libavformat/wc3movie.c:146: error: Integer Overflow L2
  ([-oo, 2147483639] + 776):signed32 by call to `av_append_packet`.

libavformat/wc3movie.c:101:28: Assignment
 99.     wc3->video_stream_index = wc3->audio_stream_index = 0;
100.     av_init_packet(&wc3->vpkt);
101.     wc3->vpkt.data = NULL; wc3->vpkt.size = 0;
                                ^
102. 
103.     /* skip the first 3 32-bit numbers */

libavformat/wc3movie.c:146:13: Call
144.             /* one of several palettes */
145.             url_fseek(pb, -8, SEEK_CUR);
146.             av_append_packet(pb, &wc3->vpkt, 8 + PALETTE_SIZE);
                 ^
147.             break;
148. 

libavformat/utils.c:342:1: Parameter `size`
  340. }
  341. 
  342. int av_append_packet(ByteIOContext *s, AVPacket *pkt, int size)
       ^
  343. {
  344.     int ret;

libavformat/utils.c:349:11: Call
  347.         return av_get_packet(s, pkt, size);
  348.     old_size = pkt->size;
  349.     ret = av_grow_packet(pkt, size);
                 ^
  350.     if (ret < 0)
  351.         return ret;

libavcodec/avpacket.c:75:1: <LHS trace>
73. }
74. 
75. int av_grow_packet(AVPacket *pkt, int grow_by)
    ^
76. {
77.     void *new_ptr;

libavcodec/avpacket.c:75:1: Parameter `grow_by`
    73. }
    74. 
    75. int av_grow_packet(AVPacket *pkt, int grow_by)
        ^
    76. {
    77.     void *new_ptr;

libavcodec/avpacket.c:75:1: <RHS trace>
73. }
74. 
75. int av_grow_packet(AVPacket *pkt, int grow_by)
    ^
76. {
77.     void *new_ptr;

libavcodec/avpacket.c:75:1: Parameter `grow_by`
    73. }
    74. 
    75. int av_grow_packet(AVPacket *pkt, int grow_by)
        ^
    76. {
    77.     void *new_ptr;

libavcodec/avpacket.c:83:15: Binary operation: ([-oo, 2147483639] + 776):signed32 by call to `av_append_packet` 
    81.     if ((unsigned)grow_by > INT_MAX - (pkt->size + FF_INPUT_BUFFER_PADDING_SIZE))
    82.         return -1;
    83.     new_ptr = av_realloc(pkt->data, pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE);
                      ^
    84.     if (!new_ptr)
    85.         return AVERROR(ENOMEM);

