libavcodec/g2meet.c:696: error: Integer Overflow L2
  ([min(0, `avpkt->data->l`), max(0, `avpkt->data->l`)] - 1):unsigned32.

libavcodec/g2meet.c:659:1: <LHS trace>
657. }
658. 
659. static int g2m_decode_frame(AVCodecContext *avctx, void *data,
     ^
660.                             int *got_picture_ptr, AVPacket *avpkt)
661. {

libavcodec/g2meet.c:659:1: Parameter `avpkt->data->l`
657. }
658. 
659. static int g2m_decode_frame(AVCodecContext *avctx, void *data,
     ^
660.                             int *got_picture_ptr, AVPacket *avpkt)
661. {

libavcodec/g2meet.c:696:23: Call
694. 
695.     while (bytestream2_get_bytes_left(&bc) > 5) {
696.         chunk_size  = bytestream2_get_le32(&bc) - 1;
                           ^
697.         chunk_type  = bytestream2_get_byte(&bc);
698.         chunk_start = bytestream2_tell(&bc);

libavcodec/bytestream.h:85:1: Assignment
  83. 
  84. DEF(uint64_t,     le64, 8, AV_RL64, AV_WL64)
  85. DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)
      ^
  86. DEF(unsigned int, le24, 3, AV_RL24, AV_WL24)
  87. DEF(unsigned int, le16, 2, AV_RL16, AV_WL16)

libavcodec/g2meet.c:696:9: Binary operation: ([min(0, avpkt->data->l), max(0, avpkt->data->l)] - 1):unsigned32
694. 
695.     while (bytestream2_get_bytes_left(&bc) > 5) {
696.         chunk_size  = bytestream2_get_le32(&bc) - 1;
             ^
697.         chunk_type  = bytestream2_get_byte(&bc);
698.         chunk_start = bytestream2_tell(&bc);

static int g2m_decode_frame(AVCodecContext *avctx, void *data,
                            int *got_picture_ptr, AVPacket *avpkt)
{
    const uint8_t *buf = avpkt->data;
    int buf_size = avpkt->size;
    G2MContext *c = avctx->priv_data;
    AVFrame *pic = data;
    GetByteContext bc, tbc;
    int magic;
    int got_header = 0;
    uint32_t chunk_size, r_mask, g_mask, b_mask;
    int chunk_type, chunk_start;
    int i;
    int ret;
    if (buf_size < 12) {
        av_log(avctx, AV_LOG_ERROR,
               "Frame should have at least 12 bytes, got %d instead\n",
               buf_size);
        return AVERROR_INVALIDDATA;
    }
    bytestream2_init(&bc, buf, buf_size);
    magic = bytestream2_get_be32(&bc);
    if ((magic & ~0xF) != MKBETAG('G', '2', 'M', '0') ||
        (magic & 0xF) < 2 || (magic & 0xF) > 4) {
        av_log(avctx, AV_LOG_ERROR, "Wrong magic %08X\n", magic);
        return AVERROR_INVALIDDATA;
    }
    if ((magic & 0xF) != 4) {
        av_log(avctx, AV_LOG_ERROR, "G2M2 and G2M3 are not yet supported\n");
        return AVERROR(ENOSYS);
    }
    while (bytestream2_get_bytes_left(&bc) > 5) {
        chunk_size  = bytestream2_get_le32(&bc) - 1;
        chunk_type  = bytestream2_get_byte(&bc);
        chunk_start = bytestream2_tell(&bc);
        if (chunk_size > bytestream2_get_bytes_left(&bc)) {
            av_log(avctx, AV_LOG_ERROR, "Invalid chunk size %"PRIu32" type %02X\n",
                   chunk_size, chunk_type);
            break;
        }
        switch (chunk_type) {
        case DISPLAY_INFO:
            c->got_header = 0;
            if (chunk_size < 21) {
                av_log(avctx, AV_LOG_ERROR, "Invalid display info size %"PRIu32"\n",
                       chunk_size);
                break;
            }
            c->width  = bytestream2_get_be32(&bc);
            c->height = bytestream2_get_be32(&bc);
            if (c->width  < 16 || c->width  > c->orig_width ||
                c->height < 16 || c->height > c->orig_height) {
                av_log(avctx, AV_LOG_ERROR,
                       "Invalid frame dimensions %dx%d\n",
                       c->width, c->height);
                ret = AVERROR_INVALIDDATA;
                goto header_fail;
            }
            if (c->width != avctx->width || c->height != avctx->height)
                ff_set_dimensions(avctx, c->width, c->height);
            c->compression = bytestream2_get_be32(&bc);
            if (c->compression != 2 && c->compression != 3) {
                av_log(avctx, AV_LOG_ERROR,
                       "Unknown compression method %d\n",
                       c->compression);
                return AVERROR_PATCHWELCOME;
            }
            c->tile_width  = bytestream2_get_be32(&bc);
            c->tile_height = bytestream2_get_be32(&bc);
