libavcodec/vp3.c:2124: error: Integer Overflow L2
  ([1, 2147483616] + 32):signed32 by call to `av_frame_ref`.

libavcodec/vp3.c:2114:9: Call
2112.     s->last_slice_end = 0;
2113.     for (i = 0; i < s->c_superblock_height; i++)
2114.         render_slice(s, i);
              ^
2115. 
2116.     // filter the last row

libavcodec/vp3.c:1469:1: Parameter `s->qmat[*][*][*][*]`
  1467.  * The slice number ranges from 0..(c_superblock_height - 1).
  1468.  */
  1469. static void render_slice(Vp3DecodeContext *s, int slice)
        ^
  1470. {
  1471.     int x, y, i, j, fragment;

libavcodec/vp3.c:2124:16: Call
2122. 
2123.     /* output frame, offset as needed */
2124.     if ((ret = av_frame_ref(data, s->current_frame.f)) < 0)
                     ^
2125.         return ret;
2126. 

libavutil/frame.c:199:1: Parameter `src->nb_samples`
  197. }
  198. 
  199. int av_frame_ref(AVFrame *dst, const AVFrame *src)
       ^
  200. {
  201.     int i, ret = 0;

libavutil/frame.c:207:5: Assignment
  205.     dst->height         = src->height;
  206.     dst->channel_layout = src->channel_layout;
  207.     dst->nb_samples     = src->nb_samples;
           ^
  208. 
  209.     ret = av_frame_copy_props(dst, src);

libavutil/frame.c:215:15: Call
  213.     /* duplicate the frame data if it's not refcounted */
  214.     if (!src->buf[0]) {
  215.         ret = av_frame_get_buffer(dst, 32);
                     ^
  216.         if (ret < 0)
  217.             return ret;

libavutil/frame.c:186:1: Parameter `frame->nb_samples`
    184. }
    185. 
    186. int av_frame_get_buffer(AVFrame *frame, int align)
         ^
    187. {
    188.     if (frame->format < 0)

libavutil/frame.c:194:16: Call
    192.         return get_video_buffer(frame, align);
    193.     else if (frame->nb_samples > 0 && frame->channel_layout)
    194.         return get_audio_buffer(frame, align);
                        ^
    195. 
    196.     return AVERROR(EINVAL);

libavutil/frame.c:137:1: Parameter `frame->nb_samples`
      135. }
      136. 
      137. static int get_audio_buffer(AVFrame *frame, int align)
           ^
      138. {
      139.     int channels = av_get_channel_layout_nb_channels(frame->channel_layout);

libavutil/frame.c:145:15: Call
      143. 
      144.     if (!frame->linesize[0]) {
      145.         ret = av_samples_get_buffer_size(&frame->linesize[0], channels,
                         ^
      146.                                          frame->nb_samples, frame->format,
      147.                                          align);

libavutil/samplefmt.c:108:1: <LHS trace>
106. }
107. 
108. int av_samples_get_buffer_size(int *linesize, int nb_channels, int nb_samples,
     ^
109.                                enum AVSampleFormat sample_fmt, int align)
110. {

libavutil/samplefmt.c:108:1: Parameter `nb_samples`
        106. }
        107. 
        108. int av_samples_get_buffer_size(int *linesize, int nb_channels, int nb_samples,
             ^
        109.                                enum AVSampleFormat sample_fmt, int align)
        110. {

libavutil/samplefmt.c:124:9: Binary operation: ([1, 2147483616] + 32):signed32 by call to `av_frame_ref` 
        122.             return AVERROR(EINVAL);
        123.         align = 1;
        124.         nb_samples = FFALIGN(nb_samples, 32);
                     ^
        125.     }
        126. 

