libavcodec/lagarith.c:391: error: Integer Overflow L2
  ([0, +oo] - 8):unsigned32 by call to `ff_lag_rac_init`.

libavcodec/lagarith.c:388:13: Call
386.         init_get_bits(&gb, src + offset, src_size * 8);
387. 
388.         if (lag_read_prob_header(&rac, &gb) < 0)
                 ^
389.             return -1;
390. 

libavcodec/lagarith.c:135:1: Parameter `rac->scale`
  133. }
  134. 
  135. static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
       ^
  136. {
  137.     int i, j, scale_factor;

libavcodec/lagarith.c:391:9: Call
389.             return -1;
390. 
391.         ff_lag_rac_init(&rac, &gb, length - stride);
             ^
392. 
393.         for (i = 0; i < height; i++)

libavcodec/lagarithrac.c:33:1: <LHS trace>
31. #include "lagarithrac.h"
32. 
33. void ff_lag_rac_init(lag_rac *l, GetBitContext *gb, int length)
    ^
34. {
35.     int i, j, left;

libavcodec/lagarithrac.c:33:1: Parameter `l->scale`
  31. #include "lagarithrac.h"
  32. 
  33. void ff_lag_rac_init(lag_rac *l, GetBitContext *gb, int length)
      ^
  34. {
  35.     int i, j, left;

libavcodec/lagarithrac.c:48:23: Binary operation: ([0, +oo] - 8):unsigned32 by call to `ff_lag_rac_init` 
  46.     l->range        = 0x80;
  47.     l->low          = *l->bytestream >> 1;
  48.     l->hash_shift   = FFMAX(l->scale - 8, 0);
                            ^
  49. 
  50.     for (i = j = 0; i < 256; i++) {

