libavcodec/flashsv.c:390: error: Integer Overflow L2
  ([1, +oo] - 2):unsigned32 by call to `bitstream_read`.

libavcodec/flashsv.c:390:37: Call
388.             if (s->ver == 2 && size) {
389.                 bitstream_skip(&bc, 3);
390.                 s->color_depth    = bitstream_read(&bc, 2);
                                         ^
391.                 has_diff          = bitstream_read_bit(&bc);
392.                 s->zlibprime_curr = bitstream_read_bit(&bc);

libavcodec/bitstream.h:183:1: Parameter `n`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/bitstream.h:194:12: Call
  192.     }
  193. 
  194.     return get_val(bc, n);
                  ^
  195. }
  196. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([1, +oo] - 2):unsigned32 by call to `bitstream_read` 
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int flashsv_decode_frame(AVCodecContext *avctx, void *data,\n                                int *got_frame, AVPacket *avpkt)\n{\n    int buf_size = avpkt->size;\n    FlashSVContext *s = avctx->priv_data;\n    int h_blocks, v_blocks, h_part, v_part, i, j, ret;\n    BitstreamContext bc;\n    if (buf_size == 0)\n        return 0;\n    if (buf_size < 4)\n        return -1;\n    bitstream_init(&bc, avpkt->data, buf_size * 8);\n    s->block_width  = 16 * (bitstream_read(&bc, 4) + 1);\n    s->image_width  = bitstream_read(&bc, 12);\n    s->block_height = 16 * (bitstream_read(&bc, 4) + 1);\n    s->image_height = bitstream_read(&bc, 12);\n    if (s->ver == 2) {\n        bitstream_skip(&bc, 6);\n        if (bitstream_read_bit(&bc)) {\n            avpriv_request_sample(avctx, "iframe");\n            return AVERROR_PATCHWELCOME;\n        }\n        if (bitstream_read_bit(&bc)) {\n            avpriv_request_sample(avctx, "Custom palette");\n            return AVERROR_PATCHWELCOME;\n        }\n    }\n    h_blocks = s->image_width  / s->block_width;\n    h_part   = s->image_width  % s->block_width;\n    v_blocks = s->image_height / s->block_height;\n    v_part   = s->image_height % s->block_height;\n    if (s->block_size < s->block_width * s->block_height) {\n        int tmpblock_size = 3 * s->block_width * s->block_height, err;\n        if ((err = av_reallocp(&s->tmpblock, tmpblock_size)) < 0) {\n            s->block_size = 0;\n            av_log(avctx, AV_LOG_ERROR,\n                   "Cannot allocate decompression buffer.\\n");\n            return err;\n        }\n        if (s->ver == 2) {\n            s->deflate_block_size = calc_deflate_block_size(tmpblock_size);\n            if (s->deflate_block_size <= 0) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Cannot determine deflate buffer size.\\n");\n                return -1;\n            }\n            if ((err = av_reallocp(&s->deflate_block, s->deflate_block_size)) < 0) {\n                s->block_size = 0;\n                av_log(avctx, AV_LOG_ERROR, "Cannot allocate deflate buffer.\\n");\n                return err;\n            }\n        }\n    }\n    s->block_size = s->block_width * s->block_height;\n    if (avctx->width == 0 && avctx->height == 0) {\n        avctx->width  = s->image_width;\n        avctx->height = s->image_height;\n    }\n    if (avctx->width != s->image_width || avctx->height != s->image_height) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Frame width or height differs from first frame!\\n");\n        av_log(avctx, AV_LOG_ERROR, "fh = %d, fv %d  vs  ch = %d, cv = %d\\n",\n               avctx->height, avctx->width, s->image_height, s->image_width);\n        return AVERROR_INVALIDDATA;\n    }\n    s->is_keyframe = (avpkt->flags & AV_PKT_FLAG_KEY) && (s->ver == 2);\n    if (s->is_keyframe) {\n        int err;\n        int nb_blocks = (v_blocks + !!v_part) *\n                        (h_blocks + !!h_part) * sizeof(s->blocks[0]);\n        if ((err = av_reallocp(&s->keyframedata, avpkt->size)) < 0)\n            return err;\n        memcpy(s->keyframedata, avpkt->data, avpkt->size);\n        if ((err = av_reallocp(&s->blocks, nb_blocks)) < 0)\n            return err;\n        memset(s->blocks, 0, nb_blocks);\n    }\n    ff_dlog(avctx, "image: %dx%d block: %dx%d num: %dx%d part: %dx%d\\n",\n            s->image_width, s->image_height, s->block_width, s->block_height,\n            h_blocks, v_blocks, h_part, v_part);\n    if ((ret = ff_reget_buffer(avctx, s->frame)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\\n");\n        return ret;\n    }\n    for (j = 0; j < v_blocks + (v_part ? 1 : 0); j++) {\n        int y_pos  = j * s->block_height;\n        int cur_blk_height = (j < v_blocks) ? s->block_height : v_part;\n        for (i = 0; i < h_blocks + (h_part ? 