            if (!c->tile_width || !c->tile_height ||
                ((c->tile_width | c->tile_height) & 0xF)) {
                av_log(avctx, AV_LOG_ERROR,
                       "Invalid tile dimensions %dx%d\n",
                       c->tile_width, c->tile_height);
                ret = AVERROR_INVALIDDATA;
                goto header_fail;
            }
            c->tiles_x = (c->width  + c->tile_width  - 1) / c->tile_width;
            c->tiles_y = (c->height + c->tile_height - 1) / c->tile_height;
            c->bpp     = bytestream2_get_byte(&bc);
            if (c->bpp == 32) {
                if (bytestream2_get_bytes_left(&bc) < 16 ||
                    (chunk_size - 21) < 16) {
                    av_log(avctx, AV_LOG_ERROR,
                           "Display info: missing bitmasks!\n");
                    return AVERROR_INVALIDDATA;
                }
                r_mask = bytestream2_get_be32(&bc);
                g_mask = bytestream2_get_be32(&bc);
                b_mask = bytestream2_get_be32(&bc);
                if (r_mask != 0xFF0000 || g_mask != 0xFF00 || b_mask != 0xFF) {
                    av_log(avctx, AV_LOG_ERROR,
                           "Invalid or unsupported bitmasks: R=%"PRIX32", G=%"PRIX32", B=%"PRIX32"\n",
                           r_mask, g_mask, b_mask);
                    return AVERROR_PATCHWELCOME;
                }
            } else {
                avpriv_request_sample(avctx, "bpp=%d", c->bpp);
                return AVERROR_PATCHWELCOME;
            }
            if (g2m_init_buffers(c)) {
                ret = AVERROR(ENOMEM);
                goto header_fail;
            }
            got_header = 1;
            break;
        case TILE_DATA:
            if (!c->tiles_x || !c->tiles_y) {
                av_log(avctx, AV_LOG_WARNING,
                       "No display info - skipping tile\n");
                break;
            }
            if (chunk_size < 2) {
                av_log(avctx, AV_LOG_ERROR, "Invalid tile data size %"PRIu32"\n",
                       chunk_size);
                break;
            }
            c->tile_x = bytestream2_get_byte(&bc);
            c->tile_y = bytestream2_get_byte(&bc);
            if (c->tile_x >= c->tiles_x || c->tile_y >= c->tiles_y) {
                av_log(avctx, AV_LOG_ERROR,
                       "Invalid tile pos %d,%d (in %dx%d grid)\n",
                       c->tile_x, c->tile_y, c->tiles_x, c->tiles_y);
                break;
            }
            ret = 0;
            switch (c->compression) {
            case COMPR_EPIC_J_B:
                av_log(avctx, AV_LOG_ERROR,
                       "ePIC j-b compression is not implemented yet\n");
                return AVERROR(ENOSYS);
            case COMPR_KEMPF_J_B:
                ret = kempf_decode_tile(c, c->tile_x, c->tile_y,
                                        buf + bytestream2_tell(&bc),
                                        chunk_size - 2);
                break;
            }
            if (ret && c->framebuf)
                av_log(avctx, AV_LOG_ERROR, "Error decoding tile %d,%d\n",
                       c->tile_x, c->tile_y);
            break;
        case CURSOR_POS:
            if (chunk_size < 5) {
                av_log(avctx, AV_LOG_ERROR, "Invalid cursor pos size %"PRIu32"\n",
                       chunk_size);
                break;
            }
            c->cursor_x = bytestream2_get_be16(&bc);
            c->cursor_y = bytestream2_get_be16(&bc);
            break;
        case CURSOR_SHAPE:
            if (chunk_size < 8) {
                av_log(avctx, AV_LOG_ERROR, "Invalid cursor data size %"PRIu32"\n",
                       chunk_size);
                break;
            }
            bytestream2_init(&tbc, buf + bytestream2_tell(&bc),
                             chunk_size - 4);
            g2m_load_cursor(avctx, c, &tbc);
            break;
        case CHUNK_CC:
        case CHUNK_CD:
            break;
        default:
            av_log(avctx, AV_LOG_WARNING, "Skipping chunk type %02d\n",
                   chunk_type);
        }
        bytestream2_skip(&bc, chunk_start + chunk_size - bytestream2_tell(&bc));
    }
    if (got_header)
        c->got_header = 1;
    if (c->width && c->height) {
        if ((ret = ff_get_buffer(avctx, pic, 0)) < 0) {
