libavcodec/mlpdec.c:978: error: Integer Overflow L2
  ([0, min(8190, `avpkt->size`)] - [4, 32]):unsigned32.

libavcodec/mlpdec.c:906:1: <LHS trace>
904.  *  otherwise returns the number of bytes consumed. */
905. 
906. static int read_access_unit(AVCodecContext *avctx, void* data, int *data_size,
     ^
907.                             AVPacket *avpkt)
908. {

libavcodec/mlpdec.c:906:1: Parameter `avpkt->size`
904.  *  otherwise returns the number of bytes consumed. */
905. 
906. static int read_access_unit(AVCodecContext *avctx, void* data, int *data_size,
     ^
907.                             AVPacket *avpkt)
908. {

libavcodec/mlpdec.c:910:5: Assignment
908. {
909.     const uint8_t *buf = avpkt->data;
910.     int buf_size = avpkt->size;
         ^
911.     MLPDecodeContext *m = avctx->priv_data;
912.     GetBitContext gb;

libavcodec/mlpdec.c:915:5: <RHS trace>
913.     unsigned int length, substr;
914.     unsigned int substream_start;
915.     unsigned int header_size = 4;
         ^
916.     unsigned int substr_header_size = 0;
917.     uint8_t substream_parity_present[MAX_SUBSTREAMS];

libavcodec/mlpdec.c:915:5: Assignment
913.     unsigned int length, substr;
914.     unsigned int substream_start;
915.     unsigned int header_size = 4;
         ^
916.     unsigned int substr_header_size = 0;
917.     uint8_t substream_parity_present[MAX_SUBSTREAMS];

libavcodec/mlpdec.c:978:13: Binary operation: ([0, min(8190, avpkt->size)] - [4, 32]):unsigned32
976.                    "Indicated length of substream %d data goes off end of "
977.                    "packet.\n", substr);
978.             end = length - header_size - substr_header_size;
                 ^
979.         }
980. 