1 : 0); i++) {\n            int x_pos = i * s->block_width;\n            int cur_blk_width = (i < h_blocks) ? s->block_width : h_part;\n            int has_diff = 0;\n            int size = bitstream_read(&bc, 16);\n            s->color_depth    = 0;\n            s->zlibprime_curr = 0;\n            s->zlibprime_prev = 0;\n            s->diff_start     = 0;\n            s->diff_height    = cur_blk_height;\n            if (8 * size > bitstream_bits_left(&bc)) {\n                av_frame_unref(s->frame);\n                return AVERROR_INVALIDDATA;\n            }\n            if (s->ver == 2 && size) {\n                bitstream_skip(&bc, 3);\n                s->color_depth    = bitstream_read(&bc, 2);\n                has_diff          = bitstream_read_bit(&bc);\n                s->zlibprime_curr = bitstream_read_bit(&bc);\n                s->zlibprime_prev = bitstream_read_bit(&bc);\n                if (s->color_depth != 0 && s->color_depth != 2) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "%dx%d invalid color depth %d\\n",\n                           i, j, s->color_depth);\n                    return AVERROR_INVALIDDATA;\n                }\n                if (has_diff) {\n                    if (!s->keyframe) {\n                        av_log(avctx, AV_LOG_ERROR,\n                               "Inter frame without keyframe\\n");\n                        return AVERROR_INVALIDDATA;\n                    }\n                    s->diff_start  = bitstream_read(&bc, 8);\n                    s->diff_height = bitstream_read(&bc, 8);\n                    if (s->diff_start + s->diff_height > cur_blk_height) {\n                        av_log(avctx, AV_LOG_ERROR,\n                               "Block parameters invalid: %d + %d > %d\\n",\n                               s->diff_start, s->diff_height, cur_blk_height);\n                        return AVERROR_INVALIDDATA;\n                    }\n                    av_log(avctx, AV_LOG_DEBUG,\n                           "%dx%d diff start %d height %d\\n",\n                           i, j, s->diff_start, s->diff_height);\n                    size -= 2;\n                }\n                if (s->zlibprime_prev)\n                    av_log(avctx, AV_LOG_DEBUG, "%dx%d zlibprime_prev\\n", i, j);\n                if (s->zlibprime_curr) {\n                    int col = bitstream_read(&bc, 8);\n                    int row = bitstream_read(&bc, 8);\n                    av_log(avctx, AV_LOG_DEBUG, "%dx%d zlibprime_curr %dx%d\\n",\n                           i, j, col, row);\n                    size -= 2;\n                    avpriv_request_sample(avctx, "zlibprime_curr");\n                    return AVERROR_PATCHWELCOME;\n                }\n                if (!s->blocks && (s->zlibprime_curr || s->zlibprime_prev)) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "no data available for zlib priming\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                size--;\n            }\n            if (has_diff) {\n                int k;\n                int off = (s->image_height - y_pos - 1) * s->frame->linesize[0];\n                for (k = 0; k < cur_blk_height; k++) {\n                    int x = off - k * s->frame->linesize[0] + x_pos * 3;\n                    memcpy(s->frame->data[0] + x, s->keyframe + x,\n                           cur_blk_width * 3);\n                }\n            }\n            if (size) {\n                if (flashsv_decode_block(avctx, avpkt, &bc, size,\n                                         cur_blk_width, cur_blk_height,\n                                         x_pos, y_pos,\n                                         i + j * (h_blocks + !!h_part)))\n                    av_log(avctx, AV_LOG_ERROR,\n                           "error in decompression of block %dx%d\\n", i, j);\n            }\n        }\n    }\n    if (s->is_keyframe && s->ver == 2) {\n        if (!s->keyframe) {\n            s->keyframe = av_malloc(s->frame->linesize[0] * avctx->height);\n            if (!s->keyframe) {\n                av_log(avctx, AV_LOG_ERROR, "Cannot allocate image data\\n");\n                return AVERROR(ENOMEM);\n            }\n        }\n        memcpy(s->keyframe, s->frame->data[0],\n               s->frame->linesize[0] * avctx->height);\n    }\n    if ((ret = av_frame_ref(data, s->frame)) < 0)\n        return ret;\n    *got_frame = 1;\n    if ((bitstream_tell(&bc) / 8) != buf_size)\n        av_log(avctx, AV_LOG_ERROR, "buffer not fully consumed (%d != %d)\\n",\n               buf_size, (bitstream_tell(&bc) / 8));\n    return buf_size;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']