            av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
            return ret;
        }
        pic->key_frame = got_header;
        pic->pict_type = got_header ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;
        for (i = 0; i < avctx->height; i++)
            memcpy(pic->data[0] + i * pic->linesize[0],
                   c->framebuf + i * c->framebuf_stride,
                   c->width * 3);
        g2m_paint_cursor(c, pic->data[0], pic->linesize[0]);
        *got_picture_ptr = 1;
    }
    return buf_size;
header_fail:
    c->width   =
    c->height  = 0;
    c->tiles_x =
    c->tiles_y = 0;
    return ret;
}
['static int g2m_decode_frame(AVCodecContext *avctx, void *data,\n                            int *got_picture_ptr, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size = avpkt->size;\n    G2MContext *c = avctx->priv_data;\n    AVFrame *pic = data;\n    GetByteContext bc, tbc;\n    int magic;\n    int got_header = 0;\n    uint32_t chunk_size, r_mask, g_mask, b_mask;\n    int chunk_type, chunk_start;\n    int i;\n    int ret;\n    if (buf_size < 12) {\n        av_log(avctx, AV_LOG_ERROR,\n               "Frame should have at least 12 bytes, got %d instead\\n",\n               buf_size);\n        return AVERROR_INVALIDDATA;\n    }\n    bytestream2_init(&bc, buf, buf_size);\n    magic = bytestream2_get_be32(&bc);\n    if ((magic & ~0xF) != MKBETAG(\'G\', \'2\', \'M\', \'0\') ||\n        (magic & 0xF) < 2 || (magic & 0xF) > 4) {\n        av_log(avctx, AV_LOG_ERROR, "Wrong magic %08X\\n", magic);\n        return AVERROR_INVALIDDATA;\n    }\n    if ((magic & 0xF) != 4) {\n        av_log(avctx, AV_LOG_ERROR, "G2M2 and G2M3 are not yet supported\\n");\n        return AVERROR(ENOSYS);\n    }\n    while (bytestream2_get_bytes_left(&bc) > 5) {\n        chunk_size  = bytestream2_get_le32(&bc) - 1;\n        chunk_type  = bytestream2_get_byte(&bc);\n        chunk_start = bytestream2_tell(&bc);\n        if (chunk_size > bytestream2_get_bytes_left(&bc)) {\n            av_log(avctx, AV_LOG_ERROR, "Invalid chunk size %"PRIu32" type %02X\\n",\n                   chunk_size, chunk_type);\n            break;\n        }\n        switch (chunk_type) {\n        case DISPLAY_INFO:\n            c->got_header = 0;\n            if (chunk_size < 21) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid display info size %"PRIu32"\\n",\n                       chunk_size);\n                break;\n            }\n            c->width  = bytestream2_get_be32(&bc);\n            c->height = bytestream2_get_be32(&bc);\n            if (c->width  < 16 || c->width  > c->orig_width ||\n                c->height < 16 || c->height > c->orig_height) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Invalid frame dimensions %dx%d\\n",\n                       c->width, c->height);\n                ret = AVERROR_INVALIDDATA;\n                goto header_fail;\n            }\n            if (c->width != avctx->width || c->height != avctx->height)\n                ff_set_dimensions(avctx, c->width, c->height);\n            c->compression = bytestream2_get_be32(&bc);\n            if (c->compression != 2 && c->compression != 3) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Unknown compression method %d\\n",\n                       c->compression);\n                return AVERROR_PATCHWELCOME;\n            }\n            c->tile_width  = bytestream2_get_be32(&bc);\n            c->tile_height = bytestream2_get_be32(&bc);\n            if (!c->tile_width || !c->tile_height ||\n                ((c->tile_width | c->tile_height) & 0xF)) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Invalid tile dimensions %dx%d\\n",\n                       c->tile_width, c->tile_height);\n                ret = AVERROR_INVALIDDATA;\n                goto header_fail;\n            }\n            c->tiles_x = (c->width  + c->tile_width  - 1) / c->tile_width;\n            c->tiles_y = (c->height + c->tile_height - 1) / c->tile_height;\n            c->bpp     = bytestream2_get_byte(&bc);\n            if (c->bpp == 32) {\n                if (bytestream2_get_bytes_left(&bc) < 16 ||\n                    (chunk_size - 21) < 16) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "Display info: missing bitmasks!