libavcodec/mlpdec.c:1102: error: Integer Overflow L2
  (32 - [0, 96]):unsigned32 by call to `read_major_sync`.

libavcodec/mlpdec.c:1098:5: Call
1096.         return AVERROR_INVALIDDATA;
1097. 
1098.     bitstream_init(&bc, (buf + 4), (length - 4) * 8);
          ^
1099. 
1100.     m->is_major_sync_unit = 0;

libavcodec/bitstream.h:85:9: Assignment
  83.         bc->buffer    =
  84.         bc->ptr       = NULL;
  85.         bc->bits_left = 0;
              ^
  86.         return AVERROR_INVALIDDATA;
  87.     }

libavcodec/mlpdec.c:1101:9: Call
1099. 
1100.     m->is_major_sync_unit = 0;
1101.     if (bitstream_peek(&bc, 31) == (0xf8726fba >> 1)) {
              ^
1102.         if (read_major_sync(m, &bc) < 0)
1103.             goto error;

libavcodec/bitstream.h:215:1: Parameter `n`
  213. /* Return n bits from the buffer, but do not change the buffer state.
  214.  * n has to be in the 0-32 range. */
  215. static inline unsigned bitstream_peek(BitstreamContext *bc, unsigned n)
       ^
  216. {
  217.     if (n > bc->bits_left)

libavcodec/mlpdec.c:1102:13: Call
1100.     m->is_major_sync_unit = 0;
1101.     if (bitstream_peek(&bc, 31) == (0xf8726fba >> 1)) {
1102.         if (read_major_sync(m, &bc) < 0)
                  ^
1103.             goto error;
1104.         m->is_major_sync_unit = 1;

libavcodec/mlpdec.c:293:1: Parameter `bc->bits_left`
  291.  */
  292. 
  293. static int read_major_sync(MLPDecodeContext *m, BitstreamContext *bc)
       ^
  294. {
  295.     MLPHeaderInfo mh;

libavcodec/mlpdec.c:298:16: Call
  296.     int substr, ret;
  297. 
  298.     if ((ret = ff_mlp_read_major_sync(m->avctx, &mh, bc)) != 0)
                      ^
  299.         return ret;
  300. 

libavcodec/mlp_parser.c:146:1: Parameter `bc->bits_left`
    144.  */
    145. 
    146. int ff_mlp_read_major_sync(void *log, MLPHeaderInfo *mh, BitstreamContext *bc)
         ^
    147. {
    148.     int ratebits, channel_arrangement, header_size;

libavcodec/mlp_parser.c:165:9: Call
    163.     }
    164. 
    165.     if (bitstream_read(bc, 24) != 0xf8726f) /* Sync words */
                 ^
    166.         return AVERROR_INVALIDDATA;
    167. 

libavcodec/bitstream.h:183:1: Parameter `n`
      181. 
      182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
      183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
           ^
      184. {
      185.     if (!n)

libavcodec/bitstream.h:189:9: Call
      187. 
      188.     if (n > bc->bits_left) {
      189.         refill_32(bc);
                   ^
      190.         if (bc->bits_left < 32)
      191.             bc->bits_left = n;

libavcodec/bitstream.h:60:1: <RHS trace>
58. }
59. 
60. static inline void refill_32(BitstreamContext *bc)
    ^
61. {
62.     if (bc->ptr >= bc->buffer_end)

libavcodec/bitstream.h:60:1: Parameter `bc->bits_left`
        58. }
        59. 
        60. static inline void refill_32(BitstreamContext *bc)
            ^
        61. {
        62.     if (bc->ptr >= bc->buffer_end)

libavcodec/bitstream.h:68:5: Binary operation: (32 - [0, 96]):unsigned32 by call to `read_major_sync` 
        66.     bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;
        67. #else
        68.     bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);
                ^
        69. #endif
        70.     bc->ptr       += 4;

