libavformat/asfdec.c:400: error: Integer Overflow L2
  ([-oo, 4294967294] + 1):signed32 by call to `get_tag`.

libavformat/asfdec.c:395:20: Call
393.             int len1, len2, len3, len4, len5;
394. 
395.             len1 = get_le16(pb);
                        ^
396.             len2 = get_le16(pb);
397.             len3 = get_le16(pb);

libavformat/aviobuf.c:450:11: Call
  448. {
  449.     unsigned int val;
  450.     val = get_byte(s);
                 ^
  451.     val |= get_byte(s) << 8;
  452.     return val;

libavformat/aviobuf.c:360:13: Assignment
    358.             return *s->buf_ptr++;
    359.         else
    360.             return 0;
                     ^
    361.     }
    362. }

libavformat/aviobuf.c:450:5: Assignment
  448. {
  449.     unsigned int val;
  450.     val = get_byte(s);
           ^
  451.     val |= get_byte(s) << 8;
  452.     return val;

libavformat/aviobuf.c:451:5: Assignment
  449.     unsigned int val;
  450.     val = get_byte(s);
  451.     val |= get_byte(s) << 8;
           ^
  452.     return val;
  453. }

libavformat/aviobuf.c:452:5: Assignment
  450.     val = get_byte(s);
  451.     val |= get_byte(s) << 8;
  452.     return val;
           ^
  453. }
  454. 

libavformat/asfdec.c:395:13: Assignment
393.             int len1, len2, len3, len4, len5;
394. 
395.             len1 = get_le16(pb);
                 ^
396.             len2 = get_le16(pb);
397.             len3 = get_le16(pb);

libavformat/asfdec.c:400:13: Call
398.             len4 = get_le16(pb);
399.             len5 = get_le16(pb);
400.             get_tag(s, "title"    , 0, len1);
                 ^
401.             get_tag(s, "author"   , 0, len2);
402.             get_tag(s, "copyright", 0, len3);

libavformat/asfdec.c:153:1: <LHS trace>
151. }
152. 
153. static void get_tag(AVFormatContext *s, const char *key, int type, int len)
     ^
154. {
155.     char *value;

libavformat/asfdec.c:153:1: Parameter `len`
  151. }
  152. 
  153. static void get_tag(AVFormatContext *s, const char *key, int type, int len)
       ^
  154. {
  155.     char *value;

libavformat/asfdec.c:160:13: Binary operation: ([-oo, 4294967294] + 1):signed32 by call to `get_tag` 
  158.         return;
  159. 
  160.     value = av_malloc(len+1);
                   ^
  161.     if (!value)
  162.         return;

