libavcodec/vorbisdec.c:1722: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `vorbis_parse_audio_packet`.

libavcodec/vorbisdec.c:1722:16: Call
1720.     init_get_bits(gb, buf, buf_size*8);
1721. 
1722.     if ((len = vorbis_parse_audio_packet(vc, channel_ptrs)) <= 0)
                     ^
1723.         return len;
1724. 

libavcodec/vorbisdec.c:1529:1: Parameter `vc->codebooks->dimensions`
  1527. // Decode the audio packet using the functions above
  1528. 
  1529. static int vorbis_parse_audio_packet(vorbis_context *vc, float **floor_ptr)
        ^
  1530. {
  1531.     GetBitContext *gb = &vc->gb;

libavcodec/vorbisdec.c:1628:19: Call
  1626.         }
  1627.         if (ch) {
  1628.             ret = vorbis_residue_decode(vc, residue, ch, do_not_decode, ch_res_ptr, vlen, ch_left);
                          ^
  1629.             if (ret < 0)
  1630.                 return ret;

libavcodec/vorbisdec.c:1485:1: Parameter `vr->ptns_to_read`
    1483. }
    1484. 
    1485. static inline int vorbis_residue_decode(vorbis_context *vc, vorbis_residue *vr,
          ^
    1486.                                         unsigned ch,
    1487.                                         uint8_t *do_not_decode,

libavcodec/vorbisdec.c:1492:16: Call
    1490. {
    1491.     if (vr->type == 2)
    1492.         return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 2);
                         ^
    1493.     else if (vr->type == 1)
    1494.         return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 1);

libavcodec/vorbisdec.c:1342:1: Parameter `vc->codebooks->dimensions`
      1340. // Read and decode residue
      1341. 
      1342. static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,
            ^
      1343.                                                            vorbis_residue *vr,
      1344.                                                            unsigned ch,

libavcodec/vorbisdec.c:1383:27: Call
      1381.         for (partition_count = 0; partition_count < ptns_to_read;) {  // SPEC        error
      1382.             if (!pass) {
      1383.                 int ret = setup_classifs(vc, vr, do_not_decode, ch_used, partition_count);
                                      ^
      1384.                 if (ret < 0)
      1385.                     return ret;

libavcodec/vorbisdec.c:1304:1: <LHS trace>
1302. }
1303. 
1304. static av_always_inline int setup_classifs(vorbis_context *vc,
      ^
1305.                                            vorbis_residue *vr,
1306.                                            uint8_t *do_not_decode,

libavcodec/vorbisdec.c:1304:1: Parameter `partition_count`
        1302. }
        1303. 
        1304. static av_always_inline int setup_classifs(vorbis_context *vc,
              ^
        1305.                                            vorbis_residue *vr,
        1306.                                            uint8_t *do_not_decode,

libavcodec/vorbisdec.c:1328:18: Binary operation: ([0, +oo] - 1):unsigned32 by call to `vorbis_parse_audio_packet` 
        1326.             }
        1327. 
        1328.             for (i = partition_count + c_p_c - 1; i >= partition_count; i--) {
                               ^
        1329.                 temp2 = (((uint64_t)temp) * inverse_class) >> 32;
        1330. 