int av_samples_get_buffer_size(int *linesize, int nb_channels, int nb_samples,
                               enum AVSampleFormat sample_fmt, int align)
{
    int line_size;
    int sample_size = av_get_bytes_per_sample(sample_fmt);
    int planar      = av_sample_fmt_is_planar(sample_fmt);
    if (!sample_size || nb_samples <= 0 || nb_channels <= 0)
        return AVERROR(EINVAL);
    if (!align) {
        if (nb_samples > INT_MAX - 31)
            return AVERROR(EINVAL);
        align = 1;
        nb_samples = FFALIGN(nb_samples, 32);
    }
    if (nb_channels > INT_MAX / align ||
        (int64_t)nb_channels * nb_samples > (INT_MAX - (align * nb_channels)) / sample_size)
        return AVERROR(EINVAL);
    line_size = planar ? FFALIGN(nb_samples * sample_size,               align) :
                         FFALIGN(nb_samples * sample_size * nb_channels, align);
    if (linesize)
        *linesize = line_size;
    return planar ? line_size * nb_channels : line_size;
}
['static int vp3_decode_frame(AVCodecContext *avctx,\n                            void *data, int *got_frame,\n                            AVPacket *avpkt)\n{\n    AVFrame     *frame  = data;\n    const uint8_t *buf  = avpkt->data;\n    int buf_size        = avpkt->size;\n    Vp3DecodeContext *s = avctx->priv_data;\n    GetBitContext gb;\n    int i, ret;\n    init_get_bits(&gb, buf, buf_size * 8);\n    if (s->theora && get_bits1(&gb)) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Header packet passed to frame decoder, skipping\\n");\n        return -1;\n    }\n    s->keyframe = !get_bits1(&gb);\n    if (!s->theora)\n        skip_bits(&gb, 1);\n    for (i = 0; i < 3; i++)\n        s->last_qps[i] = s->qps[i];\n    s->nqps = 0;\n    do {\n        s->qps[s->nqps++] = get_bits(&gb, 6);\n    } while (s->theora >= 0x030200 && s->nqps < 3 && get_bits1(&gb));\n    for (i = s->nqps; i < 3; i++)\n        s->qps[i] = -1;\n    if (s->avctx->debug & FF_DEBUG_PICT_INFO)\n        av_log(s->avctx, AV_LOG_INFO, " VP3 %sframe #%d: Q index = %d\\n",\n               s->keyframe ? "key" : "", avctx->frame_number + 1, s->qps[0]);\n    s->skip_loop_filter = !s->filter_limit_values[s->qps[0]] ||\n                          avctx->skip_loop_filter >= (s->keyframe ? AVDISCARD_ALL\n                                                                  : AVDISCARD_NONKEY);\n    if (s->qps[0] != s->last_qps[0])\n        init_loop_filter(s);\n    for (i = 0; i < s->nqps; i++)\n        if (s->qps[i] != s->last_qps[i] || s->qps[0] != s->last_qps[0])\n            init_dequantizer(s, i);\n    if (avctx->skip_frame >= AVDISCARD_NONKEY && !s->keyframe)\n        return buf_size;\n    s->current_frame.f->pict_type = s->keyframe ? AV_PICTURE_TYPE_I\n                                                : AV_PICTURE_TYPE_P;\n    if (ff_thread_get_buffer(avctx, &s->current_frame, AV_GET_BUFFER_FLAG_REF) < 0) {\n        av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        goto error;\n    }\n    if (!s->edge_emu_buffer)\n        s->edge_emu_buffer = av_malloc(9 * FFABS(s->current_frame.f->linesize[0]));\n    if (s->keyframe) {\n        if (!s->theora) {\n            skip_bits(&gb, 4);\n            skip_bits(&gb, 4);\n            if (s->version) {\n                s->version = get_bits(&gb, 5);\n                if (avctx->frame_number == 0)\n                    av_log(s->avctx, AV_LOG_DEBUG,\n                           "VP version: %d\\n", s->version);\n            }\n        }\n        if (s->version || s->theora) {\n            if (get_bits1(&gb))\n                av_log(s->avctx, AV_LOG_ERROR,\n                       "Warning, unsupported keyframe coding type?!