libavcodec/mpc8.c:353: error: Integer Overflow L1
  (0 - 510):unsigned32.

libavcodec/mpc8.c:252:16: <LHS trace>
250.     /* get output buffer */
251.     frame->nb_samples = MPC_FRAME_SIZE;
252.     if ((res = ff_get_buffer(avctx, frame, 0)) < 0) {
                    ^
253.         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
254.         return res;

libavcodec/mpc8.c:252:16: Call
250.     /* get output buffer */
251.     frame->nb_samples = MPC_FRAME_SIZE;
252.     if ((res = ff_get_buffer(avctx, frame, 0)) < 0) {
                    ^
253.         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
254.         return res;

libavcodec/decode.c:1144:9: Call
  1142. 
  1143.     if (ret < 0)
  1144.         av_frame_unref(frame);
                ^
  1145. 
  1146.     return ret;

libavutil/frame.c:310:5: Call
    308.     int i;
    309. 
    310.     wipe_side_data(frame);
             ^
    311. 
    312.     for (i = 0; i < FF_ARRAY_ELEMS(frame->buf); i++)

libavutil/frame.c:62:9: Call
      60. 
      61.     for (i = 0; i < frame->nb_side_data; i++) {
      62.         free_side_data(&frame->side_data[i]);
                  ^
      63.     }
      64.     frame->nb_side_data = 0;

libavutil/frame.c:53:5: Call
        51. 
        52.     av_freep(&sd->data);
        53.     av_dict_free(&sd->metadata);
                ^
        54.     av_freep(ptr_sd);
        55. }

libavutil/dict.c:186:5: Call
          184.         av_free(m->elems);
          185.     }
          186.     av_freep(pm);
                   ^
          187. }
          188. 

libavutil/mem.c:198:26: Assignment
            196. 
            197.     memcpy(&val, arg, sizeof(val));
            198.     memcpy(arg, &(void *){ NULL }, sizeof(val));
                                          ^
            199.     av_free(val);
            200. }

libavcodec/mpc8.c:353:42: Call
351.             case -1:
352.                 for(j = 0; j < SAMPLES_PER_BAND; j++)
353.                     c->Q[ch][off + j] = (av_lfg_get(&c->rnd) & 0x3FC) - 510;
                                              ^
354.                 break;
355.             case 0:

libavutil/lfg.h:38:1: Parameter `c->state[*]`
  36.  * it may be good enough and faster for your specific use case.
  37.  */
  38. static inline unsigned int av_lfg_get(AVLFG *c){
      ^
  39.     c->state[c->index & 63] = c->state[(c->index-24) & 63] + c->state[(c->index-55) & 63];
  40.     return c->state[c->index++ & 63];

libavutil/lfg.h:40:5: Assignment
  38. static inline unsigned int av_lfg_get(AVLFG *c){
  39.     c->state[c->index & 63] = c->state[(c->index-24) & 63] + c->state[(c->index-55) & 63];
  40.     return c->state[c->index++ & 63];
          ^
  41. }
  42. 

libavcodec/mpc8.c:353:21: Binary operation: (0 - 510):unsigned32
351.             case -1:
352.                 for(j = 0; j < SAMPLES_PER_BAND; j++)
353.                     c->Q[ch][off + j] = (av_lfg_get(&c->rnd) & 0x3FC) - 510;
                         ^
354.                 break;
355.             case 0:

static int mpc8_decode_frame(AVCodecContext * avctx, void *data,
                             int *got_frame_ptr, AVPacket *avpkt)
{
    AVFrame *frame     = data;
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    MPCContext *c = avctx->priv_data;
    BitstreamContext bc2, *bc = &bc2;
    int i, j, k, ch, cnt, res, t;
    Band *bands = c->bands;
    int off;
    int maxband, keyframe;
    int last[2];
    frame->nb_samples = MPC_FRAME_SIZE;
    if ((res = ff_get_buffer(avctx, frame, 0)) < 0) {
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        return res;
    }
    keyframe = c->cur_frame == 0;
    if(keyframe){
        memset(c->Q, 0, sizeof(c->Q));
        c->last_bits_used = 0;
    }
    bitstream_init8(bc, buf, buf_size);
    bitstream_skip(bc, c->last_bits_used & 7);
    if(keyframe)
        maxband = mpc8_get_mod_golomb(bc, c->maxbands + 1);
    else{
        maxband = c->last_max_band + bitstream_read_vlc(bc, band_vlc.table, MPC8_BANDS_BITS, 2);
        if(maxband > 32) maxband -= 33;
    }
    if(maxband > c->maxbands + 1)
        return AVERROR_INVALIDDATA;
    c->last_max_band = maxband;
    if(maxband){
        last[0] = last[1] = 0;
        for(i = maxband - 1; i >= 0; i--){
            for(ch = 0; ch < 2; ch++){
                last[ch] = bitstream_read_vlc(bc, res_vlc[last[ch] > 2].table, MPC8_RES_BITS, 2) + last[ch];
                if(last[ch] > 15) last[ch] -= 17;
                bands[i].res[ch] = last[ch];
            }
        }
        if(c->MSS){
            int mask;
            cnt = 0;
            for(i = 0; i < maxband; i++)
                if(bands[i].res[0] || bands[i].res[1])
                    cnt++;
            t = mpc8_get_mod_golomb(bc, cnt);
            mask = mpc8_get_mask(bc, cnt, t);
            for(i = maxband - 1; i >= 0; i--)
                if(bands[i].res[0] || bands[i].res[1]){
                    bands[i].msf = mask & 1;
                    mask >>= 1;
                }
        }
    }
    for(i = maxband; i < c->maxbands; i++)
        bands[i].res[0] = bands[i].res[1] = 0;
    if(keyframe){
        for(i = 0; i < 32; i++)
            c->oldDSCF[0][i] = c->oldDSCF[1][i] = 1;
    }
    for(i = 0; i < maxband; i++){
        if(bands[i].res[0] || bands[i].res[1]){
            cnt = !!bands[i].res[0] + !!bands[i].res[1] - 1;
            if(cnt >= 0){
                t = bitstream_read_vlc(bc, scfi_vlc[cnt].table, scfi_vlc[cnt].bits, 1);
                if(bands[i].res[0]) bands[i].scfi[0] = t >> (2 * cnt);
                if(bands[i].res[1]) bands[i].scfi[1] = t & 3;
            }
        }
    }
    for(i = 0; i < maxband; i++){
        for(ch = 0; ch < 2; ch++){
            if(!bands[i].res[ch]) continue;
            if(c->oldDSCF[ch][i]){
                bands[i].scf_idx[ch][0] = bitstream_read(bc, 7) - 6;
                c->oldDSCF[ch][i] = 0;
            }else{
                t = bitstream_read_vlc(bc, dscf_vlc[1].table, MPC8_DSCF1_BITS, 2);
                if(t == 64)
                    t += bitstream_read(bc, 6);
                bands[i].scf_idx[ch][0] = ((bands[i].scf_idx[ch][2] + t - 25) & 0x7F) - 6;
            }
            for(j = 0; j < 2; j++){
                if((bands[i].scfi[ch] << j) & 2)
                    bands[i].scf_idx[ch][j + 1] = bands[i].scf_idx[ch][j];
                else{
                    t = bitstream_read_vlc(bc, dscf_vlc[0].table, MPC8_DSCF0_BITS, 2);
                    if(t == 31)
                        t = 64 + bitstream_read(bc, 6);
                    bands[i].scf_idx[ch][j + 1] = ((bands[i].scf_idx[ch][j] + t - 25) & 0x7F) - 6;
                }
            }
        }
    }