\\n");\n                    return AVERROR_INVALIDDATA;\n                }\n                r_mask = bytestream2_get_be32(&bc);\n                g_mask = bytestream2_get_be32(&bc);\n                b_mask = bytestream2_get_be32(&bc);\n                if (r_mask != 0xFF0000 || g_mask != 0xFF00 || b_mask != 0xFF) {\n                    av_log(avctx, AV_LOG_ERROR,\n                           "Invalid or unsupported bitmasks: R=%"PRIX32", G=%"PRIX32", B=%"PRIX32"\\n",\n                           r_mask, g_mask, b_mask);\n                    return AVERROR_PATCHWELCOME;\n                }\n            } else {\n                avpriv_request_sample(avctx, "bpp=%d", c->bpp);\n                return AVERROR_PATCHWELCOME;\n            }\n            if (g2m_init_buffers(c)) {\n                ret = AVERROR(ENOMEM);\n                goto header_fail;\n            }\n            got_header = 1;\n            break;\n        case TILE_DATA:\n            if (!c->tiles_x || !c->tiles_y) {\n                av_log(avctx, AV_LOG_WARNING,\n                       "No display info - skipping tile\\n");\n                break;\n            }\n            if (chunk_size < 2) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid tile data size %"PRIu32"\\n",\n                       chunk_size);\n                break;\n            }\n            c->tile_x = bytestream2_get_byte(&bc);\n            c->tile_y = bytestream2_get_byte(&bc);\n            if (c->tile_x >= c->tiles_x || c->tile_y >= c->tiles_y) {\n                av_log(avctx, AV_LOG_ERROR,\n                       "Invalid tile pos %d,%d (in %dx%d grid)\\n",\n                       c->tile_x, c->tile_y, c->tiles_x, c->tiles_y);\n                break;\n            }\n            ret = 0;\n            switch (c->compression) {\n            case COMPR_EPIC_J_B:\n                av_log(avctx, AV_LOG_ERROR,\n                       "ePIC j-b compression is not implemented yet\\n");\n                return AVERROR(ENOSYS);\n            case COMPR_KEMPF_J_B:\n                ret = kempf_decode_tile(c, c->tile_x, c->tile_y,\n                                        buf + bytestream2_tell(&bc),\n                                        chunk_size - 2);\n                break;\n            }\n            if (ret && c->framebuf)\n                av_log(avctx, AV_LOG_ERROR, "Error decoding tile %d,%d\\n",\n                       c->tile_x, c->tile_y);\n            break;\n        case CURSOR_POS:\n            if (chunk_size < 5) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid cursor pos size %"PRIu32"\\n",\n                       chunk_size);\n                break;\n            }\n            c->cursor_x = bytestream2_get_be16(&bc);\n            c->cursor_y = bytestream2_get_be16(&bc);\n            break;\n        case CURSOR_SHAPE:\n            if (chunk_size < 8) {\n                av_log(avctx, AV_LOG_ERROR, "Invalid cursor data size %"PRIu32"\\n",\n                       chunk_size);\n                break;\n            }\n            bytestream2_init(&tbc, buf + bytestream2_tell(&bc),\n                             chunk_size - 4);\n            g2m_load_cursor(avctx, c, &tbc);\n            break;\n        case CHUNK_CC:\n        case CHUNK_CD:\n            break;\n        default:\n            av_log(avctx, AV_LOG_WARNING, "Skipping chunk type %02d\\n",\n                   chunk_type);\n        }\n        bytestream2_skip(&bc, chunk_start + chunk_size - bytestream2_tell(&bc));\n    }\n    if (got_header)\n        c->got_header = 1;\n    if (c->width && c->height) {\n        if ((ret = ff_get_buffer(avctx, pic, 0)) < 0) {\n            av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n            return ret;\n        }\n        pic->key_frame = got_header;\n        pic->pict_type = got_header ? AV_PICTURE_TYPE_I : AV_PICTURE_TYPE_P;\n        for (i = 0; i < avctx->height; i++)\n            memcpy(pic->data[0] + i * pic->linesize[0],\n                   c->framebuf + i * c->framebuf_stride,\n                   c->width * 3);\n        g2m_paint_cursor(c, pic->data[0], pic->linesize[0]);\n        *got_picture_ptr = 1;\n    }\n    return buf_size;\nheader_fail:\n    c->width   =\n    c->height  = 0;\n    c->tiles_x =\n    c->tiles_y = 0;\n    return ret;\n}', 'DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)']