libavcodec/cavsdec.c:1029: error: Integer Overflow L2
  ([0, +oo] - 32):unsigned32 by call to `check_for_slice`.

libavcodec/cavsdec.c:1030:13: Call
1028.         do {
1029.             check_for_slice(h);
1030.             decode_mb_i(h, 0);
                  ^
1031.         } while (ff_cavs_next_mb(h));
1032.     } else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) {

libavcodec/cavsdec.c:700:5: Call
  698.                                   h->left_border_v, h->c_stride);
  699. 
  700.     decode_residual_chroma(h);
           ^
  701.     ff_cavs_filter(h, I_8X8);
  702.     set_mv_intra(h);

libavcodec/cavsdec.c:588:1: Parameter `h->bc.bits_left`
    586. 
    587. 
    588. static inline void decode_residual_chroma(AVSContext *h)
         ^
    589. {
    590.     if (h->cbp & (1 << 4))

libavcodec/cavsdec.c:1029:13: Call
1027.     if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {
1028.         do {
1029.             check_for_slice(h);
                  ^
1030.             decode_mb_i(h, 0);
1031.         } while (ff_cavs_next_mb(h));

libavcodec/cavsdec.c:910:9: Assignment
  908.     /* check for stuffing byte */
  909.     if (!align && (bitstream_peek(bc, 8) == 0x80))
  910.         align = 8;
               ^
  911.     if ((bitstream_peek(bc, 24 + align) & 0xFFFFFF) == 0x000001) {
  912.         bitstream_skip(bc, 24 + align);

libavcodec/cavsdec.c:912:9: Call
  910.         align = 8;
  911.     if ((bitstream_peek(bc, 24 + align) & 0xFFFFFF) == 0x000001) {
  912.         bitstream_skip(bc, 24 + align);
               ^
  913.         h->stc = bitstream_read(bc, 8);
  914.         if (h->stc >= h->mb_height)

libavcodec/bitstream.h:240:1: Parameter `n`
    238. 
    239. /* Skip n bits in the buffer. */
    240. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
         ^
    241. {
    242.     if (n < bc->bits_left)

libavcodec/bitstream.h:243:9: Call
    241. {
    242.     if (n < bc->bits_left)
    243.         skip_remaining(bc, n);
                 ^
    244.     else {
    245.         n -= bc->bits_left;

libavcodec/bitstream.h:229:1: <LHS trace>
227. }
228. 
229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
230. {
231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: Parameter `bc->bits_left`
      227. }
      228. 
      229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
           ^
      230. {
      231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: <RHS trace>
227. }
228. 
229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
230. {
231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: Parameter `n`
      227. }
      228. 
      229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
           ^
      230. {
      231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:236:5: Binary operation: ([0, +oo] - 32):unsigned32 by call to `check_for_slice` 
      234.     bc->bits <<= n;
      235. #endif
      236.     bc->bits_left -= n;
               ^
      237. }
      238. 