\\n");\n            skip_bits(&gb, 2);\n        }\n    } else {\n        if (!s->golden_frame.f->data[0]) {\n            av_log(s->avctx, AV_LOG_WARNING,\n                   "vp3: first frame not a keyframe\\n");\n            s->golden_frame.f->pict_type = AV_PICTURE_TYPE_I;\n            if (ff_thread_get_buffer(avctx, &s->golden_frame,\n                                     AV_GET_BUFFER_FLAG_REF) < 0) {\n                av_log(s->avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n                goto error;\n            }\n            ff_thread_release_buffer(avctx, &s->last_frame);\n            if ((ret = ff_thread_ref_frame(&s->last_frame,\n                                           &s->golden_frame)) < 0)\n                goto error;\n            ff_thread_report_progress(&s->last_frame, INT_MAX, 0);\n        }\n    }\n    memset(s->all_fragments, 0, s->fragment_count * sizeof(Vp3Fragment));\n    ff_thread_finish_setup(avctx);\n    if (unpack_superblocks(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_superblocks\\n");\n        goto error;\n    }\n    if (unpack_modes(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_modes\\n");\n        goto error;\n    }\n    if (unpack_vectors(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_vectors\\n");\n        goto error;\n    }\n    if (unpack_block_qpis(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_block_qpis\\n");\n        goto error;\n    }\n    if (unpack_dct_coeffs(s, &gb)) {\n        av_log(s->avctx, AV_LOG_ERROR, "error in unpack_dct_coeffs\\n");\n        goto error;\n    }\n    for (i = 0; i < 3; i++) {\n        int height = s->height >> (i && s->chroma_y_shift);\n        if (s->flipped_image)\n            s->data_offset[i] = 0;\n        else\n            s->data_offset[i] = (height - 1) * s->current_frame.f->linesize[i];\n    }\n    s->last_slice_end = 0;\n    for (i = 0; i < s->c_superblock_height; i++)\n        render_slice(s, i);\n    for (i = 0; i < 3; i++) {\n        int row = (s->height >> (3 + (i && s->chroma_y_shift))) - 1;\n        apply_loop_filter(s, i, row, row + 1);\n    }\n    vp3_draw_horiz_band(s, s->height);\n    if ((ret = av_frame_ref(data, s->current_frame.f)) < 0)\n        return ret;\n    frame->crop_left   = s->offset_x;\n    frame->crop_right  = avctx->coded_width - avctx->width - s->offset_x;\n    frame->crop_top    = s->offset_y;\n    frame->crop_bottom = avctx->coded_height - avctx->height - s->offset_y;\n    *got_frame = 1;\n    if (!HAVE_THREADS || !(s->avctx->active_thread_type & FF_THREAD_FRAME)) {\n        ret = update_frames(avctx);\n        if (ret < 0)\n            return ret;\n    }\n    return buf_size;\nerror:\n    ff_thread_report_progress(&s->current_frame, INT_MAX, 0);\n    if (!HAVE_THREADS || !(s->avctx->active_thread_type & FF_THREAD_FRAME))\n        av_frame_unref(s->current_frame.f);\n    return -1;\n}', 'static void render_slice(Vp3DecodeContext *s, int slice)\n{\n    int x, y, i, j, fragment;\n    int16_t *block = s->block;\n    int motion_x = 0xdeadbeef, motion_y = 0xdeadbeef;\n    int motion_halfpel_index;\n    uint8_t *motion_source;\n    int plane, first_pixel;\n    if (slice >= s->c_superblock_height)\n        return;\n    for (plane = 0; plane < 3; plane++) {\n        uint8_t *output_plane = s->current_frame.f->data[plane] +\n                                s->data_offset[plane];\n        uint8_t *last_plane = s->last_frame.f->data[plane] +\n                              s->data_offset[plane];\n        uint8_t *golden_plane = s->golden_frame.f->data[plane] +\n                                s->data_offset[plane];\n        ptrdiff_t stride = s->current_frame.f->linesize[plane];\n        int plane_width  = s->width  >> (plane && s->chroma_x_shift);\n        int plane_height = s->height >> (plane && s->chroma_y_shift);\n        int8_t(*motion_val)[2] = s->motion_val[!!plane];\n        int sb_x, sb_y = slice << (!plane && s->chroma_y_shift);\n        int slice_height = sb_y + 1 + (!plane && s->chroma_y_shift);\n        int slice_width  = plane ? s->c_superblock_width\n                                 : s->y_superblock_width;\n        int fragment_width  = s->fragment_width[!!plane];\n        int