libavformat/oggparsespeex.c:68: error: Integer Overflow L1
  (7405290916 + 8):signed32.

libavformat/oggparsespeex.c:57:9: <LHS trace>
55.         int frames_per_packet;
56.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
57.         st->codec->codec_id = CODEC_ID_SPEEX;
            ^
58. 
59.         st->codec->sample_rate = AV_RL32(p + 36);

libavformat/oggparsespeex.c:57:9: Assignment
55.         int frames_per_packet;
56.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
57.         st->codec->codec_id = CODEC_ID_SPEEX;
            ^
58. 
59.         st->codec->sample_rate = AV_RL32(p + 36);

libavformat/oggparsespeex.c:59:9: Assignment
57.         st->codec->codec_id = CODEC_ID_SPEEX;
58. 
59.         st->codec->sample_rate = AV_RL32(p + 36);
            ^
60.         st->codec->channels = AV_RL32(p + 48);
61. 

libavformat/oggparsespeex.c:60:9: Assignment
58. 
59.         st->codec->sample_rate = AV_RL32(p + 36);
60.         st->codec->channels = AV_RL32(p + 48);
            ^
61. 
62.         spxp->packet_size  = AV_RL32(p + 56);

libavformat/oggparsespeex.c:62:9: Assignment
60.         st->codec->channels = AV_RL32(p + 48);
61. 
62.         spxp->packet_size  = AV_RL32(p + 56);
            ^
63.         frames_per_packet  = AV_RL32(p + 64);
64.         if (frames_per_packet)

libavformat/oggparsespeex.c:65:13: Assignment
63.         frames_per_packet  = AV_RL32(p + 64);
64.         if (frames_per_packet)
65.             spxp->packet_size *= frames_per_packet;
                ^
66. 
67.         st->codec->extradata_size = os->psize;

libavformat/oggparsespeex.c:67:9: Assignment
65.             spxp->packet_size *= frames_per_packet;
66. 
67.         st->codec->extradata_size = os->psize;
            ^
68.         st->codec->extradata = av_malloc(st->codec->extradata_size
69.                                          + FF_INPUT_BUFFER_PADDING_SIZE);

libavformat/oggparsespeex.c:68:32: Binary operation: (7405290916 + 8):signed32
66. 
67.         st->codec->extradata_size = os->psize;
68.         st->codec->extradata = av_malloc(st->codec->extradata_size
                                   ^
69.                                          + FF_INPUT_BUFFER_PADDING_SIZE);
70.         memcpy(st->codec->extradata, p, st->codec->extradata_size);

static int speex_header(AVFormatContext *s, int idx) {
    struct ogg *ogg = s->priv_data;
    struct ogg_stream *os = ogg->streams + idx;
    struct speex_params *spxp = os->private;
    AVStream *st = s->streams[idx];
    uint8_t *p = os->buf + os->pstart;
    if (!spxp) {
        spxp = av_mallocz(sizeof(*spxp));
        os->private = spxp;
    }
    if (spxp->seq > 1)
        return 0;
    if (spxp->seq == 0) {
        int frames_per_packet;
        st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
        st->codec->codec_id = CODEC_ID_SPEEX;
        st->codec->sample_rate = AV_RL32(p + 36);
        st->codec->channels = AV_RL32(p + 48);
        spxp->packet_size  = AV_RL32(p + 56);
        frames_per_packet  = AV_RL32(p + 64);
        if (frames_per_packet)
            spxp->packet_size *= frames_per_packet;
        st->codec->extradata_size = os->psize;
        st->codec->extradata = av_malloc(st->codec->extradata_size
                                         + FF_INPUT_BUFFER_PADDING_SIZE);
        memcpy(st->codec->extradata, p, st->codec->extradata_size);
        av_set_pts_info(st, 64, 1, st->codec->sample_rate);
    } else
        ff_vorbis_comment(s, &st->metadata, p, os->psize);
    spxp->seq++;
    return 1;
}
['static int speex_header(AVFormatContext *s, int idx) {\n    struct ogg *ogg = s->priv_data;\n    struct ogg_stream *os = ogg->streams + idx;\n    struct speex_params *spxp = os->private;\n    AVStream *st = s->streams[idx];\n    uint8_t *p = os->buf + os->pstart;\n    if (!spxp) {\n        spxp = av_mallocz(sizeof(*spxp));\n        os->private = spxp;\n    }\n    if (spxp->seq > 1)\n        return 0;\n    if (spxp->seq == 0) {\n        int frames_per_packet;\n        st->codec->codec_type = AVMEDIA_TYPE_AUDIO;\n        st->codec->codec_id = CODEC_ID_SPEEX;\n        st->codec->sample_rate = AV_RL32(p + 36);\n        st->codec->channels = AV_RL32(p + 48);\n        spxp->packet_size  = AV_RL32(p + 56);\n        frames_per_packet  = AV_RL32(p + 64);\n        if (frames_per_packet)\n            spxp->packet_size *= frames_per_packet;\n        st->codec->extradata_size = os->psize;\n        st->codec->extradata = av_malloc(st->codec->extradata_size\n                                         + FF_INPUT_BUFFER_PADDING_SIZE);\n        memcpy(st->codec->extradata, p, st->codec->extradata_size);\n        av_set_pts_info(st, 64, 1, st->codec->sample_rate);\n    } else\n        ff_vorbis_comment(s, &st->metadata, p, os->psize);\n    spxp->seq++;\n    return 1;\n}']