static inline void refill_32(BitstreamContext *bc)
{
    if (bc->ptr >= bc->buffer_end)
        return;
#ifdef BITSTREAM_READER_LE
    bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;
#else
    bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);
#endif
    bc->ptr       += 4;
    bc->bits_left += 32;
}
['static int read_access_unit(AVCodecContext *avctx, void* data,\n                            int *got_frame_ptr, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    MLPDecodeContext *m = avctx->priv_data;\n    BitstreamContext bc;\n    unsigned int length, substr;\n    unsigned int substream_start;\n    unsigned int header_size = 4;\n    unsigned int substr_header_size = 0;\n    uint8_t substream_parity_present[MAX_SUBSTREAMS];\n    uint16_t substream_data_len[MAX_SUBSTREAMS];\n    uint8_t parity_bits;\n    int ret;\n    if (buf_size < 4)\n        return 0;\n    length = (AV_RB16(buf) & 0xfff) * 2;\n    if (length < 4 || length > buf_size)\n        return AVERROR_INVALIDDATA;\n    bitstream_init(&bc, (buf + 4), (length - 4) * 8);\n    m->is_major_sync_unit = 0;\n    if (bitstream_peek(&bc, 31) == (0xf8726fba >> 1)) {\n        if (read_major_sync(m, &bc) < 0)\n            goto error;\n        m->is_major_sync_unit = 1;\n        header_size += m->major_sync_header_size;\n    }\n    if (!m->params_valid) {\n        av_log(m->avctx, AV_LOG_WARNING,\n               "Stream parameters not seen; skipping frame.\\n");\n        *got_frame_ptr = 0;\n        return length;\n    }\n    substream_start = 0;\n    for (substr = 0; substr < m->num_substreams; substr++) {\n        int extraword_present, checkdata_present, end, nonrestart_substr;\n        extraword_present = bitstream_read_bit(&bc);\n        nonrestart_substr = bitstream_read_bit(&bc);\n        checkdata_present = bitstream_read_bit(&bc);\n        bitstream_skip(&bc, 1);\n        end = bitstream_read(&bc, 12) * 2;\n        substr_header_size += 2;\n        if (extraword_present) {\n            if (m->avctx->codec_id == AV_CODEC_ID_MLP) {\n                av_log(m->avctx, AV_LOG_ERROR, "There must be no extraword for MLP.\\n");\n                goto error;\n            }\n            bitstream_skip(&bc, 16);\n            substr_header_size += 2;\n        }\n        if (!(nonrestart_substr ^ m->is_major_sync_unit)) {\n            av_log(m->avctx, AV_LOG_ERROR, "Invalid nonrestart_substr.\\n");\n            goto error;\n        }\n        if (end + header_size + substr_header_size > length) {\n            av_log(m->avctx, AV_LOG_ERROR,\n                   "Indicated length of substream %d data goes off end of "\n                   "packet.\\n", substr);\n            end = length - header_size - substr_header_size;\n        }\n        if (end < substream_start) {\n            av_log(avctx, AV_LOG_ERROR,\n                   "Indicated end offset of substream %d data "\n                   "is smaller than calculated start offset.\\n",\n                   substr);\n            goto error;\n        }\n        if (substr > m->max_decoded_substream)\n            continue;\n        substream_parity_present[substr] = checkdata_present;\n        substream_data_len[substr] = end - substream_start;\n        substream_start = end;\n    }\n    parity_bits  = ff_mlp_calculate_parity(buf, 4);\n    parity_bits ^= ff_mlp_calculate_parity(buf + header_size, substr_header_size);\n    if ((((parity_bits >> 4) ^ parity_bits) & 0xF) != 0xF) {\n        av_log(avctx, AV_LOG_ERROR, "Parity check failed.