static int read_access_unit(AVCodecContext *avctx, void* data, int *data_size,
                            AVPacket *avpkt)
{
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    MLPDecodeContext *m = avctx->priv_data;
    GetBitContext gb;
    unsigned int length, substr;
    unsigned int substream_start;
    unsigned int header_size = 4;
    unsigned int substr_header_size = 0;
    uint8_t substream_parity_present[MAX_SUBSTREAMS];
    uint16_t substream_data_len[MAX_SUBSTREAMS];
    uint8_t parity_bits;
    if (buf_size < 4)
        return 0;
    length = (AV_RB16(buf) & 0xfff) * 2;
    if (length > buf_size)
        return -1;
    init_get_bits(&gb, (buf + 4), (length - 4) * 8);
    m->is_major_sync_unit = 0;
    if (show_bits_long(&gb, 31) == (0xf8726fba >> 1)) {
        if (read_major_sync(m, &gb) < 0)
            goto error;
        m->is_major_sync_unit = 1;
        header_size += 28;
    }
    if (!m->params_valid) {
        av_log(m->avctx, AV_LOG_WARNING,
               "Stream parameters not seen; skipping frame.\n");
        *data_size = 0;
        return length;
    }
    substream_start = 0;
    for (substr = 0; substr < m->num_substreams; substr++) {
        int extraword_present, checkdata_present, end, nonrestart_substr;
        extraword_present = get_bits1(&gb);
        nonrestart_substr = get_bits1(&gb);
        checkdata_present = get_bits1(&gb);
        skip_bits1(&gb);
        end = get_bits(&gb, 12) * 2;
        substr_header_size += 2;
        if (extraword_present) {
            if (m->avctx->codec_id == CODEC_ID_MLP) {
                av_log(m->avctx, AV_LOG_ERROR, "There must be no extraword for MLP.\n");
                goto error;
            }
            skip_bits(&gb, 16);
            substr_header_size += 2;
        }
        if (!(nonrestart_substr ^ m->is_major_sync_unit)) {
            av_log(m->avctx, AV_LOG_ERROR, "Invalid nonrestart_substr.\n");
            goto error;
        }
        if (end + header_size + substr_header_size > length) {
            av_log(m->avctx, AV_LOG_ERROR,
                   "Indicated length of substream %d data goes off end of "
                   "packet.\n", substr);
            end = length - header_size - substr_header_size;
        }
        if (end < substream_start) {
            av_log(avctx, AV_LOG_ERROR,
                   "Indicated end offset of substream %d data "
                   "is smaller than calculated start offset.\n",
                   substr);
            goto error;
        }
        if (substr > m->max_decoded_substream)
            continue;
        substream_parity_present[substr] = checkdata_present;
        substream_data_len[substr] = end - substream_start;
        substream_start = end;
    }
    parity_bits  = ff_mlp_calculate_parity(buf, 4);
    parity_bits ^= ff_mlp_calculate_parity(buf + header_size, substr_header_size);
    if ((((parity_bits >> 4) ^ parity_bits) & 0xF) != 0xF) {
        av_log(avctx, AV_LOG_ERROR, "Parity check failed.\n");
        goto error;
    }
    buf += header_size + substr_header_size;
    for (substr = 0; substr <= m->max_decoded_substream; substr++) {
        SubStream *s = &m->substream[substr];
        init_get_bits(&gb, buf, substream_data_len[substr] * 8);
        m->matrix_changed = 0;
        memset(m->filter_changed, 0, sizeof(m->filter_changed));
        s->blockpos = 0;
        do {
            unsigned int ch;
            if (get_bits1(&gb)) {
                if (get_bits1(&gb)) {
                    if (read_restart_header(m, &gb, buf, substr) < 0)
                        goto next_substr;
                    s->restart_seen = 1;
                }
                if (!s->restart_seen) {
                    goto next_substr;
                }
                if (read_decoding_params(m, &gb, substr) < 0)
                    goto next_substr;
            }
            if (m->matrix_changed > 1) {
                av_log(m->avctx, AV_LOG_ERROR, "Matrices may change only once per access unit.\n");
                goto next_substr;
            }
            for (ch = 0; ch < s->max_channel; ch++)
                if (m->filter_changed[ch][FIR] > 1 ||
                    m->filter_changed[ch][IIR] > 1) {
                    av_log(m->avctx, AV_LOG_ERROR, "Filters may change only once per access unit.\n");
                    goto next_substr;
                }
            if (!s->restart_seen) {
                goto next_substr;
            }
            if (read_block_data(m, &gb, substr) < 0)
                return -1;
