END_NOT_FOUND;\n    int i = 0;\n    *poutbuf_size = 0;\n    if (buf_size == 0)\n        return 0;\n    if (!ppc->pc.frame_start_found) {\n        uint64_t state64 = ppc->pc.state64;\n        for (; i < buf_size; i++) {\n            state64 = (state64 << 8) | buf[i];\n            if (state64 == PNG_SIGNATURE ||\n                state64 == MNG_SIGNATURE) {\n                i++;\n                ppc->pc.frame_start_found = 1;\n                break;\n            }\n        }\n        ppc->pc.state64 = state64;\n    } else if (ppc->remaining_size) {\n        i = FFMIN(ppc->remaining_size, buf_size);\n        ppc->remaining_size -= i;\n        if (ppc->remaining_size)\n            goto flush;\n        if (ppc->chunk_pos == -1) {\n            next = i;\n            goto flush;\n        }\n    }\n    for (; ppc->pc.frame_start_found && i < buf_size; i++) {\n        ppc->pc.state = (ppc->pc.state << 8) | buf[i];\n        if (ppc->chunk_pos == 3) {\n            ppc->chunk_length = ppc->pc.state;\n            if (ppc->chunk_length > 0x7fffffff) {\n                ppc->chunk_pos = ppc->pc.frame_start_found = 0;\n                goto flush;\n            }\n            ppc->chunk_length += 4;\n        } else if (ppc->chunk_pos == 7) {\n            if (ppc->chunk_length >= buf_size - i)\n                ppc->remaining_size = ppc->chunk_length - buf_size + i + 1;\n            if (ppc->pc.state == MKBETAG('I', 'E', 'N', 'D')) {\n                if (ppc->remaining_size)\n                    ppc->chunk_pos = -1;\n                else\n                    next = ppc->chunk_length + i + 1;\n                break;\n            } else {\n                ppc->chunk_pos = 0;\n                if (ppc->remaining_size)\n                    break;\n                else\n                    i += ppc->chunk_length;\n                continue;\n            }\n        }\n        ppc->chunk_pos++;\n    }\nflush:\n    if (ff_combine_frame(&ppc->pc, next, &buf, &buf_size) < 0)\n        return buf_size;\n    ppc->chunk_pos = ppc->pc.frame_start_found = 0;\n    *poutbuf      = buf;\n    *poutbuf_size = buf_size;\n    return next;\n}"]