\\n");\n        goto error;\n    }\n    buf += header_size + substr_header_size;\n    for (substr = 0; substr <= m->max_decoded_substream; substr++) {\n        SubStream *s = &m->substream[substr];\n        bitstream_init(&bc, buf, substream_data_len[substr] * 8);\n        m->matrix_changed = 0;\n        memset(m->filter_changed, 0, sizeof(m->filter_changed));\n        s->blockpos = 0;\n        do {\n            if (bitstream_read_bit(&bc)) {\n                if (bitstream_read_bit(&bc)) {\n                    if (read_restart_header(m, &bc, buf, substr) < 0)\n                        goto next_substr;\n                    s->restart_seen = 1;\n                }\n                if (!s->restart_seen)\n                    goto next_substr;\n                if (read_decoding_params(m, &bc, substr) < 0)\n                    goto next_substr;\n            }\n            if (!s->restart_seen)\n                goto next_substr;\n            if ((ret = read_block_data(m, &bc, substr)) < 0)\n                return ret;\n            if (bitstream_tell(&bc) >= substream_data_len[substr] * 8)\n                goto substream_length_mismatch;\n        } while (!bitstream_read_bit(&bc));\n        bitstream_skip(&bc, (-bitstream_tell(&bc)) & 15);\n        if (substream_data_len[substr] * 8 - bitstream_tell(&bc) >= 32) {\n            int shorten_by;\n            if (bitstream_read(&bc, 16) != 0xD234)\n                return AVERROR_INVALIDDATA;\n            shorten_by = bitstream_read(&bc, 16);\n            if      (m->avctx->codec_id == AV_CODEC_ID_TRUEHD && shorten_by  & 0x2000)\n                s->blockpos -= FFMIN(shorten_by & 0x1FFF, s->blockpos);\n            else if (m->avctx->codec_id == AV_CODEC_ID_MLP    && shorten_by != 0xD234)\n                return AVERROR_INVALIDDATA;\n            if (substr == m->max_decoded_substream)\n                av_log(m->avctx, AV_LOG_INFO, "End of stream indicated.\\n");\n        }\n        if (substream_parity_present[substr]) {\n            uint8_t parity, checksum;\n            if (substream_data_len[substr] * 8 - bitstream_tell(&bc) != 16)\n                goto substream_length_mismatch;\n            parity   = ff_mlp_calculate_parity(buf, substream_data_len[substr] - 2);\n            checksum = ff_mlp_checksum8       (buf, substream_data_len[substr] - 2);\n            if ((bitstream_read(&bc, 8) ^ parity) != 0xa9)\n                av_log(m->avctx, AV_LOG_ERROR, "Substream %d parity check failed.\\n", substr);\n            if (bitstream_read(&bc, 8) != checksum)\n                av_log(m->avctx, AV_LOG_ERROR, "Substream %d checksum failed.\\n"    , substr);\n        }\n        if (substream_data_len[substr] * 8 != bitstream_tell(&bc))\n            goto substream_length_mismatch;\nnext_substr:\n        if (!s->restart_seen)\n            av_log(m->avctx, AV_LOG_ERROR,\n                   "No restart header present in substream %d.\\n", substr);\n        buf += substream_data_len[substr];\n    }\n    rematrix_channels(m, m->max_decoded_substream);\n    if ((ret = output_data(m, m->max_decoded_substream, data, got_frame_ptr)) < 0)\n        return ret;\n    return length;\nsubstream_length_mismatch:\n    av_log(m->avctx, AV_LOG_ERROR, "substream %d length mismatch\\n", substr);\n    return AVERROR_INVALIDDATA;\nerror:\n    m->params_valid = 0;\n    return AVERROR_INVALIDDATA;\n}', 'static inline int bitstream_init(BitstreamContext *bc, const uint8_t *buffer,\n                                 unsigned bit_size)\n{\n    unsigned buffer_size;\n    if (bit_size > INT_MAX - 7 || !buffer) {\n        buffer        =\n        bc->buffer    =\n        bc->ptr       = NULL;\n        bc->bits_left = 0;\n        return AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    bc->buffer       = buffer;\n    bc->buffer_end   = buffer + buffer_size;\n    bc->ptr          = bc->buffer;\n    bc->size_in_bits = bit_size;\n    bc->bits_left    = 0;\n    bc->bits         = 0;\n    refill_64(bc);\n    return 0;\n}', 'static inline unsigned bitstream_peek(BitstreamContext *bc, unsigned n)\n{\n    if (n > bc->bits_left)\n        refill_32(bc);\n    return show_val(bc, n);\n}', 'static int read_major_sync(MLPDecodeContext *m, BitstreamContext *bc)\n{\n    MLPHeaderInfo mh;\n    int substr, ret;\n    if ((ret = ff_mlp_read_major_sync(m->avctx, &mh, bc)) != 0)\n        return ret;\n    if (mh.group1_bits == 0) {\n        av_log(m->avctx, AV_LOG_ERROR, "invalid/unknown bits per sample\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (mh.group2_bits > mh.group1_bits) {\n        av_log(m->avctx, AV_LOG_ERROR,\n               "Channel group 2 cannot have more bits per sample than group 1.