libavformat/mxfdec.c:360: error: Integer Overflow L2
  ([-oo, 238609294] × 18):signed32.

libavformat/mxfdec.c:350:20: <LHS trace>
348. {
349.     MXFContext *mxf = arg;
350.     int item_num = avio_rb32(pb);
                        ^
351.     int item_len = avio_rb32(pb);
352. 

libavformat/mxfdec.c:350:20: Call
348. {
349.     MXFContext *mxf = arg;
350.     int item_num = avio_rb32(pb);
                        ^
351.     int item_len = avio_rb32(pb);
352. 

libavformat/aviobuf.c:656:11: Call
  654. {
  655.     unsigned int val;
  656.     val = avio_rb16(s) << 16;
                 ^
  657.     val |= avio_rb16(s);
  658.     return val;

libavformat/aviobuf.c:641:11: Call
    639. {
    640.     unsigned int val;
    641.     val = avio_r8(s) << 8;
                   ^
    642.     val |= avio_r8(s);
    643.     return val;

libavformat/aviobuf.c:524:5: Assignment
      522.     if (s->buf_ptr < s->buf_end)
      523.         return *s->buf_ptr++;
      524.     return 0;
               ^
      525. }
      526. 

libavformat/aviobuf.c:641:5: Assignment
    639. {
    640.     unsigned int val;
    641.     val = avio_r8(s) << 8;
             ^
    642.     val |= avio_r8(s);
    643.     return val;

libavformat/aviobuf.c:642:5: Assignment
    640.     unsigned int val;
    641.     val = avio_r8(s) << 8;
    642.     val |= avio_r8(s);
             ^
    643.     return val;
    644. }

libavformat/aviobuf.c:643:5: Assignment
    641.     val = avio_r8(s) << 8;
    642.     val |= avio_r8(s);
    643.     return val;
             ^
    644. }
    645. 

libavformat/aviobuf.c:656:5: Assignment
  654. {
  655.     unsigned int val;
  656.     val = avio_rb16(s) << 16;
           ^
  657.     val |= avio_rb16(s);
  658.     return val;

libavformat/aviobuf.c:657:5: Assignment
  655.     unsigned int val;
  656.     val = avio_rb16(s) << 16;
  657.     val |= avio_rb16(s);
           ^
  658.     return val;
  659. }

libavformat/aviobuf.c:658:5: Assignment
  656.     val = avio_rb16(s) << 16;
  657.     val |= avio_rb16(s);
  658.     return val;
           ^
  659. }
  660. 

libavformat/mxfdec.c:350:5: Assignment
348. {
349.     MXFContext *mxf = arg;
350.     int item_num = avio_rb32(pb);
         ^
351.     int item_len = avio_rb32(pb);
352. 

libavformat/mxfdec.c:351:20: <RHS trace>
349.     MXFContext *mxf = arg;
350.     int item_num = avio_rb32(pb);
351.     int item_len = avio_rb32(pb);
                        ^
352. 
353.     if (item_len != 18) {

libavformat/mxfdec.c:351:20: Call
349.     MXFContext *mxf = arg;
350.     int item_num = avio_rb32(pb);
351.     int item_len = avio_rb32(pb);
                        ^
352. 
353.     if (item_len != 18) {

libavformat/aviobuf.c:656:11: Call
  654. {
  655.     unsigned int val;
  656.     val = avio_rb16(s) << 16;
                 ^
  657.     val |= avio_rb16(s);
  658.     return val;

libavformat/aviobuf.c:641:11: Call
    639. {
    640.     unsigned int val;
    641.     val = avio_r8(s) << 8;
                   ^
    642.     val |= avio_r8(s);
    643.     return val;

libavformat/aviobuf.c:524:5: Assignment
      522.     if (s->buf_ptr < s->buf_end)
      523.         return *s->buf_ptr++;
      524.     return 0;
               ^
      525. }
      526. 

libavformat/aviobuf.c:641:5: Assignment
    639. {
    640.     unsigned int val;
    641.     val = avio_r8(s) << 8;
             ^
    642.     val |= avio_r8(s);
    643.     return val;

libavformat/aviobuf.c:642:5: Assignment
    640.     unsigned int val;
    641.     val = avio_r8(s) << 8;
    642.     val |= avio_r8(s);
             ^
    643.     return val;
    644. }

libavformat/aviobuf.c:643:5: Assignment
    641.     val = avio_r8(s) << 8;
    642.     val |= avio_r8(s);
    643.     return val;
             ^
    644. }
    645. 

libavformat/aviobuf.c:656:5: Assignment
  654. {
  655.     unsigned int val;
  656.     val = avio_rb16(s) << 16;
           ^
  657.     val |= avio_rb16(s);
  658.     return val;

libavformat/aviobuf.c:657:5: Assignment
  655.     unsigned int val;
  656.     val = avio_rb16(s) << 16;
  657.     val |= avio_rb16(s);
           ^
  658.     return val;
  659. }

libavformat/aviobuf.c:658:5: Assignment
  656.     val = avio_rb16(s) << 16;
  657.     val |= avio_rb16(s);
  658.     return val;
           ^
  659. }
  660. 

libavformat/mxfdec.c:351:5: Assignment
349.     MXFContext *mxf = arg;
350.     int item_num = avio_rb32(pb);
351.     int item_len = avio_rb32(pb);
         ^
352. 
353.     if (item_len != 18) {

libavformat/mxfdec.c:360:23: Binary operation: ([-oo, 238609294] × 18):signed32
358.         return -1;
359.     mxf->local_tags_count = item_num;
360.     mxf->local_tags = av_malloc(item_num*item_len);
                           ^
361.     if (!mxf->local_tags)
362.         return -1;

static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, UID uid)
{
    MXFContext *mxf = arg;
    int item_num = avio_rb32(pb);
    int item_len = avio_rb32(pb);
    if (item_len != 18) {
        av_log(mxf->fc, AV_LOG_ERROR, "unsupported primer pack item length\n");
        return -1;
    }
    if (item_num > UINT_MAX / item_len)
        return -1;
    mxf->local_tags_count = item_num;
    mxf->local_tags = av_malloc(item_num*item_len);
    if (!mxf->local_tags)
        return -1;
    avio_read(pb, mxf->local_tags, item_num*item_len);
    return 0;
}
['static int mxf_read_primer_pack(void *arg, AVIOContext *pb, int tag, int size, UID uid)\n{\n    MXFContext *mxf = arg;\n    int item_num = avio_rb32(pb);\n    int item_len = avio_rb32(pb);\n    if (item_len != 18) {\n        av_log(mxf->fc, AV_LOG_ERROR, "unsupported primer pack item length\\n");\n        return -1;\n    }\n    if (item_num > UINT_MAX / item_len)\n        return -1;\n    mxf->local_tags_count = item_num;\n    mxf->local_tags = av_malloc(item_num*item_len);\n    if (!mxf->local_tags)\n        return -1;\n    avio_read(pb, mxf->local_tags, item_num*item_len);\n    return 0;\n}', 'unsigned int avio_rb32(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rb16(s) << 16;\n    val |= avio_rb16(s);\n    return val;\n}', 'unsigned int avio_rb16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s) << 8;\n    val |= avio_r8(s);\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}']