int av_grow_packet(AVPacket *pkt, int grow_by)
{
    void *new_ptr;
    av_assert0((unsigned)pkt->size <= INT_MAX - FF_INPUT_BUFFER_PADDING_SIZE);
    if (!pkt->size)
        return av_new_packet(pkt, grow_by);
    if ((unsigned)grow_by > INT_MAX - (pkt->size + FF_INPUT_BUFFER_PADDING_SIZE))
        return -1;
    new_ptr = av_realloc(pkt->data, pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE);
    if (!new_ptr)
        return AVERROR(ENOMEM);
    pkt->data = new_ptr;
    pkt->size += grow_by;
    memset(pkt->data + pkt->size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
    return 0;
}
['static int wc3_read_header(AVFormatContext *s,\n                           AVFormatParameters *ap)\n{\n    Wc3DemuxContext *wc3 = s->priv_data;\n    ByteIOContext *pb = s->pb;\n    unsigned int fourcc_tag;\n    unsigned int size;\n    AVStream *st;\n    int ret = 0;\n    char *buffer;\n    wc3->width = WC3_DEFAULT_WIDTH;\n    wc3->height = WC3_DEFAULT_HEIGHT;\n    wc3->pts = 0;\n    wc3->video_stream_index = wc3->audio_stream_index = 0;\n    av_init_packet(&wc3->vpkt);\n    wc3->vpkt.data = NULL; wc3->vpkt.size = 0;\n    url_fseek(pb, 12, SEEK_CUR);\n    fourcc_tag = get_le32(pb);\n    size = (get_be32(pb) + 1) & (~1);\n    do {\n        switch (fourcc_tag) {\n        case SOND_TAG:\n        case INDX_TAG:\n            url_fseek(pb, size, SEEK_CUR);\n            break;\n        case PC__TAG:\n            url_fseek(pb, 12, SEEK_CUR);\n            break;\n        case BNAM_TAG:\n            buffer = av_malloc(size+1);\n            if (!buffer)\n                return AVERROR(ENOMEM);\n            if ((ret = get_buffer(pb, buffer, size)) != size)\n                return AVERROR(EIO);\n            buffer[size] = 0;\n            av_metadata_set2(&s->metadata, "title", buffer,\n                                   AV_METADATA_DONT_STRDUP_VAL);\n            break;\n        case SIZE_TAG:\n            wc3->width  = get_le32(pb);\n            wc3->height = get_le32(pb);\n            break;\n        case PALT_TAG:\n            url_fseek(pb, -8, SEEK_CUR);\n            av_append_packet(pb, &wc3->vpkt, 8 + PALETTE_SIZE);\n            break;\n        default:\n            av_log(s, AV_LOG_ERROR, "  unrecognized WC3 chunk: %c%c%c%c (0x%02X%02X%02X%02X)\\n",\n                (uint8_t)fourcc_tag, (uint8_t)(fourcc_tag >> 8), (uint8_t)(fourcc_tag >> 16), (uint8_t)(fourcc_tag >> 24),\n                (uint8_t)fourcc_tag, (uint8_t)(fourcc_tag >> 8), (uint8_t)(fourcc_tag >> 16), (uint8_t)(fourcc_tag >> 24));\n            return AVERROR_INVALIDDATA;\n            break;\n        }\n        fourcc_tag = get_le32(pb);\n        size = (get_be32(pb) + 1) & (~1);\n        if (url_feof(pb))\n            return AVERROR(EIO);\n    } while (fourcc_tag != BRCH_TAG);\n    st = av_new_stream(s, 0);\n    if (!st)\n        return AVERROR(ENOMEM);\n    av_set_pts_info(st, 33, 1, WC3_FRAME_FPS);\n    wc3->video_stream_index = st->index;\n    st->codec->codec_type = AVMEDIA_TYPE_VIDEO;\n    st->codec->codec_id = CODEC_ID_XAN_WC3;\n    st->codec->codec_tag = 0;\n    st->codec->width = wc3->width;\n    st->codec->height = wc3->height;\n    st = av_new_stream(s, 0);\n    if (!st)\n        return AVERROR(ENOMEM);\n    av_set_pts_info(st, 33, 1, WC3_FRAME_FPS);\n    wc3->audio_stream_index = st->index;\n    st->codec->codec_type = AVMEDIA_TYPE_AUDIO;\n    st->codec->codec_id = CODEC_ID_PCM_S16LE;\n    st->codec->codec_tag = 1;\n    st->codec->channels = WC3_AUDIO_CHANNELS;\n    st->codec->bits_per_coded_sample = WC3_AUDIO_BITS;\n    st->codec->sample_rate = WC3_SAMPLE_RATE;\n    st->codec->bit_rate = st->codec->channels * st->codec->sample_rate *\n        st->codec->bits_per_coded_sample;\n    st->codec->block_align = WC3_AUDIO_BITS * WC3_AUDIO_CHANNELS;\n    return 0;\n}', 'int av_append_packet(ByteIOContext *s, AVPacket *pkt, int size)\n{\n    int ret;\n    int old_size;\n    if (!pkt->size)\n        return av_get_packet(s, pkt, size);\n    old_size = pkt->size;\n    ret = av_grow_packet(pkt, size);\n    if (ret < 0)\n        return ret;\n    ret = get_buffer(s, pkt->data + old_size, size);\n    av_shrink_packet(pkt, old_size + FFMAX(ret, 0));\n    return ret;\n}', 'int av_grow_packet(AVPacket *pkt, int grow_by)\n{\n    void *new_ptr;\n    av_assert0((unsigned)pkt->size <= INT_MAX - FF_INPUT_BUFFER_PADDING_SIZE);\n    if (!pkt->size)\n        return av_new_packet(pkt, grow_by);\n    if ((unsigned)grow_by > INT_MAX - (pkt->size + FF_INPUT_BUFFER_PADDING_SIZE))\n        return -1;\n    new_ptr = av_realloc(pkt->data, pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE);\n    if (!new_ptr)\n        return AVERROR(ENOMEM);\n    pkt->data = new_ptr;\n    pkt->size += grow_by;\n    memset(pkt->data + pkt->size, 0, FF_INPUT_BUFFER_PADDING_SIZE);\n    return 0;\n}']