libavformat/wc3movie.c:148: error: Integer Overflow L2
  ([-oo, 2147483639] + 776):signed32 by call to `av_append_packet`.

libavformat/wc3movie.c:103:28: Assignment
101.     wc3->video_stream_index = wc3->audio_stream_index = 0;
102.     av_init_packet(&wc3->vpkt);
103.     wc3->vpkt.data = NULL; wc3->vpkt.size = 0;
                                ^
104. 
105.     /* skip the first 3 32-bit numbers */

libavformat/wc3movie.c:148:13: Call
146.             /* one of several palettes */
147.             avio_seek(pb, -8, SEEK_CUR);
148.             av_append_packet(pb, &wc3->vpkt, 8 + PALETTE_SIZE);
                 ^
149.             break;
150. 

libavformat/utils.c:236:1: Parameter `size`
  234. }
  235. 
  236. int av_append_packet(AVIOContext *s, AVPacket *pkt, int size)
       ^
  237. {
  238.     int ret;

libavformat/utils.c:243:11: Call
  241.         return av_get_packet(s, pkt, size);
  242.     old_size = pkt->size;
  243.     ret = av_grow_packet(pkt, size);
                 ^
  244.     if (ret < 0)
  245.         return ret;

libavcodec/avpacket.c:94:1: <LHS trace>
92. }
93. 
94. int av_grow_packet(AVPacket *pkt, int grow_by)
    ^
95. {
96.     int new_size;

libavcodec/avpacket.c:94:1: Parameter `grow_by`
    92. }
    93. 
    94. int av_grow_packet(AVPacket *pkt, int grow_by)
        ^
    95. {
    96.     int new_size;

libavcodec/avpacket.c:94:1: <RHS trace>
92. }
93. 
94. int av_grow_packet(AVPacket *pkt, int grow_by)
    ^
95. {
96.     int new_size;

libavcodec/avpacket.c:94:1: Parameter `grow_by`
    92. }
    93. 
    94. int av_grow_packet(AVPacket *pkt, int grow_by)
        ^
    95. {
    96.     int new_size;

libavcodec/avpacket.c:104:5: Binary operation: ([-oo, 2147483639] + 776):signed32 by call to `av_append_packet` 
    102.         return -1;
    103. 
    104.     new_size = pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE;
             ^
    105.     if (pkt->buf) {
    106.         int ret = av_buffer_realloc(&pkt->buf, new_size);