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (mh.group2_samplerate && mh.group2_samplerate != mh.group1_samplerate) {\n        av_log(m->avctx, AV_LOG_ERROR,\n               "Channel groups with differing sample rates are not currently supported.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (mh.group1_samplerate == 0) {\n        av_log(m->avctx, AV_LOG_ERROR, "invalid/unknown sampling rate\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (mh.group1_samplerate > MAX_SAMPLERATE) {\n        av_log(m->avctx, AV_LOG_ERROR,\n               "Sampling rate %d is greater than the supported maximum (%d).\\n",\n               mh.group1_samplerate, MAX_SAMPLERATE);\n        return AVERROR_INVALIDDATA;\n    }\n    if (mh.access_unit_size > MAX_BLOCKSIZE) {\n        av_log(m->avctx, AV_LOG_ERROR,\n               "Block size %d is greater than the supported maximum (%d).\\n",\n               mh.access_unit_size, MAX_BLOCKSIZE);\n        return AVERROR_INVALIDDATA;\n    }\n    if (mh.access_unit_size_pow2 > MAX_BLOCKSIZE_POW2) {\n        av_log(m->avctx, AV_LOG_ERROR,\n               "Block size pow2 %d is greater than the supported maximum (%d).\\n",\n               mh.access_unit_size_pow2, MAX_BLOCKSIZE_POW2);\n        return AVERROR_INVALIDDATA;\n    }\n    if (mh.num_substreams == 0)\n        return AVERROR_INVALIDDATA;\n    if (m->avctx->codec_id == AV_CODEC_ID_MLP && mh.num_substreams > 2) {\n        av_log(m->avctx, AV_LOG_ERROR, "MLP only supports up to 2 substreams.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (mh.num_substreams > MAX_SUBSTREAMS) {\n        avpriv_request_sample(m->avctx,\n                              "%d substreams (more than the "\n                              "maximum supported by the decoder)",\n                              mh.num_substreams);\n        return AVERROR_PATCHWELCOME;\n    }\n    m->major_sync_header_size = mh.header_size;\n    m->access_unit_size      = mh.access_unit_size;\n    m->access_unit_size_pow2 = mh.access_unit_size_pow2;\n    m->num_substreams        = mh.num_substreams;\n    m->max_decoded_substream = FFMIN(m->num_substreams - 1, 2);\n    m->avctx->sample_rate    = mh.group1_samplerate;\n    m->avctx->frame_size     = mh.access_unit_size;\n    m->avctx->bits_per_raw_sample = mh.group1_bits;\n    if (mh.group1_bits > 16)\n        m->avctx->sample_fmt = AV_SAMPLE_FMT_S32;\n    else\n        m->avctx->sample_fmt = AV_SAMPLE_FMT_S16;\n    m->dsp.mlp_pack_output = m->dsp.mlp_select_pack_output(m->substream[m->max_decoded_substream].ch_assign,\n                                                           m->substream[m->max_decoded_substream].output_shift,\n                                                           m->substream[m->max_decoded_substream].max_matrix_channel,\n                                                           m->avctx->sample_fmt == AV_SAMPLE_FMT_S32);\n    m->params_valid = 1;\n    for (substr = 0; substr < MAX_SUBSTREAMS; substr++)\n        m->substream[substr].restart_seen = 0;\n    if (m->avctx->codec_id == AV_CODEC_ID_MLP) {\n        if ((substr = (mh.num_substreams > 1)))\n            m->substream[0].ch_layout = AV_CH_LAYOUT_STEREO;\n        m->substream[substr].ch_layout = mh.channel_layout_mlp;\n    } else {\n        if ((substr = (mh.num_substreams > 1)))\n            m->substream[0].ch_layout = AV_CH_LAYOUT_STEREO;\n        if (mh.num_substreams > 2)\n            if (mh.channel_layout_thd_stream2)\n                m->substream[2].ch_layout = mh.channel_layout_thd_stream2;\n            else\n                m->substream[2].ch_layout = mh.channel_layout_thd_stream1;\n        m->substream[substr].ch_layout = mh.channel_layout_thd_stream1;\n    }\n    for (substr = 0; substr < MAX_SUBSTREAMS; substr++)\n        m->substream[substr].matrix_encoding = AV_MATRIX_ENCODING_NONE;\n    if (m->avctx->codec_id == AV_CODEC_ID_TRUEHD) {\n        if (mh.num_substreams > 2 &&\n            mh.channel_layout_thd_stream2 & AV_CH_SIDE_LEFT &&\n            mh.channel_layout_thd_stream2 & AV_CH_SIDE_RIGHT &&\n            mh.channel_modifier_thd_stream2 == THD_CH_MODIFIER_SURROUNDEX)\n            m->substream[2].matrix_encoding = AV_MATRIX_ENCODING_DOLBYEX;\n        if (mh.num_substreams > 1 &&\n            mh.channel_layout_thd_stream1 & AV_CH_SIDE_LEFT &&\n            mh.channel_layout_thd_stream1 & AV_CH_SIDE_RIGHT &&\n            mh.channel_modifier_thd_stream1 == THD_CH_MODIFIER_SURROUNDEX)\n            m->substream[1].matrix_encoding = AV_MATRIX_ENCODING_DOLBYEX;\n        if (mh.num_substreams > 0)\n            switch (mh.channel_modifier_thd_stream0) {\n            case THD_CH_MODIFIER_LTRT:\n                m->substream[0].matrix_encoding = AV_MATRIX_ENCODING_DOLBY;\n                break;\n            case THD_CH_MODIFIER_LBINRBIN:\n                m->substream[0].matrix_encoding = AV_MATRIX_ENCODING_DOLBYHEADPHONE;\n                break;\n            default:\n                break;\n            }\n    }\n    return 0;\n}', 'int ff_mlp_read_major_sync(void *log, MLPHeaderInfo *mh, BitstreamContext *bc)\n{\n    int ratebits, channel_arrangement, header_size;\n    uint16_t checksum;\n    assert(bitstream_tell(bc) == 0);\n    header_size = ff_mlp_get_major_sync_size(bc->buffer, bc->size_in_bits >> 3);\n    if (header_size < 0 || bc->size_in_bits < header_size << 3) {\n        av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\\n");\n        return -1;\n    }\n    checksum = ff_mlp_checksum16(bc->buffer, header_size - 2);\n    if (checksum != AV_RL16(bc->buffer + header_size - 2)) {\n        av_log(log, AV_LOG_ERROR, "major sync info header checksum error\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (bitstream_read(bc, 24) != 0xf8726f)\n        return AVERROR_INVALIDDATA;\n    mh->stream_type = bitstream_read(bc, 8);\n    mh->header_size = header_size;\n    if (mh->stream_type == 0xbb) {\n        mh->group1_bits = mlp_quants[bitstream_read(bc, 4)];\n        mh->group2_bits = mlp_quants[bitstream_read(bc, 4)];\n        ratebits = bitstream_read(bc, 4);\n        mh->group1_samplerate = mlp_samplerate(ratebits);\n        mh->group2_samplerate = mlp_samplerate(bitstream_read(bc, 4));\n        bitstream_skip(bc, 11);\n        channel_arrangement    = bitstream_read(bc, 5);\n        mh->channels_mlp       = mlp_channels[channel_arrangement];\n        mh->channel_layout_mlp = mlp_layout[channel_arrangement];\n    } else if (mh->stream_type == 0xba) {\n        mh->group1_bits = 24;\n        mh->group2_bits = 0;\n        ratebits = bitstream_read(bc, 4);\n        mh->group1_samplerate = mlp_samplerate(ratebits);\n        mh->group2_samplerate = 0;\n        bitstream_skip(bc, 4);\n        mh->channel_modifier_thd_stream0 = bitstream_read(bc, 2);\n        mh->channel_modifier_thd_stream1 = bitstream_read(bc, 2);\n        channel_arrangement            = bitstream_read(bc, 5);\n        mh->channels_thd_stream1       = truehd_channels(channel_arrangement);\n        mh->channel_layout_thd_stream1 = truehd_layout(channel_arrangement);\n        mh->channel_modifier_thd_stream2 = bitstream_read(bc, 2);\n        channel_arrangement            = bitstream_read(bc, 13);\n        mh->channels_thd_stream2       = truehd_channels(channel_arrangement);\n        mh->channel_layout_thd_stream2 = truehd_layout(channel_arrangement);\n    } else\n        return AVERROR_INVALIDDATA;\n    mh->access_unit_size = 40 << (ratebits & 7);\n    mh->access_unit_size_pow2 = 64 << (ratebits & 7);\n    bitstream_skip(bc, 48);\n    mh->is_vbr = bitstream_read_bit(bc);\n    mh->peak_bitrate = (bitstream_read(bc, 15) * mh->group1_samplerate + 8) >> 4;\n    mh->num_substreams = bitstream_read(bc, 4);\n    bitstream_skip(bc, 4 + (header_size - 17) * 8);\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline void refill_32(BitstreamContext *bc)\n{\n    if (bc->ptr >= bc->buffer_end)\n        return;\n#ifdef BITSTREAM_READER_LE\n    bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;\n#else\n    bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);\n#endif\n    bc->ptr       += 4;\n    bc->bits_left += 32;\n}']