            if (get_bits_count(&gb) >= substream_data_len[substr] * 8)
                goto substream_length_mismatch;
        } while (!get_bits1(&gb));
        skip_bits(&gb, (-get_bits_count(&gb)) & 15);
        if (substream_data_len[substr] * 8 - get_bits_count(&gb) >= 32) {
            int shorten_by;
            if (get_bits(&gb, 16) != 0xD234)
                return -1;
            shorten_by = get_bits(&gb, 16);
            if      (m->avctx->codec_id == CODEC_ID_TRUEHD && shorten_by  & 0x2000)
                s->blockpos -= FFMIN(shorten_by & 0x1FFF, s->blockpos);
            else if (m->avctx->codec_id == CODEC_ID_MLP    && shorten_by != 0xD234)
                return -1;
            if (substr == m->max_decoded_substream)
                av_log(m->avctx, AV_LOG_INFO, "End of stream indicated.\n");
        }
        if (substream_parity_present[substr]) {
            uint8_t parity, checksum;
            if (substream_data_len[substr] * 8 - get_bits_count(&gb) != 16)
                goto substream_length_mismatch;
            parity   = ff_mlp_calculate_parity(buf, substream_data_len[substr] - 2);
            checksum = ff_mlp_checksum8       (buf, substream_data_len[substr] - 2);
            if ((get_bits(&gb, 8) ^ parity) != 0xa9    )
                av_log(m->avctx, AV_LOG_ERROR, "Substream %d parity check failed.\n", substr);
            if ( get_bits(&gb, 8)           != checksum)
                av_log(m->avctx, AV_LOG_ERROR, "Substream %d checksum failed.\n"    , substr);
        }
        if (substream_data_len[substr] * 8 != get_bits_count(&gb)) {
            goto substream_length_mismatch;
        }
next_substr:
        if (!s->restart_seen) {
            av_log(m->avctx, AV_LOG_ERROR,
                   "No restart header present in substream %d.\n", substr);
        }
        buf += substream_data_len[substr];
    }
    rematrix_channels(m, m->max_decoded_substream);
    if (output_data(m, m->max_decoded_substream, data, data_size) < 0)
        return -1;
    return length;
substream_length_mismatch:
    av_log(m->avctx, AV_LOG_ERROR, "substream %d length mismatch\n", substr);
    return -1;
error:
    m->params_valid = 0;
    return -1;
}
['static int read_access_unit(AVCodecContext *avctx, void* data, int *data_size,\n                            AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    MLPDecodeContext *m = avctx->priv_data;\n    GetBitContext gb;\n    unsigned int length, substr;\n    unsigned int substream_start;\n    unsigned int header_size = 4;\n    unsigned int substr_header_size = 0;\n    uint8_t substream_parity_present[MAX_SUBSTREAMS];\n    uint16_t substream_data_len[MAX_SUBSTREAMS];\n    uint8_t parity_bits;\n    if (buf_size < 4)\n        return 0;\n    length = (AV_RB16(buf) & 0xfff) * 2;\n    if (length > buf_size)\n        return -1;\n    init_get_bits(&gb, (buf + 4), (length - 4) * 8);\n    m->is_major_sync_unit = 0;\n    if (show_bits_long(&gb, 31) == (0xf8726fba >> 1)) {\n        if (read_major_sync(m, &gb) < 0)\n            goto error;\n        m->is_major_sync_unit = 1;\n        header_size += 28;\n    }\n    if (!m->params_valid) {\n        av_log(m->avctx, AV_LOG_WARNING,\n               "Stream parameters not seen; skipping frame.\\n");\n        *data_size = 0;\n        return length;\n    }\n    substream_start = 0;\n    for (substr = 0; substr < m->num_substreams; substr++) {\n        int extraword_present, checkdata_present, end, nonrestart_substr;\n        extraword_present = get_bits1(&gb);\n        nonrestart_substr = get_bits1(&gb);\n        checkdata_present = get_bits1(&gb);\n        skip_bits1(&gb);\n        end = get_bits(&gb, 12) * 2;\n        substr_header_size += 2;\n        if (extraword_present) {\n            if (m->avctx->codec_id == CODEC_ID_MLP) {\n                av_log(m->avctx, AV_LOG_ERROR, "There must be no extraword for MLP.\\n");\n                goto error;\n            }\n            skip_bits(&gb, 16);\n            substr_header_size += 2;\n        }\n        if (!(nonrestart_substr ^ m->is_major_sync_unit)) {\n            av_log(m->avctx, AV_LOG_ERROR, "Invalid nonrestart_substr.\\n");\n            goto error;\n        }\n        if (end + header_size + substr_header_size > length) {\n            av_log(m->avctx, AV_LOG_ERROR,\n                   "Indicated length of substream %d data goes off end of "\n                   "packet.\\n", substr);\n            end = length - header_size - substr_header_size;\n        }\n        if (end < substream_start) {\n            av_log(avctx, AV_LOG_ERROR,\n                   "Indicated end offset of substream %d data "\n                   "is smaller than calculated start offset.