static inline void skip_remaining(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    bc->bits >>= n;
#else
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
}
['static int decode_pic(AVSContext *h)\n{\n    int ret;\n    int skip_count    = -1;\n    enum cavs_mb mb_type;\n    if (!h->top_qp) {\n        av_log(h->avctx, AV_LOG_ERROR, "No sequence header decoded yet\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    av_frame_unref(h->cur.f);\n    bitstream_skip(&h->bc, 16);\n    if (h->stc == PIC_PB_START_CODE) {\n        h->cur.f->pict_type = bitstream_read(&h->bc, 2) + AV_PICTURE_TYPE_I;\n        if (h->cur.f->pict_type > AV_PICTURE_TYPE_B) {\n            av_log(h->avctx, AV_LOG_ERROR, "illegal picture type\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        if (!h->DPB[0].f->data[0] ||\n           (!h->DPB[1].f->data[0] && h->cur.f->pict_type == AV_PICTURE_TYPE_B))\n            return AVERROR_INVALIDDATA;\n    } else {\n        h->cur.f->pict_type = AV_PICTURE_TYPE_I;\n        if (bitstream_read_bit(&h->bc))\n            bitstream_skip(&h->bc, 24);\n        if (h->low_delay || !(bitstream_peek(&h->bc, 9) & 1))\n            h->stream_revision = 1;\n        else if (bitstream_peek(&h->bc, 11) & 3)\n            h->stream_revision = 1;\n        if (h->stream_revision > 0)\n            bitstream_skip(&h->bc, 1);\n    }\n    ret = ff_get_buffer(h->avctx, h->cur.f, h->cur.f->pict_type == AV_PICTURE_TYPE_B ?\n                        0 : AV_GET_BUFFER_FLAG_REF);\n    if (ret < 0)\n        return ret;\n    if (!h->edge_emu_buffer) {\n        int alloc_size = FFALIGN(FFABS(h->cur.f->linesize[0]) + 32, 32);\n        h->edge_emu_buffer = av_mallocz(alloc_size * 2 * 24);\n        if (!h->edge_emu_buffer)\n            return AVERROR(ENOMEM);\n    }\n    ff_cavs_init_pic(h);\n    h->cur.poc = bitstream_read(&h->bc, 8) * 2;\n    if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {\n        h->dist[0] = (h->cur.poc - h->DPB[0].poc  + 512) % 512;\n    } else {\n        h->dist[0] = (h->DPB[0].poc  - h->cur.poc + 512) % 512;\n    }\n    h->dist[1] = (h->cur.poc - h->DPB[1].poc  + 512) % 512;\n    h->scale_den[0] = h->dist[0] ? 512/h->dist[0] : 0;\n    h->scale_den[1] = h->dist[1] ? 512/h->dist[1] : 0;\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_B) {\n        h->sym_factor = h->dist[0] * h->scale_den[1];\n    } else {\n        h->direct_den[0] = h->dist[0] ? 16384 / h->dist[0] : 0;\n        h->direct_den[1] = h->dist[1] ? 16384 / h->dist[1] : 0;\n    }\n    if (h->low_delay)\n        get_ue_golomb(&h->bc);\n    h->progressive   = bitstream_read_bit(&h->bc);\n    h->pic_structure = 1;\n    if (!h->progressive)\n        h->pic_structure = bitstream_read_bit(&h->bc);\n    if (!h->pic_structure && h->stc == PIC_PB_START_CODE)\n        bitstream_skip(&h->bc, 1);\n    bitstream_skip(&h->bc, 1);\n    bitstream_skip(&h->bc, 1);\n    h->qp_fixed = bitstream_read_bit(&h->bc);\n    h->qp       = bitstream_read(&h->bc, 6);\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {\n        if (!h->progressive && !h->pic_structure)\n            bitstream_skip(&h->bc, 1);\n        bitstream_skip(&h->bc, 4);\n    } else {\n        if (!(h->cur.f->pict_type == AV_PICTURE_TYPE_B && h->pic_structure == 1))\n            h->ref_flag        = bitstream_read_bit(&h->bc);\n        bitstream_skip(&h->bc, 4);\n        h->skip_mode_flag      = bitstream_read_bit(&h->bc);\n    }\n    h->loop_filter_disable     = bitstream_read_bit(&h->bc);\n    if (!h->loop_filter_disable && bitstream_read_bit(&h->bc)) {\n        h->alpha_offset        = get_se_golomb(&h->bc);\n        h->beta_offset         = get_se_golomb(&h->bc);\n    } else {\n        h->alpha_offset = h->beta_offset  = 0;\n    }\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {\n        do {\n            check_for_slice(h);\n            decode_mb_i(h, 0);\n        } while (ff_cavs_next_mb(h));\n    } else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) {\n        do {\n            if (check_for_slice(h))\n                skip_count = -1;\n            if (h->skip_mode_flag && (skip_count < 0))\n                skip_count = get_ue_golomb(&h->bc);\n            if (h->skip_mode_flag && skip_count--) {\n                decode_mb_p(h, P_SKIP);\n            } else {\n                mb_type = get_ue_golomb(&h->bc) + P_SKIP + h->skip_mode_flag;\n                if (mb_type > P_8X8)\n                    decode_mb_i(h, mb_type - P_8X8 - 1);\n                else\n                    decode_mb_p(h, mb_type);\n            }\n        } while (ff_cavs_next_mb(h));\n    } else {\n        do {\n            if (check_for_slice(h))\n                skip_count = -1;\n            if (h->skip_mode_flag && (skip_count < 0))\n                skip_count = get_ue_golomb(&h->bc);\n            if (h->skip_mode_flag && skip_count--) {\n                decode_mb_b(h, B_SKIP);\n            } else {\n                mb_type = get_ue_golomb(&h->bc) + B_SKIP + h->skip_mode_flag;\n                if (mb_type > B_8X8)\n                    decode_mb_i(h, mb_type - B_8X8 - 1);\n                else\n                    decode_mb_b(h, mb_type);\n            }\n        } while (ff_cavs_next_mb(h));\n    }\n    if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {\n        av_frame_unref(h->DPB[1].f);\n        FFSWAP(AVSFrame, h->cur, h->DPB[1]);\n        FFSWAP(AVSFrame, h->DPB[0], h->DPB[1]);\n    }\n    return 0;\n}', 'static int decode_mb_i(AVSContext *h, int cbp_code)\n{\n    BitstreamContext *bc = &h->bc;\n    unsigned pred_mode_uv;\n    int block;\n    uint8_t top[18];\n    uint8_t *left = NULL;\n    uint8_t *d;\n    ff_cavs_init_mb(h);\n    for (block = 0; block < 4; block++) {\n        int nA, nB, predpred;\n        int pos = scan3x3[block];\n        nA = h->pred_mode_Y[pos - 1];\n        nB = h->pred_mode_Y[pos - 3];\n        predpred = FFMIN(nA, nB);\n        if (predpred == NOT_AVAIL)\n            predpred = INTRA_L_LP;\n        if (!bitstream_read_bit(bc)) {\n            int rem_mode = bitstream_read(bc, 2);\n            predpred     = rem_mode + (rem_mode >= predpred);\n        }\n        h->pred_mode_Y[pos] = predpred;\n    }\n    pred_mode_uv = get_ue_golomb(bc);\n    if (pred_mode_uv > 6) {\n        av_log(h->avctx, AV_LOG_ERROR, "illegal intra chroma pred mode\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    ff_cavs_modify_mb_i(h, &pred_mode_uv);\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_I)\n        cbp_code = get_ue_golomb(bc);\n    if (cbp_code > 63 || cbp_code < 0) {\n        av_log(h->avctx, AV_LOG_ERROR, "illegal intra cbp\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    h->cbp = cbp_tab[cbp_code][0];\n    if (h->cbp && !h->qp_fixed)\n        h->qp = (h->qp + get_se_golomb(bc)) & 63;\n    for (block = 0; block < 4; block++) {\n        d = h->cy + h->luma_scan[block];\n        ff_cavs_load_intra_pred_luma(h, top, &left, block);\n        h->intra_pred_l[h->pred_mode_Y[scan3x3[block]]]\n            (d, top, left, h->l_stride);\n        if (h->cbp & (1<<block))\n            decode_residual_block(h, bc, intra_dec, 1, h->qp, d, h->l_stride);\n    }\n    ff_cavs_load_intra_pred_chroma(h);\n    h->intra_pred_c[pred_mode_uv](h->cu, &h->top_border_u[h->mbx * 10],\n                                  h->left_border_u, h->c_stride);\n    h->intra_pred_c[pred_mode_uv](h->cv, &h->top_border_v[h->mbx * 10],\n                                  h->left_border_v, h->c_stride);\n    decode_residual_chroma(h);\n    ff_cavs_filter(h, I_8X8);\n    set_mv_intra(h);\n    return 0;\n}', 'static inline void decode_residual_chroma(AVSContext *h)\n{\n    if (h->cbp & (1 << 4))\n        decode_residual_block(h, &h->bc, chroma_dec, 0,\n                              cavs_chroma_qp[h->qp], h->cu, h->c_stride);\n    if (h->cbp & (1 << 5))\n        decode_residual_block(h, &h->bc, chroma_dec, 0,\n                              cavs_chroma_qp[h->qp], h->cv, h->c_stride);\n}', 'static inline int check_for_slice(AVSContext *h)\n{\n    BitstreamContext *bc = &h->bc;\n    int align;\n    if (h->mbx)\n        return 0;\n    align = (-bitstream_tell(bc)) & 7;\n    if (!align && (bitstream_peek(bc, 8) == 0x80))\n        align = 8;\n    if ((bitstream_peek(bc, 24 + align) & 0xFFFFFF) == 0x000001) {\n        bitstream_skip(bc, 24 + align);\n        h->stc = bitstream_read(bc, 8);\n        if (h->stc >= h->mb_height)\n            return 0;\n        decode_slice_header(h, bc);\n        return 1;\n    }\n    return 0;\n}', 'static inline void bitstream_skip(BitstreamContext *bc, unsigned n)\n{\n    if (n < bc->bits_left)\n        skip_remaining(bc, n);\n    else {\n        n -= bc->bits_left;\n        bc->bits      = 0;\n        bc->bits_left = 0;\n        if (n >= 64) {\n            unsigned skip = n / 8;\n            n -= skip * 8;\n            bc->ptr += skip;\n        }\n        refill_64(bc);\n        if (n)\n            skip_remaining(bc, n);\n    }\n}', 'static inline void skip_remaining(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    bc->bits >>= n;\n#else\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n}']