    for(i = 0, off = 0; i < maxband; i++, off += SAMPLES_PER_BAND){
        for(ch = 0; ch < 2; ch++){
            res = bands[i].res[ch];
            switch(res){
            case -1:
                for(j = 0; j < SAMPLES_PER_BAND; j++)
                    c->Q[ch][off + j] = (av_lfg_get(&c->rnd) & 0x3FC) - 510;
                break;
            case 0:
                break;
            case 1:
                for(j = 0; j < SAMPLES_PER_BAND; j += SAMPLES_PER_BAND / 2){
                    cnt = bitstream_read_vlc(bc, q1_vlc.table, MPC8_Q1_BITS, 2);
                    t = mpc8_get_mask(bc, 18, cnt);
                    for(k = 0; k < SAMPLES_PER_BAND / 2; k++, t <<= 1)
                        c->Q[ch][off + j + k] = (t & 0x20000) ? (bitstream_read_bit(bc) << 1) - 1 : 0;
                }
                break;
            case 2:
                cnt = 6;
                for(j = 0; j < SAMPLES_PER_BAND; j += 3){
                    t = bitstream_read_vlc(bc, q2_vlc[cnt > 3].table, MPC8_Q2_BITS, 2);
                    c->Q[ch][off + j + 0] = mpc8_idx50[t];
                    c->Q[ch][off + j + 1] = mpc8_idx51[t];
                    c->Q[ch][off + j + 2] = mpc8_idx52[t];
                    cnt = (cnt >> 1) + mpc8_huffq2[t];
                }
                break;
            case 3:
            case 4:
                for(j = 0; j < SAMPLES_PER_BAND; j += 2){
                    t = bitstream_read_vlc(bc, q3_vlc[res - 3].table, MPC8_Q3_BITS, 2) + q3_offsets[res - 3];
                    c->Q[ch][off + j + 1] = t >> 4;
                    c->Q[ch][off + j + 0] = (t & 8) ? (t & 0xF) - 16 : (t & 0xF);
                }
                break;
            case 5:
            case 6:
            case 7:
            case 8:
                cnt = 2 * mpc8_thres[res];
                for(j = 0; j < SAMPLES_PER_BAND; j++){
                    t = bitstream_read_vlc(bc, quant_vlc[res - 5][cnt > mpc8_thres[res]].table, quant_vlc[res - 5][cnt > mpc8_thres[res]].bits, 2) + quant_offsets[res - 5];
                    c->Q[ch][off + j] = t;
                    cnt = (cnt >> 1) + FFABS(c->Q[ch][off + j]);
                }
                break;
            default:
                for(j = 0; j < SAMPLES_PER_BAND; j++){
                    c->Q[ch][off + j] = bitstream_read_vlc(bc, q9up_vlc.table, MPC8_Q9UP_BITS, 2);
                    if(res != 9){
                        c->Q[ch][off + j] <<= res - 9;
                        c->Q[ch][off + j] |= bitstream_read(bc, res - 9);
                    }
                    c->Q[ch][off + j] -= (1 << (res - 2)) - 1;
                }
            }
        }
    }
    ff_mpc_dequantize_and_synth(c, maxband - 1,
                                (int16_t **)frame->extended_data,
                                avctx->channels);
    c->cur_frame++;
    c->last_bits_used = bitstream_tell(bc);
    if (bitstream_bits_left(bc) < 8)
        c->last_bits_used = buf_size << 3;
    if(c->cur_frame >= c->frames)
        c->cur_frame = 0;
    *got_frame_ptr = 1;
    return c->cur_frame ? c->last_bits_used >> 3 : buf_size;
}
['static int mpc8_decode_frame(AVCodecContext * avctx, void *data,\n                             int *got_frame_ptr, AVPacket *avpkt)\n{\n    AVFrame *frame     = data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    MPCContext *c = avctx->priv_data;\n    BitstreamContext bc2, *bc = &bc2;\n    int i, j, k, ch, cnt, res, t;\n    Band *bands = c->bands;\n    int off;\n    int maxband, keyframe;\n    int last[2];\n    frame->nb_samples = MPC_FRAME_SIZE;\n    if ((res = ff_get_buffer(avctx, frame, 0)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return res;\n    }\n    keyframe = c->cur_frame == 0;\n    if(keyframe){\n        memset(c->Q, 0, sizeof(c->Q));\n        c->last_bits_used = 0;\n    }\n    bitstream_init8(bc, buf, buf_size);\n    bitstream_skip(bc, c->last_bits_used & 7);\n    if(keyframe)\n        maxband = mpc8_get_mod_golomb(bc, c->maxbands + 1);\n    else{\n        maxband = c->last_max_band + bitstream_read_vlc(bc, band_vlc.table, MPC8_BANDS_BITS, 2);\n        if(maxband > 32) maxband -= 33;\n    }\n    if(maxband > c->maxbands + 1)\n        return AVERROR_INVALIDDATA;\n    c->last_max_band = maxband;\n    if(maxband){\n        last[0] = last[1] = 0;\n        for(i = maxband - 1; i >= 0; i--){\n            for(ch = 0; ch < 2; ch++){\n                last[ch] = bitstream_read_vlc(bc, res_vlc[last[ch] > 2].table, MPC8_RES_BITS, 2) + last[ch];\n                if(last[ch] > 15) last[ch] -= 17;\n                bands[i].res[ch] = last[ch];\n            }\n        }\n        if(c->MSS){\n            int mask;\n            cnt = 0;\n            for(i = 0; i < maxband; i++)\n                if(bands[i].res[0] || bands[i].res[1])\n                    cnt++;\n            t = mpc8_get_mod_golomb(bc, cnt);\n            mask = mpc8_get_mask(bc, cnt, t);\n            for(i = maxband - 1; i >= 0; i--)\n                if(bands[i].res[0] || bands[i].res[1]){\n                    bands[i].msf = mask & 1;\n                    mask >>= 1;\n                }\n        }\n    }\n    for(i = maxband; i < c->maxbands; i++)\n        bands[i].res[0] = bands[i].res[1] = 0;\n    if(keyframe){\n        for(i = 0; i < 32; i++)\n            c->oldDSCF[0][i] = c->oldDSCF[1][i] = 1;\n    }\n    for(i = 0; i < maxband; i++){\n        if(bands[i].res[0] || bands[i].res[1]){\n            cnt = !!bands[i].res[0] + !!bands[i].res[1] - 1;\n            if(cnt >= 0){\n                t = bitstream_read_vlc(bc, scfi_vlc[cnt].table, scfi_vlc[cnt].bits, 1);\n                if(bands[i].res[0]) bands[i].scfi[0] = t >> (2 * cnt);\n                if(bands[i].res[1]) bands[i].scfi[1] = t & 3;\n            }\n        }\n    }\n    for(i = 0; i < maxband; i++){\n        for(ch = 0; ch < 2; ch++){\n            if(!bands[i].res[ch]) continue;\n            if(c->oldDSCF[ch][i]){\n                bands[i].scf_idx[ch][0] = bitstream_read(bc, 7) - 6;\n                c->oldDSCF[ch][i] = 0;\n            }else{\n                t = bitstream_read_vlc(bc, dscf_vlc[1].table, MPC8_DSCF1_BITS, 2);\n                if(t == 64)\n                    t += bitstream_read(bc, 6);\n                bands[i].scf_idx[ch][0] = ((bands[i].scf_idx[ch][2] + t - 25) & 0x7F) - 6;\n            }\n            for(j = 0; j < 2; j++){\n                if((bands[i].scfi[ch] << j) & 2)\n                    bands[i].scf_idx[ch][j + 1] = bands[i].scf_idx[ch][j];\n                else{\n                    t = bitstream_read_vlc(bc, dscf_vlc[0].table, MPC8_DSCF0_BITS, 2);\n                    if(t == 31)\n                        t = 64 + bitstream_read(bc, 6);\n                    bands[i].scf_idx[ch][j + 1] = ((bands[i].scf_idx[ch][j] + t - 25) & 0x7F) - 6;\n                }\n            }\n        }\n    }\n    for(i = 0, off = 0; i < maxband; i++, off += SAMPLES_PER_BAND){\n        for(ch = 0; ch < 2; ch++){\n            res = bands[i].res[ch];\n            switch(res){\n            case -1:\n                for(j = 0; j < SAMPLES_PER_BAND; j++)\n                    c->Q[ch][off + j] = (av_lfg_get(&c->rnd) & 0x3FC) - 510;\n                break;\n            case 0:\n                break;\n            case 1:\n                for(j = 0; j < SAMPLES_PER_BAND; j += SAMPLES_PER_BAND / 2){\n                    cnt = bitstream_read_vlc(bc, q1_vlc.table, MPC8_Q1_BITS, 2);\n                    t = mpc8_get_mask(bc, 18, cnt);\n                    for(k = 0; k < SAMPLES_PER_BAND / 2; k++, t <<= 1)\n                        c->Q[ch][off + j + k] = (t & 0x20000) ? (bitstream_read_bit(bc) << 1) - 1 : 0;\n                }\n                break;\n            case 2:\n                cnt = 6;\n                for(j = 0; j < SAMPLES_PER_BAND; j += 3){\n                    t = bitstream_read_vlc(bc, q2_vlc[cnt > 3].table, MPC8_Q2_BITS, 2);\n                    c->Q[ch][off + j + 0] = mpc8_idx50[t];\n                    c->Q[ch][off + j + 1] = mpc8_idx51[t];\n                    c->Q[ch][off + j + 2] = mpc8_idx52[t];\n                    cnt = (cnt >> 1) + mpc8_huffq2[t];\n                }\n                break;\n            case 3:\n            case 4:\n                for(j = 0; j < SAMPLES_PER_BAND; j += 2){\n                    t = bitstream_read_vlc(bc, q3_vlc[res - 3].table, MPC8_Q3_BITS, 2) + q3_offsets[res - 3];\n                    c->Q[ch][off + j + 1] = t >> 4;\n                    c->Q[ch][off + j + 0] = (t & 8) ? (t & 0xF) - 16 : (t & 0xF);\n                }\n                break;\n            case 5:\n            case 6:\n            case 7:\n            case 8:\n                cnt = 2 * mpc8_thres[res];\n                for(j = 0; j < SAMPLES_PER_BAND; j++){\n                    t = bitstream_read_vlc(bc, quant_vlc[res - 5][cnt > mpc8_thres[res]].table, quant_vlc[res - 5][cnt > mpc8_thres[res]].bits, 2) + quant_offsets[res - 5];\n                    c->Q[ch][off + j] = t;\n                    cnt = (cnt >> 1) + FFABS(c->Q[ch][off + j]);\n                }\n                break;\n            default:\n                for(j = 0; j < SAMPLES_PER_BAND; j++){\n                    c->Q[ch][off + j] = bitstream_read_vlc(bc, q9up_vlc.table, MPC8_Q9UP_BITS, 2);\n                    if(res != 9){\n                        c->Q[ch][off + j] <<= res - 9;\n                        c->Q[ch][off + j] |= bitstream_read(bc, res - 9);\n                    }\n                    c->Q[ch][off + j] -= (1 << (res - 2)) - 1;\n                }\n            }\n        }\n    }\n    ff_mpc_dequantize_and_synth(c, maxband - 1,\n                                (int16_t **)frame->extended_data,\n                                avctx->channels);\n    c->cur_frame++;\n    c->last_bits_used = bitstream_tell(bc);\n    if (bitstream_bits_left(bc) < 8)\n        c->last_bits_used = buf_size << 3;\n    if(c->cur_frame >= c->frames)\n        c->cur_frame = 0;\n    *got_frame_ptr = 1;\n    return c->cur_frame ? c->last_bits_used >> 3 : buf_size;\n}', 'int ff_get_buffer(AVCodecContext *avctx, AVFrame *frame, int flags)\n{\n    const AVHWAccel *hwaccel = avctx->hwaccel;\n    int override_dimensions = 1;\n    int ret;\n    switch (avctx->codec_type) {\n    case AVMEDIA_TYPE_VIDEO:\n        if (frame->width <= 0 || frame->height <= 0) {\n            frame->width  = FFMAX(avctx->width, avctx->coded_width);\n            frame->height = FFMAX(avctx->height, avctx->coded_height);\n            override_dimensions = 0;\n        }\n        if (frame->format < 0)\n            frame->format              = avctx->pix_fmt;\n        if (!frame->sample_aspect_ratio.num)\n            frame->sample_aspect_ratio = avctx->sample_aspect_ratio;\n        if (av_image_check_sar(frame->width, frame->height,\n                               frame->sample_aspect_ratio) < 0) {\n            av_log(avctx, AV_LOG_WARNING, "ignoring invalid SAR: %u/%u\\n",\n                   frame->sample_aspect_ratio.num,\n                   frame->sample_aspect_ratio.den);\n            