fragment_height = s->fragment_height[!!plane];\n        int fragment_start  = s->fragment_start[plane];\n        int do_await = !plane && HAVE_THREADS &&\n                       (s->avctx->active_thread_type & FF_THREAD_FRAME);\n        if (!s->flipped_image)\n            stride = -stride;\n        if (CONFIG_GRAY && plane && (s->avctx->flags & AV_CODEC_FLAG_GRAY))\n            continue;\n        for (; sb_y < slice_height; sb_y++) {\n            for (sb_x = 0; sb_x < slice_width; sb_x++) {\n                for (j = 0; j < 16; j++) {\n                    x        = 4 * sb_x + hilbert_offset[j][0];\n                    y        = 4 * sb_y + hilbert_offset[j][1];\n                    fragment = y * fragment_width + x;\n                    i = fragment_start + fragment;\n                    if (x >= fragment_width || y >= fragment_height)\n                        continue;\n                    first_pixel = 8 * y * stride + 8 * x;\n                    if (do_await &&\n                        s->all_fragments[i].coding_method != MODE_INTRA)\n                        await_reference_row(s, &s->all_fragments[i],\n                                            motion_val[fragment][1],\n                                            (16 * y) >> s->chroma_y_shift);\n                    if (s->all_fragments[i].coding_method != MODE_COPY) {\n                        if ((s->all_fragments[i].coding_method == MODE_USING_GOLDEN) ||\n                            (s->all_fragments[i].coding_method == MODE_GOLDEN_MV))\n                            motion_source = golden_plane;\n                        else\n                            motion_source = last_plane;\n                        motion_source       += first_pixel;\n                        motion_halfpel_index = 0;\n                        if ((s->all_fragments[i].coding_method > MODE_INTRA) &&\n                            (s->all_fragments[i].coding_method != MODE_USING_GOLDEN)) {\n                            int src_x, src_y;\n                            motion_x = motion_val[fragment][0];\n                            motion_y = motion_val[fragment][1];\n                            src_x = (motion_x >> 1) + 8 * x;\n                            src_y = (motion_y >> 1) + 8 * y;\n                            motion_halfpel_index = motion_x & 0x01;\n                            motion_source       += (motion_x >> 1);\n                            motion_halfpel_index |= (motion_y & 0x01) << 1;\n                            motion_source        += ((motion_y >> 1) * stride);\n                            if (src_x < 0 || src_y < 0 ||\n                                src_x + 9 >= plane_width ||\n                                src_y + 9 >= plane_height) {\n                                uint8_t *temp = s->edge_emu_buffer;\n                                if (stride < 0)\n                                    temp -= 8 * stride;\n                                s->vdsp.emulated_edge_mc(temp, motion_source,\n                                                         stride, stride,\n                                                         9, 9, src_x, src_y,\n                                                         plane_width,\n                                                         plane_height);\n                                motion_source = temp;\n                            }\n                        }\n                        if (s->all_fragments[i].coding_method != MODE_INTRA) {\n                            if (motion_halfpel_index != 3) {\n                                s->hdsp.put_no_rnd_pixels_tab[1][motion_halfpel_index](\n                                    output_plane + first_pixel,\n                                    motion_source, stride, 8);\n                            } else {\n                                int d = (motion_x ^ motion_y) >> 31;\n                                s->vp3dsp.put_no_rnd_pixels_l2(output_plane + first_pixel,\n                                                               motion_source - d,\n                                                               motion_source + stride + 1 + d,\n                                                               stride, 8);\n                            }\n                        }\n                        if (s->all_fragments[i].coding_method == MODE_INTRA) {\n                            int index;\n                            index = vp3_dequant(s, s->all_fragments + i,\n                                                plane, 0, block);\n                            if (index > 63)\n                                continue;\n                            s->vp3dsp.idct_put(output_plane + first_pixel,\n                                               stride,\n                                               block);\n                        } else {\n                            int index = vp3_dequant(s, s->all_fragments + i,\n                                                    plane, 1, block);\n                            if (index > 63)\n                                continue;\n                            if (index > 0) {\n                                s->vp3dsp.idct_add(output_plane + first_pixel,\n                                                   stride,\n                                                   block);\n                            } else {\n                                s->vp3dsp.idct_dc_add(output_plane + first_pixel,\n                                                      stride, block);\n                            }\n                        }\n                    } else {\n                        s->hdsp.put_pixels_tab[1][0](\n                            output_plane + first_pixel,\n                            last_plane + first_pixel,\n                            stride, 8);\n                    }\n                }\n            }\n            if (!s->skip_loop_filter)\n                apply_loop_filter(s, plane, 4 * sb_y - !!sb_y,\n                                  FFMIN(4 * sb_y + 3, fragment_height - 1));\n        }\n    }\n    vp3_draw_horiz_band(s, FFMIN((32 << s->chroma_y_shift) * (slice + 1) - 16,\n                                 s->height - 16));\n}', 'int av_frame_ref(AVFrame *dst, const AVFrame *src)\n{\n    int i, ret = 0;\n    dst->format         = src->format;\n    dst->width          = src->width;\n    dst->height         = src->height;\n    dst->channel_layout = src->channel_layout;\n    dst->nb_samples     = src->nb_samples;\n    ret = av_frame_copy_props(dst, src);\n    if (ret < 0)\n        return ret;\n    if (!src->buf[0]) {\n        ret = av_frame_get_buffer(dst, 32);\n        if (ret < 0)\n            return ret;\n        ret = av_frame_copy(dst, src);\n        if (ret < 0)\n            av_frame_unref(dst);\n        return ret;\n    }\n    for (i = 0; i < FF_ARRAY_ELEMS(src->buf) && src->buf[i]; i++) {\n        dst->buf[i] = av_buffer_ref(src->buf[i]);\n        if (!dst->buf[i]) {\n            ret = AVERROR(ENOMEM);\n            goto fail;\n        }\n    }\n    if (src->extended_buf) {\n        dst->extended_buf = av_mallocz(sizeof(*dst->extended_buf) *\n                                       src->nb_extended_buf);\n        if (!dst->extended_buf) {\n            ret = AVERROR(ENOMEM);\n            goto fail;\n        }\n        dst->nb_extended_buf = src->nb_extended_buf;\n        for (i = 0; i < src->nb_extended_buf; i++) {\n            dst->extended_buf[i] = av_buffer_ref(src->extended_buf[i]);\n            if (!dst->extended_buf[i]) {\n                ret = AVERROR(ENOMEM);\n                goto fail;\n            }\n        }\n    }\n    if (src->hw_frames_ctx) {\n        dst->hw_frames_ctx = av_buffer_ref(src->hw_frames_ctx);\n        if (!dst->hw_frames_ctx) {\n            ret = AVERROR(ENOMEM);\n            goto fail;\n        }\n    }\n    if (src->extended_data != src->data) {\n        