static void get_tag(AVFormatContext *s, const char *key, int type, int len)
{
    char *value;
    if ((unsigned)len >= UINT_MAX)
        return;
    value = av_malloc(len+1);
    if (!value)
        return;
    if (type <= 1) {
        get_str16_nolen(s->pb, len, value, len);
    } else if (type <= 5) {
        uint64_t num = get_value(s->pb, type);
        snprintf(value, len, "%"PRIu64, num);
    } else {
        url_fskip(s->pb, len);
        return;
    }
    if (!strncmp(key, "WM/", 3))
        key += 3;
    av_metadata_set2(&s->metadata, key, value, AV_METADATA_DONT_STRDUP_VAL);
}
['static int asf_read_header(AVFormatContext *s, AVFormatParameters *ap)\n{\n    ASFContext *asf = s->priv_data;\n    ff_asf_guid g;\n    ByteIOContext *pb = s->pb;\n    AVStream *st;\n    ASFStream *asf_st;\n    int size, i;\n    int64_t gsize;\n    AVRational dar[128];\n    uint32_t bitrate[128];\n    memset(dar, 0, sizeof(dar));\n    memset(bitrate, 0, sizeof(bitrate));\n    get_guid(pb, &g);\n    if (guidcmp(&g, &ff_asf_header))\n        return -1;\n    get_le64(pb);\n    get_le32(pb);\n    get_byte(pb);\n    get_byte(pb);\n    memset(&asf->asfid2avid, -1, sizeof(asf->asfid2avid));\n    for(;;) {\n        get_guid(pb, &g);\n        gsize = get_le64(pb);\n        dprintf(s, "%08"PRIx64": ", url_ftell(pb) - 24);\n        print_guid(&g);\n        dprintf(s, "  size=0x%"PRIx64"\\n", gsize);\n        if (!guidcmp(&g, &ff_asf_data_header)) {\n            asf->data_object_offset = url_ftell(pb);\n            if (!(asf->hdr.flags & 0x01) && gsize >= 100) {\n                asf->data_object_size = gsize - 24;\n            } else {\n                asf->data_object_size = (uint64_t)-1;\n            }\n            break;\n        }\n        if (gsize < 24)\n            return -1;\n        if (!guidcmp(&g, &ff_asf_file_header)) {\n            get_guid(pb, &asf->hdr.guid);\n            asf->hdr.file_size          = get_le64(pb);\n            asf->hdr.create_time        = get_le64(pb);\n            asf->nb_packets             = get_le64(pb);\n            asf->hdr.play_time          = get_le64(pb);\n            asf->hdr.send_time          = get_le64(pb);\n            asf->hdr.preroll            = get_le32(pb);\n            asf->hdr.ignore             = get_le32(pb);\n            asf->hdr.flags              = get_le32(pb);\n            asf->hdr.min_pktsize        = get_le32(pb);\n            asf->hdr.max_pktsize        = get_le32(pb);\n            asf->hdr.max_bitrate        = get_le32(pb);\n            s->packet_size = asf->hdr.max_pktsize;\n        } else if (!guidcmp(&g, &ff_asf_stream_header)) {\n            enum CodecType type;\n            int type_specific_size, sizeX;\n            uint64_t total_size;\n            unsigned int tag1;\n            int64_t pos1, pos2, start_time;\n            int test_for_ext_stream_audio, is_dvr_ms_audio=0;\n            pos1 = url_ftell(pb);\n            st = av_new_stream(s, 0);\n            if (!st)\n                return AVERROR(ENOMEM);\n            av_set_pts_info(st, 32, 1, 1000);\n            asf_st = av_mallocz(sizeof(ASFStream));\n            if (!asf_st)\n                return AVERROR(ENOMEM);\n            st->priv_data = asf_st;\n            start_time = asf->hdr.preroll;\n            asf_st->stream_language_index = 128;\n            if(!(asf->hdr.flags & 0x01)) {\n                st->duration = asf->hdr.play_time /\n                    (10000000 / 1000) - start_time;\n            }\n            get_guid(pb, &g);\n            test_for_ext_stream_audio = 0;\n            if (!guidcmp(&g, &ff_asf_audio_stream)) {\n                type = CODEC_TYPE_AUDIO;\n            } else if (!guidcmp(&g, &ff_asf_video_stream)) {\n                type = CODEC_TYPE_VIDEO;\n            } else if (!guidcmp(&g, &ff_asf_command_stream)) {\n                type = CODEC_TYPE_DATA;\n            } else if (!guidcmp(&g, &ff_asf_ext_stream_embed_stream_header)) {\n                test_for_ext_stream_audio = 1;\n                type = CODEC_TYPE_UNKNOWN;\n            } else {\n                return -1;\n            }\n            get_guid(pb, &g);\n            total_size = get_le64(pb);\n            