frame->sample_aspect_ratio = (AVRational){ 0, 1 };\n        }\n        if ((ret = av_image_check_size(avctx->width, avctx->height, 0, avctx)) < 0)\n            return ret;\n        break;\n    case AVMEDIA_TYPE_AUDIO:\n        if (!frame->sample_rate)\n            frame->sample_rate    = avctx->sample_rate;\n        if (frame->format < 0)\n            frame->format         = avctx->sample_fmt;\n        if (!frame->channel_layout) {\n            if (avctx->channel_layout) {\n                 if (av_get_channel_layout_nb_channels(avctx->channel_layout) !=\n                     avctx->channels) {\n                     av_log(avctx, AV_LOG_ERROR, "Inconsistent channel "\n                            "configuration.\\n");\n                     return AVERROR(EINVAL);\n                 }\n                frame->channel_layout = avctx->channel_layout;\n            } else {\n                if (avctx->channels > FF_SANE_NB_CHANNELS) {\n                    av_log(avctx, AV_LOG_ERROR, "Too many channels: %d.\\n",\n                           avctx->channels);\n                    return AVERROR(ENOSYS);\n                }\n                frame->channel_layout = av_get_default_channel_layout(avctx->channels);\n                if (!frame->channel_layout)\n                    frame->channel_layout = (1ULL << avctx->channels) - 1;\n            }\n        }\n        break;\n    default: return AVERROR(EINVAL);\n    }\n    ret = ff_decode_frame_props(avctx, frame);\n    if (ret < 0)\n        return ret;\n    if (hwaccel) {\n        if (hwaccel->alloc_frame) {\n            ret = hwaccel->alloc_frame(avctx, frame);\n            goto end;\n        }\n    } else\n        avctx->sw_pix_fmt = avctx->pix_fmt;\n    ret = avctx->get_buffer2(avctx, frame, flags);\n    if (ret < 0)\n        goto end;\n    ret = attach_decode_data(frame);\n    if (ret < 0)\n        goto end;\nend:\n    if (avctx->codec_type == AVMEDIA_TYPE_VIDEO && !override_dimensions &&\n        !(avctx->codec->caps_internal & FF_CODEC_CAP_EXPORTS_CROPPING)) {\n        frame->width  = avctx->width;\n        frame->height = avctx->height;\n    }\n    if (ret < 0)\n        av_frame_unref(frame);\n    return ret;\n}', 'void av_frame_unref(AVFrame *frame)\n{\n    int i;\n    wipe_side_data(frame);\n    for (i = 0; i < FF_ARRAY_ELEMS(frame->buf); i++)\n        av_buffer_unref(&frame->buf[i]);\n    for (i = 0; i < frame->nb_extended_buf; i++)\n        av_buffer_unref(&frame->extended_buf[i]);\n    av_freep(&frame->extended_buf);\n    av_buffer_unref(&frame->hw_frames_ctx);\n    av_buffer_unref(&frame->opaque_ref);\n    get_frame_defaults(frame);\n}', 'static void wipe_side_data(AVFrame *frame)\n{\n    int i;\n    for (i = 0; i < frame->nb_side_data; i++) {\n        free_side_data(&frame->side_data[i]);\n    }\n    frame->nb_side_data = 0;\n    av_freep(&frame->side_data);\n}', 'static void free_side_data(AVFrameSideData **ptr_sd)\n{\n    AVFrameSideData *sd = *ptr_sd;\n    av_freep(&sd->data);\n    av_dict_free(&sd->metadata);\n    av_freep(ptr_sd);\n}', 'void av_dict_free(AVDictionary **pm)\n{\n    AVDictionary *m = *pm;\n    if (m) {\n        while (m->count--) {\n            av_free(m->elems[m->count].key);\n            av_free(m->elems[m->count].value);\n        }\n        av_free(m->elems);\n    }\n    av_freep(pm);\n}', 'void av_freep(void *arg)\n{\n    void *val;\n    memcpy(&val, arg, sizeof(val));\n    memcpy(arg, &(void *){ NULL }, sizeof(val));\n    av_free(val);\n}', 'static inline unsigned int av_lfg_get(AVLFG *c){\n    c->state[c->index & 63] = c->state[(c->index-24) & 63] + c->state[(c->index-55) & 63];\n    return c->state[c->index++ & 63];\n}']