int ch = av_get_channel_layout_nb_channels(src->channel_layout);\n        if (!ch) {\n            ret = AVERROR(EINVAL);\n            goto fail;\n        }\n        dst->extended_data = av_malloc(sizeof(*dst->extended_data) * ch);\n        if (!dst->extended_data) {\n            ret = AVERROR(ENOMEM);\n            goto fail;\n        }\n        memcpy(dst->extended_data, src->extended_data, sizeof(*src->extended_data) * ch);\n    } else\n        dst->extended_data = dst->data;\n    memcpy(dst->data,     src->data,     sizeof(src->data));\n    memcpy(dst->linesize, src->linesize, sizeof(src->linesize));\n    return 0;\nfail:\n    av_frame_unref(dst);\n    return ret;\n}', 'int av_frame_get_buffer(AVFrame *frame, int align)\n{\n    if (frame->format < 0)\n        return AVERROR(EINVAL);\n    if (frame->width > 0 && frame->height > 0)\n        return get_video_buffer(frame, align);\n    else if (frame->nb_samples > 0 && frame->channel_layout)\n        return get_audio_buffer(frame, align);\n    return AVERROR(EINVAL);\n}', 'static int get_audio_buffer(AVFrame *frame, int align)\n{\n    int channels = av_get_channel_layout_nb_channels(frame->channel_layout);\n    int planar   = av_sample_fmt_is_planar(frame->format);\n    int planes   = planar ? channels : 1;\n    int ret, i;\n    if (!frame->linesize[0]) {\n        ret = av_samples_get_buffer_size(&frame->linesize[0], channels,\n                                         frame->nb_samples, frame->format,\n                                         align);\n        if (ret < 0)\n            return ret;\n    }\n    if (planes > AV_NUM_DATA_POINTERS) {\n        frame->extended_data = av_mallocz(planes *\n                                          sizeof(*frame->extended_data));\n        frame->extended_buf  = av_mallocz((planes - AV_NUM_DATA_POINTERS) *\n                                          sizeof(*frame->extended_buf));\n        if (!frame->extended_data || !frame->extended_buf) {\n            av_freep(&frame->extended_data);\n            av_freep(&frame->extended_buf);\n            return AVERROR(ENOMEM);\n        }\n        frame->nb_extended_buf = planes - AV_NUM_DATA_POINTERS;\n    } else\n        frame->extended_data = frame->data;\n    for (i = 0; i < FFMIN(planes, AV_NUM_DATA_POINTERS); i++) {\n        frame->buf[i] = av_buffer_alloc(frame->linesize[0]);\n        if (!frame->buf[i]) {\n            av_frame_unref(frame);\n            return AVERROR(ENOMEM);\n        }\n        frame->extended_data[i] = frame->data[i] = frame->buf[i]->data;\n    }\n    for (i = 0; i < planes - AV_NUM_DATA_POINTERS; i++) {\n        frame->extended_buf[i] = av_buffer_alloc(frame->linesize[0]);\n        if (!frame->extended_buf[i]) {\n            av_frame_unref(frame);\n            return AVERROR(ENOMEM);\n        }\n        frame->extended_data[i + AV_NUM_DATA_POINTERS] = frame->extended_buf[i]->data;\n    }\n    return 0;\n}', 'int av_samples_get_buffer_size(int *linesize, int nb_channels, int nb_samples,\n                               enum AVSampleFormat sample_fmt, int align)\n{\n    int line_size;\n    int sample_size = av_get_bytes_per_sample(sample_fmt);\n    int planar      = av_sample_fmt_is_planar(sample_fmt);\n    if (!sample_size || nb_samples <= 0 || nb_channels <= 0)\n        return AVERROR(EINVAL);\n    if (!align) {\n        if (nb_samples > INT_MAX - 31)\n            return AVERROR(EINVAL);\n        align = 1;\n        nb_samples = FFALIGN(nb_samples, 32);\n    }\n    if (nb_channels > INT_MAX / align ||\n        (int64_t)nb_channels * nb_samples > (INT_MAX - (align * nb_channels)) / sample_size)\n        return AVERROR(EINVAL);\n    line_size = planar ? FFALIGN(nb_samples * sample_size,               align) :\n                         FFALIGN(nb_samples * sample_size * nb_channels, align);\n    if (linesize)\n        *linesize = line_size;\n    return planar ? line_size * nb_channels : line_size;\n}']