libavcodec/cavsdec.c:748: error: Integer Overflow L2
  (32 - [-4+min(64, `h->bc.bits_left`), max(63, `h->bc.bits_left`)]):unsigned32 by call to `ff_cavs_mv`.

libavcodec/cavsdec.c:717:1: Parameter `h->bc.bits_left`
715. }
716. 
717. static void decode_mb_p(AVSContext *h, enum cavs_mb mb_type)
     ^
718. {
719.     BitstreamContext *bc = &h->bc;

libavcodec/cavsdec.c:748:9: Call
746.         ref[2] = h->ref_flag ? 0 : bitstream_read_bit(bc);
747.         ref[3] = h->ref_flag ? 0 : bitstream_read_bit(bc);
748.         ff_cavs_mv(h, MV_FWD_X0, MV_FWD_B3, MV_PRED_MEDIAN,   BLK_8X8, ref[0]);
             ^
749.         ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN,   BLK_8X8, ref[1]);
750.         ff_cavs_mv(h, MV_FWD_X2, MV_FWD_X1, MV_PRED_MEDIAN,   BLK_8X8, ref[2]);

libavcodec/cavs.c:566:1: Parameter `h->bc.bits_left`
  564. }
  565. 
  566. void ff_cavs_mv(AVSContext *h, enum cavs_mv_loc nP, enum cavs_mv_loc nC,
       ^
  567.                 enum cavs_mv_pred mode, enum cavs_block size, int ref)
  568. {

libavcodec/cavs.c:606:19: Call
  604. 
  605.     if (mode < MV_PRED_PSKIP) {
  606.         mvP->x += get_se_golomb(&h->bc);
                         ^
  607.         mvP->y += get_se_golomb(&h->bc);
  608.     }

libavcodec/golomb.h:166:1: Parameter `bc->bits_left`
    164.  * read signed exp golomb code.
    165.  */
    166. static inline int get_se_golomb(BitstreamContext *bc)
         ^
    167. {
    168.     unsigned int buf;

libavcodec/golomb.h:170:11: Call
    168.     unsigned int buf;
    169. 
    170.     buf = bitstream_peek(bc, 32);
                   ^
    171. 
    172.     if (buf >= (1 << 27)) {

libavcodec/bitstream.h:215:1: Parameter `n`
      213. /* Return n bits from the buffer, but do not change the buffer state.
      214.  * n has to be in the 0-32 range. */
      215. static inline unsigned bitstream_peek(BitstreamContext *bc, unsigned n)
           ^
      216. {
      217.     if (n > bc->bits_left)

libavcodec/bitstream.h:218:9: Call
      216. {
      217.     if (n > bc->bits_left)
      218.         refill_32(bc);
                   ^
      219. 
      220.     return show_val(bc, n);

libavcodec/bitstream.h:60:1: <RHS trace>
58. }
59. 
60. static inline void refill_32(BitstreamContext *bc)
    ^
61. {
62.     if (bc->ptr >= bc->buffer_end)

libavcodec/bitstream.h:60:1: Parameter `bc->bits_left`
        58. }
        59. 
        60. static inline void refill_32(BitstreamContext *bc)
            ^
        61. {
        62.     if (bc->ptr >= bc->buffer_end)

libavcodec/bitstream.h:68:5: Binary operation: (32 - [-4+min(64, h->bc.bits_left), max(63, h->bc.bits_left)]):unsigned32 by call to `ff_cavs_mv` 
        66.     bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;
        67. #else
        68.     bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);
                ^
        69. #endif
        70.     bc->ptr       += 4;

