libavcodec/msgsmdec.c:36: error: Integer Overflow L2
  (32 - [0, 64]):unsigned32 by call to `gsm_decode_block`.

libavcodec/msgsmdec.c:35:5: Call
33.     int res;
34.     BitstreamContext bc;
35.     bitstream_init(&bc, buf, GSM_MS_BLOCK_SIZE * 8);
        ^
36.     res = gsm_decode_block(avctx, samples, &bc, mode);
37.     if (res < 0)

libavcodec/bitstream.h:85:9: Assignment
  83.         bc->buffer    =
  84.         bc->ptr       = NULL;
  85.         bc->bits_left = 0;
              ^
  86.         return AVERROR_INVALIDDATA;
  87.     }

libavcodec/msgsmdec.c:36:11: Call
34.     BitstreamContext bc;
35.     bitstream_init(&bc, buf, GSM_MS_BLOCK_SIZE * 8);
36.     res = gsm_decode_block(avctx, samples, &bc, mode);
              ^
37.     if (res < 0)
38.         return res;

libavcodec/gsmdec_template.c:122:1: Parameter `bc->bits_left`
  120. }
  121. 
  122. static int gsm_decode_block(AVCodecContext *avctx, int16_t *samples,
       ^
  123.                             BitstreamContext *bc, int mode)
  124. {

libavcodec/gsmdec_template.c:129:30: Call
  127.     int16_t *ref_dst = ctx->ref_buf + 120;
  128.     int *lar = ctx->lar[ctx->lar_idx];
  129.     lar[0] = decode_log_area(bitstream_read(bc, 6), 13107,  1 << 15);
                                    ^
  130.     lar[1] = decode_log_area(bitstream_read(bc, 6), 13107,  1 << 15);
  131.     lar[2] = decode_log_area(bitstream_read(bc, 5), 13107, (1 << 14) + 2048 * 2);

libavcodec/bitstream.h:183:1: Parameter `n`
    181. 
    182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
    183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
         ^
    184. {
    185.     if (!n)

libavcodec/bitstream.h:189:9: Call
    187. 
    188.     if (n > bc->bits_left) {
    189.         refill_32(bc);
                 ^
    190.         if (bc->bits_left < 32)
    191.             bc->bits_left = n;

libavcodec/bitstream.h:60:1: <RHS trace>
58. }
59. 
60. static inline void refill_32(BitstreamContext *bc)
    ^
61. {
62.     if (bc->ptr >= bc->buffer_end)

libavcodec/bitstream.h:60:1: Parameter `bc->bits_left`
      58. }
      59. 
      60. static inline void refill_32(BitstreamContext *bc)
          ^
      61. {
      62.     if (bc->ptr >= bc->buffer_end)

libavcodec/bitstream.h:68:5: Binary operation: (32 - [0, 64]):unsigned32 by call to `gsm_decode_block` 
      66.     bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;
      67. #else
      68.     bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);
              ^
      69. #endif
      70.     bc->ptr       += 4;

static inline void refill_32(BitstreamContext *bc)
{
    if (bc->ptr >= bc->buffer_end)
        return;
#ifdef BITSTREAM_READER_LE
    bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;
#else
    bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);
#endif
    bc->ptr       += 4;
    bc->bits_left += 32;
}
['int ff_msgsm_decode_block(AVCodecContext *avctx, int16_t *samples,\n                          const uint8_t *buf, int mode)\n{\n    int res;\n    BitstreamContext bc;\n    bitstream_init(&bc, buf, GSM_MS_BLOCK_SIZE * 8);\n    res = gsm_decode_block(avctx, samples, &bc, mode);\n    if (res < 0)\n        return res;\n    return gsm_decode_block(avctx, samples + GSM_FRAME_SIZE, &bc, mode);\n}', 'static inline int bitstream_init(BitstreamContext *bc, const uint8_t *buffer,\n                                 unsigned bit_size)\n{\n    unsigned buffer_size;\n    if (bit_size > INT_MAX - 7 || !buffer) {\n        buffer        =\n        bc->buffer    =\n        bc->ptr       = NULL;\n        bc->bits_left = 0;\n        return AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    bc->buffer       = buffer;\n    bc->buffer_end   = buffer + buffer_size;\n    bc->ptr          = bc->buffer;\n    bc->size_in_bits = bit_size;\n    bc->bits_left    = 0;\n    bc->bits         = 0;\n    refill_64(bc);\n    return 0;\n}', 'static int gsm_decode_block(AVCodecContext *avctx, int16_t *samples,\n                            BitstreamContext *bc, int mode)\n{\n    GSMContext *ctx = avctx->priv_data;\n    int i;\n    int16_t *ref_dst = ctx->ref_buf + 120;\n    int *lar = ctx->lar[ctx->lar_idx];\n    lar[0] = decode_log_area(bitstream_read(bc, 6), 13107,  1 << 15);\n    lar[1] = decode_log_area(bitstream_read(bc, 6), 13107,  1 << 15);\n    lar[2] = decode_log_area(bitstream_read(bc, 5), 13107, (1 << 14) + 2048 * 2);\n    lar[3] = decode_log_area(bitstream_read(bc, 5), 13107, (1 << 14) - 2560 * 2);\n    lar[4] = decode_log_area(bitstream_read(bc, 4), 19223, (1 << 13) +   94 * 2);\n    lar[5] = decode_log_area(bitstream_read(bc, 4), 17476, (1 << 13) - 1792 * 2);\n    lar[6] = decode_log_area(bitstream_read(bc, 3), 31454, (1 << 12) -  341 * 2);\n    lar[7] = decode_log_area(bitstream_read(bc, 3), 29708, (1 << 12) - 1144 * 2);\n    for (i = 0; i < 4; i++) {\n        int lag      = bitstream_read(bc, 7);\n        int gain_idx = bitstream_read(bc, 2);\n        int offset   = bitstream_read(bc, 2);\n        lag = av_clip(lag, 40, 120);\n        long_term_synth(ref_dst, lag, gain_idx);\n        apcm_dequant_add(bc, ref_dst + offset, ff_gsm_apcm_bits[mode][i]);\n        ref_dst += 40;\n    }\n    memcpy(ctx->ref_buf, ctx->ref_buf + 160, 120 * sizeof(*ctx->ref_buf));\n    short_term_synth(ctx, samples, ctx->ref_buf + 120);\n    ctx->msr = postprocess(samples, ctx->msr);\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline void refill_32(BitstreamContext *bc)\n{\n    if (bc->ptr >= bc->buffer_end)\n        return;\n#ifdef BITSTREAM_READER_LE\n    bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;\n#else\n    bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);\n#endif\n    bc->ptr       += 4;\n    bc->bits_left += 32;\n}']