type_specific_size = get_le32(pb);\n            get_le32(pb);\n            st->id = get_le16(pb) & 0x7f;\n            asf->asfid2avid[st->id] = s->nb_streams - 1;\n            get_le32(pb);\n            if (test_for_ext_stream_audio) {\n                get_guid(pb, &g);\n                if (!guidcmp(&g, &ff_asf_ext_stream_audio_stream)) {\n                    type = CODEC_TYPE_AUDIO;\n                    is_dvr_ms_audio=1;\n                    get_guid(pb, &g);\n                    get_le32(pb);\n                    get_le32(pb);\n                    get_le32(pb);\n                    get_guid(pb, &g);\n                    get_le32(pb);\n                }\n            }\n            st->codec->codec_type = type;\n            if (type == CODEC_TYPE_AUDIO) {\n                ff_get_wav_header(pb, st->codec, type_specific_size);\n                if (is_dvr_ms_audio) {\n                    st->codec->codec_id = CODEC_ID_PROBE;\n                    st->codec->codec_tag = 0;\n                }\n                if (st->codec->codec_id == CODEC_ID_AAC) {\n                    st->need_parsing = AVSTREAM_PARSE_NONE;\n                } else {\n                    st->need_parsing = AVSTREAM_PARSE_FULL;\n                }\n                pos2 = url_ftell(pb);\n                if (gsize >= (pos2 + 8 - pos1 + 24)) {\n                    asf_st->ds_span = get_byte(pb);\n                    asf_st->ds_packet_size = get_le16(pb);\n                    asf_st->ds_chunk_size = get_le16(pb);\n                    get_le16(pb);\n                    get_byte(pb);\n                }\n                if (asf_st->ds_span > 1) {\n                    if (!asf_st->ds_chunk_size\n                        || (asf_st->ds_packet_size/asf_st->ds_chunk_size <= 1)\n                        || asf_st->ds_packet_size % asf_st->ds_chunk_size)\n                        asf_st->ds_span = 0;\n                }\n                switch (st->codec->codec_id) {\n                case CODEC_ID_MP3:\n                    st->codec->frame_size = MPA_FRAME_SIZE;\n                    break;\n                case CODEC_ID_PCM_S16LE:\n                case CODEC_ID_PCM_S16BE:\n                case CODEC_ID_PCM_U16LE:\n                case CODEC_ID_PCM_U16BE:\n                case CODEC_ID_PCM_S8:\n                case CODEC_ID_PCM_U8:\n                case CODEC_ID_PCM_ALAW:\n                case CODEC_ID_PCM_MULAW:\n                    st->codec->frame_size = 1;\n                    break;\n                default:\n                    st->codec->frame_size = 1;\n                    break;\n                }\n            } else if (type == CODEC_TYPE_VIDEO) {\n                get_le32(pb);\n                get_le32(pb);\n                get_byte(pb);\n                size = get_le16(pb);\n                sizeX= get_le32(pb);\n                st->codec->width = get_le32(pb);\n                st->codec->height = get_le32(pb);\n                get_le16(pb);\n                st->codec->bits_per_coded_sample = get_le16(pb);\n                tag1 = get_le32(pb);\n                url_fskip(pb, 20);\n                size= sizeX;\n                if (size > 40) {\n                    st->codec->extradata_size = size - 40;\n                    st->codec->extradata = av_mallocz(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE);\n                    get_buffer(pb, st->codec->extradata, st->codec->extradata_size);\n                }\n                if (st->codec->extradata_size && (st->codec->bits_per_coded_sample <= 8)) {\n                    st->codec->palctrl = av_mallocz(sizeof(AVPaletteControl));\n#if HAVE_BIGENDIAN\n                    for (i = 0; i < FFMIN(st->codec->extradata_size, AVPALETTE_SIZE)/4; i++)\n                        st->codec->palctrl->palette[i] = bswap_32(((uint32_t*)st->codec->extradata)[i]);\n#else\n                    memcpy(st->codec->palctrl->palette, st->codec->extradata,\n                           FFMIN(st->codec->extradata_size, AVPALETTE_SIZE));\n#endif\n                    st->codec->palctrl->palette_changed = 1;\n                }\n                st->codec->codec_tag = tag1;\n                st->codec->codec_id = ff_codec_get_id(ff_codec_bmp_tags, tag1);\n                if(tag1 == MKTAG(\'D\', \'V\', \'R\', \' \'))\n                    st->need_parsing = AVSTREAM_PARSE_FULL;\n            }\n            pos2 = url_ftell(pb);\n            url_fskip(pb, gsize - (pos2 - pos1 + 24));\n        } else if (!guidcmp(&g, &ff_asf_comment_header)) {\n            int len1, len2, len3, len4, len5;\n            len1 = get_le16(pb);\n            len2 = get_le16(pb);\n            len3 = get_le16(pb);\n            len4 = get_le16(pb);\n            len5 = get_le16(pb);\n            get_tag(s, "title"    , 0, len1);\n            get_tag(s, "author"   , 0, len2);\n            get_tag(s, "copyright", 0, len3);\n            get_tag(s, "comment"  , 0, len4);\n            url_fskip(pb, len5);\n        } else if (!guidcmp(&g, &stream_bitrate_guid)) {\n            int stream_count = get_le16(pb);\n            int j;\n            for(j = 0; j < stream_count; j++) {\n                int flags, bitrate, stream_id;\n                flags= get_le16(pb);\n                bitrate= get_le32(pb);\n                stream_id= (flags & 0x7f);\n                asf->stream_bitrates[stream_id]= bitrate;\n            }\n        } else if (!guidcmp(&g, &ff_asf_language_guid)) {\n            int j;\n            int stream_count = get_le16(pb);\n            for(j = 0; j < stream_count; j++) {\n                char lang[6];\n                unsigned int lang_len = get_byte(pb);\n                get_str16_nolen(pb, lang_len, lang, sizeof(lang));\n                if (j < 128)\n                    av_strlcpy(asf->stream_languages[j], lang, sizeof(*asf->stream_languages));\n            }\n        } else if (!guidcmp(&g, &ff_asf_extended_content_header)) {\n            int desc_count, i;\n            desc_count = get_le16(pb);\n            for(i=0;i<desc_count;i++) {\n                    int name_len,value_type,value_len;\n                    char name[1024];\n                    name_len = get_le16(pb);\n                    get_str16_nolen(pb, name_len, name, sizeof(name));\n                    value_type = get_le16(pb);\n                    value_len  = get_le16(pb);\n                    get_tag(s, name, value_type, value_len);\n            }\n        } else if (!guidcmp(&g, &ff_asf_metadata_header)) {\n            int n, stream_num, name_len, value_len, value_type, value_num;\n            n = get_le16(pb);\n            for(i=0;i<n;i++) {\n                char name[1024];\n                get_le16(pb);\n                stream_num= get_le16(pb);\n                name_len=   get_le16(pb);\n                value_type= get_le16(pb);\n                value_len=  get_le32(pb);\n                get_str16_nolen(pb, name_len, name, sizeof(name));\n                value_num= get_le16(pb);\n                url_fskip(pb, value_len - 2);\n                if(stream_num<128){\n                    if     (!strcmp(name, "AspectRatioX")) dar[stream_num].num= value_num;\n                    else if(!strcmp(name, "AspectRatioY")) dar[stream_num].den= value_num;\n                }\n            }\n        } else if (!guidcmp(&g, &ff_asf_ext_stream_header)) {\n            int ext_len, payload_ext_ct, stream_ct;\n            uint32_t ext_d, leak_rate, stream_num;\n            unsigned int stream_languageid_index;\n            get_le64(pb);\n            get_le64(pb);\n            leak_rate = get_le32(pb);\n            get_le32(pb);\n            get_le32(pb);\n            get_le32(pb);\n            get_le32(pb);\n            get_le32(pb);\n            get_le32(pb);\n            get_le32(pb);\n            stream_num = get_le16(pb);\n            stream_languageid_index = get_le16(pb);\n            if (stream_num < 128)\n                asf->streams[stream_num].stream_language_index = stream_languageid_index;\n            get_le64(pb);\n            stream_ct = get_le16(pb);\n            payload_ext_ct = get_le16(pb);\n            if (stream_num < 128)\n                bitrate[stream_num] = leak_rate;\n            for (i=0; i<stream_ct; i++){\n                get_le16(pb);\n                ext_len = get_le16(pb);\n                url_fseek(pb, ext_len, SEEK_CUR);\n            }\n            for (i=0; i<payload_ext_ct; i++){\n                get_guid(pb, &g);\n                ext_d=get_le16(pb);\n                ext_len=get_le32(pb);\n                url_fseek(pb, ext_len, SEEK_CUR);\n            }\n        } else if (!guidcmp(&g, &ff_asf_head1_guid)) {\n            int v1, v2;\n            get_guid(pb, &g);\n            v1 = get_le32(pb);\n            v2 = get_le16(pb);\n#if 0\n        } else if (!guidcmp(&g, &ff_asf_codec_comment_header)) {\n            int len, v1, n, num;\n            char str[256], *q;\n            char tag[16];\n            get_guid(pb, &g);\n            print_guid(&g);\n            n = get_le32(pb);\n            for(i=0;i<n;i++) {\n                num = get_le16(pb);\n                get_str16(pb, str, sizeof(str));\n                get_str16(pb, str, sizeof(str));\n                len = get_le16(pb);\n                q = tag;\n                while (len > 0) {\n                    v1 = get_byte(pb);\n                    if ((q - tag) < sizeof(tag) - 1)\n                        *q++ = v1;\n                    len--;\n                }\n                *q = \'\\0\';\n            }\n#endif\n        } else if (url_feof(pb)) {\n            return -1;\n        } else {\n            if (!s->keylen) {\n                if (!guidcmp(&g, &ff_asf_content_encryption)) {\n                    av_log(s, AV_LOG_WARNING, "DRM protected stream detected, decoding will likely fail!\\n");\n                } else if (!guidcmp(&g, &ff_asf_ext_content_encryption)) {\n                    av_log(s, AV_LOG_WARNING, "Ext DRM protected stream detected, decoding will likely fail!\\n");\n                } else if (!guidcmp(&g, &ff_asf_digital_signature)) {\n                    av_log(s, AV_LOG_WARNING, "Digital signature detected, decoding will likely fail!\\n");\n                }\n            }\n            url_fseek(pb, gsize - 24, SEEK_CUR);\n        }\n    }\n    get_guid(pb, &g);\n    get_le64(pb);\n    get_byte(pb);\n    get_byte(pb);\n    if (url_feof(pb))\n        return -1;\n    asf->data_offset = url_ftell(pb);\n    asf->packet_size_left = 0;\n    for(i=0; i<128; i++){\n        int stream_num= asf->asfid2avid[i];\n        if(stream_num>=0){\n            AVStream *st = s->streams[stream_num];\n            if (!st->codec->bit_rate)\n                st->codec->bit_rate = bitrate[i];\n            if (dar[i].num > 0 && dar[i].den > 0)\n                av_reduce(&st->sample_aspect_ratio.num,\n                          &st->sample_aspect_ratio.den,\n                          dar[i].num, dar[i].den, INT_MAX);\n            if (asf->streams[i].stream_language_index < 128) {\n                const char *rfc1766 = asf->stream_languages[asf->streams[i].stream_language_index];\n                if (rfc1766 && strlen(rfc1766) > 1) {\n                    const char primary_tag[3] = { rfc1766[0], rfc1766[1], \'\\0\' };\n                    const char *iso6392 = av_convert_lang_to(primary_tag, AV_LANG_ISO639_2_BIBL);\n                    if (iso6392)\n                        av_metadata_set(&st->metadata, "language", iso6392);\n                }\n            }\n        }\n    }\n    return 0;\n}', 'unsigned int get_le16(ByteIOContext *s)\n{\n    unsigned int val;\n    val = get_byte(s);\n    val |= get_byte(s) << 8;\n    return val;\n}', 'int get_byte(ByteIOContext *s)\n{\n    if (s->buf_ptr < s->buf_end) {\n        return *s->buf_ptr++;\n    } else {\n        fill_buffer(s);\n        if (s->buf_ptr < s->buf_end)\n            return *s->buf_ptr++;\n        else\n            return 0;\n    }\n}', 'static void get_tag(AVFormatContext *s, const char *key, int type, int len)\n{\n    char *value;\n    if ((unsigned)len >= UINT_MAX)\n        return;\n    value = av_malloc(len+1);\n    if (!value)\n        return;\n    if (type <= 1) {\n        get_str16_nolen(s->pb, len, value, len);\n    } else if (type <= 5) {\n        uint64_t num = get_value(s->pb, type);\n        snprintf(value, len, "%"PRIu64, num);\n    } else {\n        url_fskip(s->pb, len);\n        return;\n    }\n    if (!strncmp(key, "WM/", 3))\n        key += 3;\n    av_metadata_set2(&s->metadata, key, value, AV_METADATA_DONT_STRDUP_VAL);\n}']