libavcodec/8bps.c:123: error: Integer Overflow L2
  ([1, +oo] - 2):unsigned32.

libavcodec/8bps.c:60:1: <LHS trace>
58.  *
59.  */
60. static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, const uint8_t *buf, int buf_size)
    ^
61. {
62.         EightBpsContext * const c = avctx->priv_data;

libavcodec/8bps.c:60:1: Parameter `*buf`
58.  *
59.  */
60. static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, const uint8_t *buf, int buf_size)
    ^
61. {
62.         EightBpsContext * const c = avctx->priv_data;

libavcodec/8bps.c:104:38: Assignment
102.                         while(dlen > 0) {
103.                                 if(dp + 1 >= buf+buf_size) return -1;
104.                                 if ((count = *dp++) <= 127) {
                                          ^
105.                                         count++;
106.                                         dlen -= count + 1;

libavcodec/8bps.c:105:41: Assignment
103.                                 if(dp + 1 >= buf+buf_size) return -1;
104.                                 if ((count = *dp++) <= 127) {
105.                                         count++;
                                             ^
106.                                         dlen -= count + 1;
107.                                         if (pixptr + count * px_inc > pixptr_end)

libavcodec/8bps.c:106:41: Assignment
104.                                 if ((count = *dp++) <= 127) {
105.                                         count++;
106.                                         dlen -= count + 1;
                                             ^
107.                                         if (pixptr + count * px_inc > pixptr_end)
108.                                             break;

libavcodec/8bps.c:123:41: Binary operation: ([1, +oo] - 2):unsigned32
121.                                         }
122.                                         dp++;
123.                                         dlen -= 2;
                                             ^
124.                                 }
125.                         }

static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, const uint8_t *buf, int buf_size)
{
        EightBpsContext * const c = avctx->priv_data;
        const unsigned char *encoded = buf;
        unsigned char *pixptr, *pixptr_end;
        unsigned int height = avctx->height;
        unsigned int dlen, p, row;
        const unsigned char *lp, *dp;
        unsigned char count;
        unsigned int px_inc;
        unsigned int planes = c->planes;
        unsigned char *planemap = c->planemap;
        if(c->pic.data[0])
                avctx->release_buffer(avctx, &c->pic);
        c->pic.reference = 0;
        c->pic.buffer_hints = FF_BUFFER_HINTS_VALID;
        if(avctx->get_buffer(avctx, &c->pic) < 0){
                av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
                return -1;
        }
        dp = encoded + planes * (height << 1);
        if (planes == 4)
                planes--;
        px_inc = planes + (avctx->pix_fmt == PIX_FMT_RGB32);
        for (p = 0; p < planes; p++) {
                lp = encoded + p * (height << 1);
                for(row = 0; row < height; row++) {
                        pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p];
                        pixptr_end = pixptr + c->pic.linesize[0];
                        dlen = be2me_16(*(const unsigned short *)(lp+row*2));
                        while(dlen > 0) {
                                if(dp + 1 >= buf+buf_size) return -1;
                                if ((count = *dp++) <= 127) {
                                        count++;
                                        dlen -= count + 1;
                                        if (pixptr + count * px_inc > pixptr_end)
                                            break;
                                        if(dp + count > buf+buf_size) return -1;
                                        while(count--) {
                                                *pixptr = *dp++;
                                                pixptr += px_inc;
                                        }
                                } else {
                                        count = 257 - count;
                                        if (pixptr + count * px_inc > pixptr_end)
                                            break;
                                        while(count--) {
                                                *pixptr = *dp;
                                                pixptr += px_inc;
                                        }
                                        dp++;
                                        dlen -= 2;
                                }
                        }
                }
        }
        if (avctx->palctrl) {
                memcpy (c->pic.data[1], avctx->palctrl->palette, AVPALETTE_SIZE);
                if (avctx->palctrl->palette_changed) {
                        c->pic.palette_has_changed = 1;
                        avctx->palctrl->palette_changed = 0;
                } else
                        c->pic.palette_has_changed = 0;
        }
        *data_size = sizeof(AVFrame);
        *(AVFrame*)data = c->pic;
        return buf_size;
}
['static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, const uint8_t *buf, int buf_size)\n{\n        EightBpsContext * const c = avctx->priv_data;\n        const unsigned char *encoded = buf;\n        unsigned char *pixptr, *pixptr_end;\n        unsigned int height = avctx->height;\n        unsigned int dlen, p, row;\n        const unsigned char *lp, *dp;\n        unsigned char count;\n        unsigned int px_inc;\n        unsigned int planes = c->planes;\n        unsigned char *planemap = c->planemap;\n        if(c->pic.data[0])\n                avctx->release_buffer(avctx, &c->pic);\n        c->pic.reference = 0;\n        c->pic.buffer_hints = FF_BUFFER_HINTS_VALID;\n        if(avctx->get_buffer(avctx, &c->pic) < 0){\n                av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n                return -1;\n        }\n        dp = encoded + planes * (height << 1);\n        if (planes == 4)\n                planes--;\n        px_inc = planes + (avctx->pix_fmt == PIX_FMT_RGB32);\n        for (p = 0; p < planes; p++) {\n                lp = encoded + p * (height << 1);\n                for(row = 0; row < height; row++) {\n                        pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p];\n                        pixptr_end = pixptr + c->pic.linesize[0];\n                        dlen = be2me_16(*(const unsigned short *)(lp+row*2));\n                        while(dlen > 0) {\n                                if(dp + 1 >= buf+buf_size) return -1;\n                                if ((count = *dp++) <= 127) {\n                                        count++;\n                                        dlen -= count + 1;\n                                        if (pixptr + count * px_inc > pixptr_end)\n                                            break;\n                                        if(dp + count > buf+buf_size) return -1;\n                                        while(count--) {\n                                                *pixptr = *dp++;\n                                                pixptr += px_inc;\n                                        }\n                                } else {\n                                        count = 257 - count;\n                                        if (pixptr + count * px_inc > pixptr_end)\n                                            break;\n                                        while(count--) {\n                                                *pixptr = *dp;\n                                                pixptr += px_inc;\n                                        }\n                                        dp++;\n                                        dlen -= 2;\n                                }\n                        }\n                }\n        }\n        if (avctx->palctrl) {\n                memcpy (c->pic.data[1], avctx->palctrl->palette, AVPALETTE_SIZE);\n                if (avctx->palctrl->palette_changed) {\n                        c->pic.palette_has_changed = 1;\n                        avctx->palctrl->palette_changed = 0;\n                } else\n                        c->pic.palette_has_changed = 0;\n        }\n        *data_size = sizeof(AVFrame);\n        *(AVFrame*)data = c->pic;\n        return buf_size;\n}']