int av_grow_packet(AVPacket *pkt, int grow_by)
{
    int new_size;
    av_assert0((unsigned)pkt->size <= INT_MAX - FF_INPUT_BUFFER_PADDING_SIZE);
    if (!pkt->size)
        return av_new_packet(pkt, grow_by);
    if ((unsigned)grow_by >
        INT_MAX - (pkt->size + FF_INPUT_BUFFER_PADDING_SIZE))
        return -1;
    new_size = pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE;
    if (pkt->buf) {
        int ret = av_buffer_realloc(&pkt->buf, new_size);
        if (ret < 0)
            return ret;
    } else {
        pkt->buf = av_buffer_alloc(new_size);
        if (!pkt->buf)
            return AVERROR(ENOMEM);
        memcpy(pkt->buf->data, pkt->data, FFMIN(pkt->size, pkt->size + grow_by));
#if FF_API_DESTRUCT_PACKET
        pkt->destruct = dummy_destruct_packet;
#endif
    }
    pkt->data  = pkt->buf->data;
    pkt->size += grow_by;
    memset(pkt->data + pkt->size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
    return 0;
}
['static int wc3_read_header(AVFormatContext *s)\n{\n    Wc3DemuxContext *wc3 = s->priv_data;\n    AVIOContext *pb = s->pb;\n    unsigned int fourcc_tag;\n    unsigned int size;\n    AVStream *st;\n    int ret = 0;\n    char *buffer;\n    wc3->width = WC3_DEFAULT_WIDTH;\n    wc3->height = WC3_DEFAULT_HEIGHT;\n    wc3->pts = 0;\n    wc3->video_stream_index = wc3->audio_stream_index = 0;\n    av_init_packet(&wc3->vpkt);\n    wc3->vpkt.data = NULL; wc3->vpkt.size = 0;\n    avio_skip(pb, 12);\n    fourcc_tag = avio_rl32(pb);\n    size = (avio_rb32(pb) + 1) & (~1);\n    do {\n        switch (fourcc_tag) {\n        case SOND_TAG:\n        case INDX_TAG:\n            avio_skip(pb, size);\n            break;\n        case PC__TAG:\n            avio_skip(pb, 12);\n            break;\n        case BNAM_TAG:\n            buffer = av_malloc(size+1);\n            if (!buffer)\n                return AVERROR(ENOMEM);\n            if ((ret = avio_read(pb, buffer, size)) != size)\n                return AVERROR(EIO);\n            buffer[size] = 0;\n            av_dict_set(&s->metadata, "title", buffer,\n                                   AV_DICT_DONT_STRDUP_VAL);\n            break;\n        case SIZE_TAG:\n            wc3->width  = avio_rl32(pb);\n            wc3->height = avio_rl32(pb);\n            break;\n        case PALT_TAG:\n            avio_seek(pb, -8, SEEK_CUR);\n            av_append_packet(pb, &wc3->vpkt, 8 + PALETTE_SIZE);\n            break;\n        default:\n            av_log(s, AV_LOG_ERROR, "  unrecognized WC3 chunk: %c%c%c%c (0x%02X%02X%02X%02X)\\n",\n                (uint8_t)fourcc_tag, (uint8_t)(fourcc_tag >> 8), (uint8_t)(fourcc_tag >> 16), (uint8_t)(fourcc_tag >> 24),\n                (uint8_t)fourcc_tag, (uint8_t)(fourcc_tag >> 8), (uint8_t)(fourcc_tag >> 16), (uint8_t)(fourcc_tag >> 24));\n            return AVERROR_INVALIDDATA;\n        }\n        fourcc_tag = avio_rl32(pb);\n        size = (avio_rb32(pb) + 1) & (~1);\n        if (pb->eof_reached)\n            return AVERROR(EIO);\n    } while (fourcc_tag != BRCH_TAG);\n    st = avformat_new_stream(s, NULL);\n    if (!st)\n        return AVERROR(ENOMEM);\n    avpriv_set_pts_info(st, 33, 1, WC3_FRAME_FPS);\n    wc3->video_stream_index = st->index;\n    st->codec->codec_type = AVMEDIA_TYPE_VIDEO;\n    st->codec->codec_id = AV_CODEC_ID_XAN_WC3;\n    st->codec->codec_tag = 0;\n    st->codec->width = wc3->width;\n    st->codec->height = wc3->height;\n    st = avformat_new_stream(s, NULL);\n    if (!st)\n        return AVERROR(ENOMEM);\n    avpriv_set_pts_info(st, 33, 1, WC3_FRAME_FPS);\n    wc3->audio_stream_index = st->index;\n    st->codec->codec_type = AVMEDIA_TYPE_AUDIO;\n    st->codec->codec_id = AV_CODEC_ID_PCM_S16LE;\n    st->codec->codec_tag = 1;\n    st->codec->channels = WC3_AUDIO_CHANNELS;\n    st->codec->channel_layout = AV_CH_LAYOUT_MONO;\n    st->codec->bits_per_coded_sample = WC3_AUDIO_BITS;\n    st->codec->sample_rate = WC3_SAMPLE_RATE;\n    st->codec->bit_rate = st->codec->channels * st->codec->sample_rate *\n        st->codec->bits_per_coded_sample;\n    st->codec->block_align = WC3_AUDIO_BITS * WC3_AUDIO_CHANNELS;\n    return 0;\n}', 'int av_append_packet(AVIOContext *s, AVPacket *pkt, int size)\n{\n    int ret;\n    int old_size;\n    if (!pkt->size)\n        return av_get_packet(s, pkt, size);\n    old_size = pkt->size;\n    ret = av_grow_packet(pkt, size);\n    if (ret < 0)\n        return ret;\n    ret = avio_read(s, pkt->data + old_size, size);\n    av_shrink_packet(pkt, old_size + FFMAX(ret, 0));\n    return ret;\n}', 'int av_grow_packet(AVPacket *pkt, int grow_by)\n{\n    int new_size;\n    av_assert0((unsigned)pkt->size <= INT_MAX - FF_INPUT_BUFFER_PADDING_SIZE);\n    if (!pkt->size)\n        return av_new_packet(pkt, grow_by);\n    if ((unsigned)grow_by >\n        INT_MAX - (pkt->size + FF_INPUT_BUFFER_PADDING_SIZE))\n        return -1;\n    new_size = pkt->size + grow_by + FF_INPUT_BUFFER_PADDING_SIZE;\n    if (pkt->buf) {\n        int ret = av_buffer_realloc(&pkt->buf, new_size);\n        if (ret < 0)\n            return ret;\n    } else {\n        pkt->buf = av_buffer_alloc(new_size);\n        if (!pkt->buf)\n            return AVERROR(ENOMEM);\n        memcpy(pkt->buf->data, pkt->data, FFMIN(pkt->size, pkt->size + grow_by));\n#if FF_API_DESTRUCT_PACKET\n        pkt->destruct = dummy_destruct_packet;\n#endif\n    }\n    pkt->data  = pkt->buf->data;\n    pkt->size += grow_by;\n    memset(pkt->data + pkt->size, 0, FF_INPUT_BUFFER_PADDING_SIZE);\n    return 0;\n}']