static inline void refill_32(BitstreamContext *bc)
{
    if (bc->ptr >= bc->buffer_end)
        return;
#ifdef BITSTREAM_READER_LE
    bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;
#else
    bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);
#endif
    bc->ptr       += 4;
    bc->bits_left += 32;
}
['static void decode_mb_p(AVSContext *h, enum cavs_mb mb_type)\n{\n    BitstreamContext *bc = &h->bc;\n    int ref[4];\n    ff_cavs_init_mb(h);\n    switch (mb_type) {\n    case P_SKIP:\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_C2, MV_PRED_PSKIP,  BLK_16X16, 0);\n        break;\n    case P_16X16:\n        ref[0] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_C2, MV_PRED_MEDIAN, BLK_16X16, ref[0]);\n        break;\n    case P_16X8:\n        ref[0] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[2] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_C2, MV_PRED_TOP,    BLK_16X8, ref[0]);\n        ff_cavs_mv(h, MV_FWD_X2, MV_FWD_A1, MV_PRED_LEFT,   BLK_16X8, ref[2]);\n        break;\n    case P_8X16:\n        ref[0] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[1] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_B3, MV_PRED_LEFT,     BLK_8X16, ref[0]);\n        ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_TOPRIGHT, BLK_8X16, ref[1]);\n        break;\n    case P_8X8:\n        ref[0] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[1] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[2] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[3] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_B3, MV_PRED_MEDIAN,   BLK_8X8, ref[0]);\n        ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN,   BLK_8X8, ref[1]);\n        ff_cavs_mv(h, MV_FWD_X2, MV_FWD_X1, MV_PRED_MEDIAN,   BLK_8X8, ref[2]);\n        ff_cavs_mv(h, MV_FWD_X3, MV_FWD_X0, MV_PRED_MEDIAN,   BLK_8X8, ref[3]);\n    }\n    ff_cavs_inter(h, mb_type);\n    set_intra_mode_default(h);\n    store_mvs(h);\n    if (mb_type != P_SKIP)\n        decode_residual_inter(h);\n    ff_cavs_filter(h, mb_type);\n    h->col_type_base[h->mbidx] = mb_type;\n}', 'void ff_cavs_mv(AVSContext *h, enum cavs_mv_loc nP, enum cavs_mv_loc nC,\n                enum cavs_mv_pred mode, enum cavs_block size, int ref)\n{\n    cavs_vector *mvP = &h->mv[nP];\n    cavs_vector *mvA = &h->mv[nP-1];\n    cavs_vector *mvB = &h->mv[nP-4];\n    cavs_vector *mvC = &h->mv[nC];\n    const cavs_vector *mvP2 = NULL;\n    mvP->ref  = ref;\n    mvP->dist = h->dist[mvP->ref];\n    if (mvC->ref == NOT_AVAIL)\n        mvC = &h->mv[nP - 5];\n    if (mode == MV_PRED_PSKIP &&\n        (mvA->ref == NOT_AVAIL ||\n         mvB->ref == NOT_AVAIL ||\n         (mvA->x | mvA->y | mvA->ref) == 0 ||\n         (mvB->x | mvB->y | mvB->ref) == 0)) {\n        mvP2 = &un_mv;\n    } else if (mvA->ref >= 0 && mvB->ref < 0  && mvC->ref < 0) {\n        mvP2 = mvA;\n    } else if (mvA->ref < 0  && mvB->ref >= 0 && mvC->ref < 0) {\n        mvP2 = mvB;\n    } else if (mvA->ref < 0  && mvB->ref < 0  && mvC->ref >= 0) {\n        mvP2 = mvC;\n    } else if (mode == MV_PRED_LEFT     && mvA->ref == ref) {\n        mvP2 = mvA;\n    } else if (mode == MV_PRED_TOP      && mvB->ref == ref) {\n        mvP2 = mvB;\n    } else if (mode == MV_PRED_TOPRIGHT && mvC->ref == ref) {\n        mvP2 = mvC;\n    }\n    if (mvP2) {\n        mvP->x = mvP2->x;\n        mvP->y = mvP2->y;\n    } else\n        mv_pred_median(h, mvP, mvA, mvB, mvC);\n    if (mode < MV_PRED_PSKIP) {\n        mvP->x += get_se_golomb(&h->bc);\n        mvP->y += get_se_golomb(&h->bc);\n    }\n    set_mvs(mvP, size);\n}', 'static inline int get_se_golomb(BitstreamContext *bc)\n{\n    unsigned int buf;\n    buf = bitstream_peek(bc, 32);\n    if (buf >= (1 << 27)) {\n        buf >>= 32 - 9;\n        bitstream_skip(bc, ff_golomb_vlc_len[buf]);\n        return ff_se_golomb_vlc_code[buf];\n    } else {\n        int log = 2 * av_log2(buf) - 31;\n        buf >>= log;\n        bitstream_skip(bc, 32 - log);\n        if (buf & 1)\n            buf = -(buf >> 1);\n        else\n            buf = (buf >> 1);\n        return buf;\n    }\n}', 'static inline unsigned bitstream_peek(BitstreamContext *bc, unsigned n)\n{\n    if (n > bc->bits_left)\n        refill_32(bc);\n    return show_val(bc, n);\n}', 'static inline void refill_32(BitstreamContext *bc)\n{\n    if (bc->ptr >= bc->buffer_end)\n        return;\n#ifdef BITSTREAM_READER_LE\n    bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;\n#else\n    bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);\n#endif\n    bc->ptr       += 4;\n    bc->bits_left += 32;\n}']