\\n",\n                   substr);\n            goto error;\n        }\n        if (substr > m->max_decoded_substream)\n            continue;\n        substream_parity_present[substr] = checkdata_present;\n        substream_data_len[substr] = end - substream_start;\n        substream_start = end;\n    }\n    parity_bits  = ff_mlp_calculate_parity(buf, 4);\n    parity_bits ^= ff_mlp_calculate_parity(buf + header_size, substr_header_size);\n    if ((((parity_bits >> 4) ^ parity_bits) & 0xF) != 0xF) {\n        av_log(avctx, AV_LOG_ERROR, "Parity check failed.\\n");\n        goto error;\n    }\n    buf += header_size + substr_header_size;\n    for (substr = 0; substr <= m->max_decoded_substream; substr++) {\n        SubStream *s = &m->substream[substr];\n        init_get_bits(&gb, buf, substream_data_len[substr] * 8);\n        m->matrix_changed = 0;\n        memset(m->filter_changed, 0, sizeof(m->filter_changed));\n        s->blockpos = 0;\n        do {\n            unsigned int ch;\n            if (get_bits1(&gb)) {\n                if (get_bits1(&gb)) {\n                    if (read_restart_header(m, &gb, buf, substr) < 0)\n                        goto next_substr;\n                    s->restart_seen = 1;\n                }\n                if (!s->restart_seen) {\n                    goto next_substr;\n                }\n                if (read_decoding_params(m, &gb, substr) < 0)\n                    goto next_substr;\n            }\n            if (m->matrix_changed > 1) {\n                av_log(m->avctx, AV_LOG_ERROR, "Matrices may change only once per access unit.\\n");\n                goto next_substr;\n            }\n            for (ch = 0; ch < s->max_channel; ch++)\n                if (m->filter_changed[ch][FIR] > 1 ||\n                    m->filter_changed[ch][IIR] > 1) {\n                    av_log(m->avctx, AV_LOG_ERROR, "Filters may change only once per access unit.\\n");\n                    goto next_substr;\n                }\n            if (!s->restart_seen) {\n                goto next_substr;\n            }\n            if (read_block_data(m, &gb, substr) < 0)\n                return -1;\n            if (get_bits_count(&gb) >= substream_data_len[substr] * 8)\n                goto substream_length_mismatch;\n        } while (!get_bits1(&gb));\n        skip_bits(&gb, (-get_bits_count(&gb)) & 15);\n        if (substream_data_len[substr] * 8 - get_bits_count(&gb) >= 32) {\n            int shorten_by;\n            if (get_bits(&gb, 16) != 0xD234)\n                return -1;\n            shorten_by = get_bits(&gb, 16);\n            if      (m->avctx->codec_id == CODEC_ID_TRUEHD && shorten_by  & 0x2000)\n                s->blockpos -= FFMIN(shorten_by & 0x1FFF, s->blockpos);\n            else if (m->avctx->codec_id == CODEC_ID_MLP    && shorten_by != 0xD234)\n                return -1;\n            if (substr == m->max_decoded_substream)\n                av_log(m->avctx, AV_LOG_INFO, "End of stream indicated.\\n");\n        }\n        if (substream_parity_present[substr]) {\n            uint8_t parity, checksum;\n            if (substream_data_len[substr] * 8 - get_bits_count(&gb) != 16)\n                goto substream_length_mismatch;\n            parity   = ff_mlp_calculate_parity(buf, substream_data_len[substr] - 2);\n            checksum = ff_mlp_checksum8       (buf, substream_data_len[substr] - 2);\n            if ((get_bits(&gb, 8) ^ parity) != 0xa9    )\n                av_log(m->avctx, AV_LOG_ERROR, "Substream %d parity check failed.\\n", substr);\n            if ( get_bits(&gb, 8)           != checksum)\n                av_log(m->avctx, AV_LOG_ERROR, "Substream %d checksum failed.\\n"    , substr);\n        }\n        if (substream_data_len[substr] * 8 != get_bits_count(&gb)) {\n            goto substream_length_mismatch;\n        }\nnext_substr:\n        if (!s->restart_seen) {\n            av_log(m->avctx, AV_LOG_ERROR,\n                   "No restart header present in substream %d.\\n", substr);\n        }\n        buf += substream_data_len[substr];\n    }\n    rematrix_channels(m, m->max_decoded_substream);\n    if (output_data(m, m->max_decoded_substream, data, data_size) < 0)\n        return -1;\n    return length;\nsubstream_length_mismatch:\n    av_log(m->avctx, AV_LOG_ERROR, "substream %d length mismatch\\n", substr);\n    return -1;\nerror:\n    m->params_valid = 0;\n    return -1;\n}']