void ff_lag_rac_init(lag_rac *l, GetBitContext *gb, int length)
{
    int i, j, left;
    align_get_bits(gb);
    left                = get_bits_left(gb) >> 3;
    l->bytestream_start =
    l->bytestream       = gb->buffer + get_bits_count(gb) / 8;
    l->bytestream_end   = l->bytestream_start + FFMIN(length, left);
    l->range        = 0x80;
    l->low          = *l->bytestream >> 1;
    l->hash_shift   = FFMAX(l->scale - 8, 0);
    for (i = j = 0; i < 256; i++) {
        unsigned r = i << l->hash_shift;
        while (l->prob[j + 1] <= r)
            j++;
        l->range_hash[i] = j;
    }
    l->hash_shift += 23;
}
['static int lag_decode_arith_plane(LagarithContext *l, uint8_t *dst,\n                                  int width, int height, int stride,\n                                  const uint8_t *src, int src_size)\n{\n    int i = 0;\n    int read = 0;\n    uint32_t length;\n    uint32_t offset = 1;\n    int esc_count = src[0];\n    GetBitContext gb;\n    lag_rac rac;\n    const uint8_t *src_end = src + src_size;\n    rac.avctx = l->avctx;\n    l->zeros = 0;\n    if (esc_count < 4) {\n        length = width * height;\n        if (esc_count && AV_RL32(src + 1) < length) {\n            length = AV_RL32(src + 1);\n            offset += 4;\n        }\n        init_get_bits(&gb, src + offset, src_size * 8);\n        if (lag_read_prob_header(&rac, &gb) < 0)\n            return -1;\n        ff_lag_rac_init(&rac, &gb, length - stride);\n        for (i = 0; i < height; i++)\n            read += lag_decode_line(l, &rac, dst + (i * stride), width,\n                                    stride, esc_count);\n        if (read > length)\n            av_log(l->avctx, AV_LOG_WARNING,\n                   "Output more bytes than length (%d of %d)\\n", read,\n                   length);\n    } else if (esc_count < 8) {\n        esc_count -= 4;\n        if (esc_count > 0) {\n            for (i = 0; i < height; i++) {\n                int res = lag_decode_zero_run_line(l, dst + (i * stride), src,\n                                                   src_end, width, esc_count);\n                if (res < 0)\n                    return res;\n                src += res;\n            }\n        } else {\n            if (src_size < width * height)\n                return AVERROR_INVALIDDATA;\n            for (i = 0; i < height; i++) {\n                memcpy(dst + (i * stride), src, width);\n                src += width;\n            }\n        }\n    } else if (esc_count == 0xff) {\n        for (i = 0; i < height; i++)\n            memset(dst + i * stride, src[1], width);\n        return 0;\n    } else {\n        av_log(l->avctx, AV_LOG_ERROR,\n               "Invalid zero run escape code! (%#x)\\n", esc_count);\n        return -1;\n    }\n    for (i = 0; i < height; i++) {\n        lag_pred_line(l, dst, width, stride, i);\n        dst += stride;\n    }\n    return 0;\n}', 'static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)\n{\n    int i, j, scale_factor;\n    unsigned prob, cumulative_target;\n    unsigned cumul_prob = 0;\n    unsigned scaled_cumul_prob = 0;\n    rac->prob[0] = 0;\n    rac->prob[257] = UINT_MAX;\n    for (i = 1; i < 257; i++) {\n        if (lag_decode_prob(gb, &rac->prob[i]) < 0) {\n            av_log(rac->avctx, AV_LOG_ERROR, "Invalid probability encountered.\\n");\n            return -1;\n        }\n        if ((uint64_t)cumul_prob + rac->prob[i] > UINT_MAX) {\n            av_log(rac->avctx, AV_LOG_ERROR, "Integer overflow encountered in cumulative probability calculation.\\n");\n            return -1;\n        }\n        cumul_prob += rac->prob[i];\n        if (!rac->prob[i]) {\n            if (lag_decode_prob(gb, &prob)) {\n                av_log(rac->avctx, AV_LOG_ERROR, "Invalid probability run encountered.\\n");\n                return -1;\n            }\n            if (prob > 257 - i)\n                prob = 257 - i;\n            for (j = 0; j < prob; j++)\n                rac->prob[++i] = 0;\n        }\n    }\n    if (!cumul_prob) {\n        av_log(rac->avctx, AV_LOG_ERROR, "All probabilities are 0!\\n");\n        return -1;\n    }\n    scale_factor = av_log2(cumul_prob);\n    if (cumul_prob & (cumul_prob - 1)) {\n        uint64_t mul = softfloat_reciprocal(cumul_prob);\n        for (i = 1; i < 257; i++) {\n            rac->prob[i] = softfloat_mul(rac->prob[i], mul);\n            scaled_cumul_prob += rac->prob[i];\n        }\n        scale_factor++;\n        cumulative_target = 1 << scale_factor;\n        if (scaled_cumul_prob > cumulative_target) {\n            av_log(rac->avctx, AV_LOG_ERROR,\n                   "Scaled probabilities are larger than target!\\n");\n            return -1;\n        }\n        scaled_cumul_prob = cumulative_target - scaled_cumul_prob;\n        for (i = 1; scaled_cumul_prob; i = (i & 0x7f) + 1) {\n            if (rac->prob[i]) {\n                rac->prob[i]++;\n                scaled_cumul_prob--;\n            }\n        }\n    }\n    rac->scale = scale_factor;\n    for (i = 1; i < 257; i++)\n        rac->prob[i] += rac->prob[i - 1];\n    return 0;\n}', 'void ff_lag_rac_init(lag_rac *l, GetBitContext *gb, int length)\n{\n    int i, j, left;\n    align_get_bits(gb);\n    left                = get_bits_left(gb) >> 3;\n    l->bytestream_start =\n    l->bytestream       = gb->buffer + get_bits_count(gb) / 8;\n    l->bytestream_end   = l->bytestream_start + FFMIN(length, left);\n    l->range        = 0x80;\n    l->low          = *l->bytestream >> 1;\n    l->hash_shift   = FFMAX(l->scale - 8, 0);\n    for (i = j = 0; i < 256; i++) {\n        unsigned r = i << l->hash_shift;\n        while (l->prob[j + 1] <= r)\n            j++;\n        l->range_hash[i] = j;\n    }\n    l->hash_shift += 23;\n}']