libavcodec/qtrle.c:308: error: Integer Overflow L2
  ([0, `*s->g.buffer`] - 1):unsigned32.

libavcodec/qtrle.c:298:1: <LHS trace>
296. }
297. 
298. static void qtrle_decode_32bpp(QtrleContext *s, int row_ptr, int lines_to_change)
     ^
299. {
300.     int rle_code;

libavcodec/qtrle.c:298:1: Parameter `*s->g.buffer`
296. }
297. 
298. static void qtrle_decode_32bpp(QtrleContext *s, int row_ptr, int lines_to_change)
     ^
299. {
300.     int rle_code;

libavcodec/qtrle.c:308:32: Call
306. 
307.     while (lines_to_change--) {
308.         pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 4;
                                    ^
309. 
310.         while ((rle_code = (signed char)bytestream2_get_byte(&s->g)) != -1) {

libavcodec/bytestream.h:92:1: Assignment
  90. DEF(unsigned int, be24, 3, AV_RB24, AV_WB24)
  91. DEF(unsigned int, be16, 2, AV_RB16, AV_WB16)
  92. DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)
      ^
  93. 
  94. #if HAVE_BIGENDIAN

libavcodec/qtrle.c:308:9: Binary operation: ([0, *s->g.buffer] - 1):unsigned32
306. 
307.     while (lines_to_change--) {
308.         pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 4;
             ^
309. 
310.         while ((rle_code = (signed char)bytestream2_get_byte(&s->g)) != -1) {

static void qtrle_decode_32bpp(QtrleContext *s, int row_ptr, int lines_to_change)
{
    int rle_code;
    int pixel_ptr;
    int row_inc = s->frame.linesize[0];
    unsigned int argb;
    unsigned char *rgb = s->frame.data[0];
    int pixel_limit = s->frame.linesize[0] * s->avctx->height;
    while (lines_to_change--) {
        pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 4;
        while ((rle_code = (signed char)bytestream2_get_byte(&s->g)) != -1) {
            if (rle_code == 0) {
                pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 4;
                CHECK_PIXEL_PTR(0);
            } else if (rle_code < 0) {
                rle_code = -rle_code;
                argb = bytestream2_get_be32(&s->g);
                CHECK_PIXEL_PTR(rle_code * 4);
                while (rle_code--) {
                    AV_WN32A(rgb + pixel_ptr, argb);
                    pixel_ptr += 4;
                }
            } else {
                CHECK_PIXEL_PTR(rle_code * 4);
                while (rle_code--) {
                    argb = bytestream2_get_be32(&s->g);
                    AV_WN32A(rgb + pixel_ptr, argb);
                    pixel_ptr  += 4;
                }
            }
        }
        row_ptr += row_inc;
    }
}
['static void qtrle_decode_32bpp(QtrleContext *s, int row_ptr, int lines_to_change)\n{\n    int rle_code;\n    int pixel_ptr;\n    int row_inc = s->frame.linesize[0];\n    unsigned int argb;\n    unsigned char *rgb = s->frame.data[0];\n    int pixel_limit = s->frame.linesize[0] * s->avctx->height;\n    while (lines_to_change--) {\n        pixel_ptr = row_ptr + (bytestream2_get_byte(&s->g) - 1) * 4;\n        while ((rle_code = (signed char)bytestream2_get_byte(&s->g)) != -1) {\n            if (rle_code == 0) {\n                pixel_ptr += (bytestream2_get_byte(&s->g) - 1) * 4;\n                CHECK_PIXEL_PTR(0);\n            } else if (rle_code < 0) {\n                rle_code = -rle_code;\n                argb = bytestream2_get_be32(&s->g);\n                CHECK_PIXEL_PTR(rle_code * 4);\n                while (rle_code--) {\n                    AV_WN32A(rgb + pixel_ptr, argb);\n                    pixel_ptr += 4;\n                }\n            } else {\n                CHECK_PIXEL_PTR(rle_code * 4);\n                while (rle_code--) {\n                    argb = bytestream2_get_be32(&s->g);\n                    AV_WN32A(rgb + pixel_ptr, argb);\n                    pixel_ptr  += 4;\n                }\n            }\n        }\n        row_ptr += row_inc;\n    }\n}', 'DEF(unsigned int, byte, 1, AV_RB8 , AV_WB8)']