libavformat/wc3movie.c:223: error: Integer Overflow L2
  ([-oo, 2147483639] + 12):signed32 by call to `av_append_packet`.

libavformat/wc3movie.c:234:36: Assignment
232.                 ret = 0;
233.             *pkt = wc3->vpkt;
234.             wc3->vpkt.data = NULL; wc3->vpkt.size = 0;
                                        ^
235.             pkt->stream_index = wc3->video_stream_index;
236.             pkt->pts = wc3->pts;

libavformat/wc3movie.c:223:13: Call
221.             /* load up new palette */
222.             avio_seek(pb, -8, SEEK_CUR);
223.             av_append_packet(pb, &wc3->vpkt, 8 + 4);
                 ^
224.             break;
225. 

libavformat/utils.c:344:1: Parameter `size`
  342. }
  343. 
  344. int av_append_packet(AVIOContext *s, AVPacket *pkt, int size)
       ^
  345. {
  346.     int ret;

libavformat/utils.c:351:11: Call
  349.         return av_get_packet(s, pkt, size);
  350.     old_size = pkt->size;
  351.     ret = av_grow_packet(pkt, size);
                 ^
  352.     if (ret < 0)
  353.         return ret;

libavcodec/avpacket.c:75:1: <LHS trace>
73. }
74. 
75. int av_grow_packet(AVPacket *pkt, int grow_by)
    ^
76. {
77.     void *new_ptr;

libavcodec/avpacket.c:75:1: Parameter `grow_by`
    73. }
    74. 
    75. int av_grow_packet(AVPacket *pkt, int grow_by)
        ^
    76. {
    77.     void *new_ptr;

libavcodec/avpacket.c:75:1: <RHS trace>
73. }
74. 
75. int av_grow_packet(AVPacket *pkt, int grow_by)
    ^
76. {
77.     void *new_ptr;

libavcodec/avpacket.c:75:1: Parameter `grow_by`
    73. }
    74. 
    75. int av_grow_packet(AVPacket *pkt, int grow_by)
        ^
    76. {
    77.     void *new_ptr;

libavcodec/avpacket.c:83:15: Binary operation: ([-oo, 2147483639] + 12):signed32 by call to `av_append_packet` 
    81.     if ((unsigned)grow_by > INT_MAX - (pkt->size + FF_INPUT_BUFFER_PADDING_SIZE))
    82.         return -1;
    83.     new_ptr = av_realloc(pkt->data, pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE);
                      ^
    84.     if (!new_ptr)
    85.         return AVERROR(ENOMEM);

int av_grow_packet(AVPacket *pkt, int grow_by)
{
    void *new_ptr;
    av_assert0((unsigned)pkt->size <= INT_MAX - FF_INPUT_BUFFER_PADDING_SIZE);
    if (!pkt->size)
        return av_new_packet(pkt, grow_by);
    if ((unsigned)grow_by > INT_MAX - (pkt->size + FF_INPUT_BUFFER_PADDING_SIZE))
        return -1;
    new_ptr = av_realloc(pkt->data, pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE);
    if (!new_ptr)
        return AVERROR(ENOMEM);
    pkt->data = new_ptr;
    pkt->size += grow_by;
    memset(pkt->data + pkt->size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
    return 0;
}
['static int wc3_read_packet(AVFormatContext *s,\n                           AVPacket *pkt)\n{\n    Wc3DemuxContext *wc3 = s->priv_data;\n    AVIOContext *pb = s->pb;\n    unsigned int fourcc_tag;\n    unsigned int size;\n    int packet_read = 0;\n    int ret = 0;\n    unsigned char text[1024];\n    while (!packet_read) {\n        fourcc_tag = avio_rl32(pb);\n        size = (avio_rb32(pb) + 1) & (~1);\n        if (url_feof(pb))\n            return AVERROR(EIO);\n        switch (fourcc_tag) {\n        case BRCH_TAG:\n            break;\n        case SHOT_TAG:\n            avio_seek(pb, -8, SEEK_CUR);\n            av_append_packet(pb, &wc3->vpkt, 8 + 4);\n            break;\n        case VGA__TAG:\n            avio_seek(pb, -8, SEEK_CUR);\n            ret= av_append_packet(pb, &wc3->vpkt, 8 + size);\n            if (wc3->vpkt.size > 0)\n                ret = 0;\n            *pkt = wc3->vpkt;\n            wc3->vpkt.data = NULL; wc3->vpkt.size = 0;\n            pkt->stream_index = wc3->video_stream_index;\n            pkt->pts = wc3->pts;\n            packet_read = 1;\n            break;\n        case TEXT_TAG:\n#if 0\n            avio_seek(pb, size, SEEK_CUR);\n#else\n            if ((unsigned)size > sizeof(text) || (ret = avio_read(pb, text, size)) != size)\n                ret = AVERROR(EIO);\n            else {\n                int i = 0;\n                av_log (s, AV_LOG_DEBUG, "Subtitle time!\\n");\n                av_log (s, AV_LOG_DEBUG, "  inglish: %s\\n", &text[i + 1]);\n                i += text[i] + 1;\n                av_log (s, AV_LOG_DEBUG, "  doytsch: %s\\n", &text[i + 1]);\n                i += text[i] + 1;\n                av_log (s, AV_LOG_DEBUG, "  fronsay: %s\\n", &text[i + 1]);\n            }\n#endif\n            break;\n        case AUDI_TAG:\n            ret= av_get_packet(pb, pkt, size);\n            pkt->stream_index = wc3->audio_stream_index;\n            pkt->pts = wc3->pts;\n            wc3->pts++;\n            packet_read = 1;\n            break;\n        default:\n            av_log (s, AV_LOG_ERROR, "  unrecognized WC3 chunk: %c%c%c%c (0x%02X%02X%02X%02X)\\n",\n                (uint8_t)fourcc_tag, (uint8_t)(fourcc_tag >> 8), (uint8_t)(fourcc_tag >> 16), (uint8_t)(fourcc_tag >> 24),\n                (uint8_t)fourcc_tag, (uint8_t)(fourcc_tag >> 8), (uint8_t)(fourcc_tag >> 16), (uint8_t)(fourcc_tag >> 24));\n            ret = AVERROR_INVALIDDATA;\n            packet_read = 1;\n            break;\n        }\n    }\n    return ret;\n}', 'int av_append_packet(AVIOContext *s, AVPacket *pkt, int size)\n{\n    int ret;\n    int old_size;\n    if (!pkt->size)\n        return av_get_packet(s, pkt, size);\n    old_size = pkt->size;\n    ret = av_grow_packet(pkt, size);\n    if (ret < 0)\n        return ret;\n    ret = avio_read(s, pkt->data + old_size, size);\n    av_shrink_packet(pkt, old_size + FFMAX(ret, 0));\n    return ret;\n}', 'int av_grow_packet(AVPacket *pkt, int grow_by)\n{\n    void *new_ptr;\n    av_assert0((unsigned)pkt->size <= INT_MAX - FF_INPUT_BUFFER_PADDING_SIZE);\n    if (!pkt->size)\n        return av_new_packet(pkt, grow_by);\n    if ((unsigned)grow_by > INT_MAX - (pkt->size + FF_INPUT_BUFFER_PADDING_SIZE))\n        return -1;\n    new_ptr = av_realloc(pkt->data, pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE);\n    if (!new_ptr)\n        return AVERROR(ENOMEM);\n    pkt->data = new_ptr;\n    pkt->size += grow_by;\n    memset(pkt->data + pkt->size, 0, FF_INPUT_BUFFER_PADDING_SIZE);\n    return 0;\n}']