static av_always_inline int setup_classifs(vorbis_context *vc,
                                           vorbis_residue *vr,
                                           uint8_t *do_not_decode,
                                           unsigned ch_used,
                                           int partition_count)
{
    vorbis_codebook *codebook = vc->codebooks + vr->classbook;
    int p, j, i;
    unsigned c_p_c         = codebook->dimensions;
    unsigned inverse_class = ff_inverse[vr->classifications];
    int temp, temp2;
    for (p = 0, j = 0; j < ch_used; ++j) {
        if (!do_not_decode[j]) {
            temp = get_vlc2(&vc->gb, codebook->vlc.table,
                                     codebook->nb_bits, 3);
            ff_dlog(NULL, "Classword: %u\n", temp);
            if (temp < 0) {
                av_log(vc->avctx, AV_LOG_ERROR,
                       "Invalid vlc code decoding %d channel.", j);
                return AVERROR_INVALIDDATA;
            }
            for (i = partition_count + c_p_c - 1; i >= partition_count; i--) {
                temp2 = (((uint64_t)temp) * inverse_class) >> 32;
                if (i < vr->ptns_to_read)
                    vr->classifs[p + i] = temp - temp2 * vr->classifications;
                temp = temp2;
            }
        }
        p += vr->ptns_to_read;
    }
    return 0;
}
['static int vorbis_decode_frame(AVCodecContext *avctx, void *data,\n                               int *got_frame_ptr, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    vorbis_context *vc = avctx->priv_data;\n    AVFrame *frame     = data;\n    GetBitContext *gb = &vc->gb;\n    float *channel_ptrs[255];\n    int i, len, ret;\n    ff_dlog(NULL, "packet length %d \\n", buf_size);\n    frame->nb_samples = vc->blocksize[1] / 2;\n    if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    if (vc->audio_channels > 8) {\n        for (i = 0; i < vc->audio_channels; i++)\n            channel_ptrs[i] = (float *)frame->extended_data[i];\n    } else {\n        for (i = 0; i < vc->audio_channels; i++) {\n            int ch = ff_vorbis_channel_layout_offsets[vc->audio_channels - 1][i];\n            channel_ptrs[ch] = (float *)frame->extended_data[i];\n        }\n    }\n    init_get_bits(gb, buf, buf_size*8);\n    if ((len = vorbis_parse_audio_packet(vc, channel_ptrs)) <= 0)\n        return len;\n    if (!vc->first_frame) {\n        vc->first_frame = 1;\n        *got_frame_ptr = 0;\n        av_frame_unref(frame);\n        return buf_size;\n    }\n    ff_dlog(NULL, "parsed %d bytes %d bits, returned %d samples (*ch*bits) \\n",\n            get_bits_count(gb) / 8, get_bits_count(gb) % 8, len);\n    frame->nb_samples = len;\n    *got_frame_ptr    = 1;\n    return buf_size;\n}', 'static int vorbis_parse_audio_packet(vorbis_context *vc, float **floor_ptr)\n{\n    GetBitContext *gb = &vc->gb;\n    FFTContext *mdct;\n    unsigned previous_window = vc->previous_window;\n    unsigned mode_number, blockflag, blocksize;\n    int i, j;\n    uint8_t no_residue[255];\n    uint8_t do_not_decode[255];\n    vorbis_mapping *mapping;\n    float *ch_res_ptr   = vc->channel_residues;\n    uint8_t res_chan[255];\n    unsigned res_num = 0;\n    int retlen  = 0;\n    unsigned ch_left = vc->audio_channels;\n    unsigned vlen;\n    if (get_bits1(gb)) {\n        av_log(vc->avctx, AV_LOG_ERROR, "Not a Vorbis I audio packet.\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (vc->mode_count == 1) {\n        mode_number = 0;\n    } else {\n        GET_VALIDATED_INDEX(mode_number, ilog(vc->mode_count-1), vc->mode_count)\n    }\n    vc->mode_number = mode_number;\n    mapping = &vc->mappings[vc->modes[mode_number].mapping];\n    ff_dlog(NULL, " Mode number: %u , mapping: %d , blocktype %d\\n", mode_number,\n            vc->modes[mode_number].mapping, vc->modes[mode_number].blockflag);\n    blockflag = vc->modes[mode_number].blockflag;\n    blocksize = vc->blocksize[blockflag];\n    vlen = blocksize / 2;\n    if (blockflag) {\n        previous_window = get_bits(gb, 1);\n        skip_bits1(gb);\n    }\n    memset(ch_res_ptr,   0, sizeof(float) * vc->audio_channels * vlen);\n    for (i = 0; i < vc->audio_channels; ++i)\n        memset(floor_ptr[i], 0, vlen * sizeof(floor_ptr[0][0]));\n    for (i = 0; i < vc->audio_channels; ++i) {\n        vorbis_floor *floor;\n        int ret;\n        if (mapping->submaps > 1) {\n            floor = &vc->floors[mapping->submap_floor[mapping->mux[i]]];\n        } else {\n            floor = &vc->floors[mapping->submap_floor[0]];\n        }\n        ret = floor->decode(vc, &floor->data, floor_ptr[i]);\n        if (ret < 0) {\n            av_log(vc->avctx, AV_LOG_ERROR, "Invalid codebook in vorbis_floor_decode.\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        no_residue[i] = ret;\n    }\n    for (i = mapping->coupling_steps - 1; i >= 0; --i) {\n        if (!(no_residue[mapping->magnitude[i]] & no_residue[mapping->angle[i]])) {\n            no_residue[mapping->magnitude[i]] = 0;\n            no_residue[mapping->angle[i]]     = 0;\n        }\n    }\n    for (i = 0; i < mapping->submaps; ++i) {\n        vorbis_residue *residue;\n        unsigned ch = 0;\n        int ret;\n        for (j = 0; j < vc->audio_channels; ++j) {\n            if ((mapping->submaps == 1) || (i == mapping->mux[j])) {\n                res_chan[j] = res_num;\n                if (no_residue[j]) {\n                    do_not_decode[ch] = 1;\n                } else {\n                    do_not_decode[ch] = 0;\n                }\n                ++ch;\n                ++res_num;\n            }\n        }\n        residue = &vc->residues[mapping->submap_residue[i]];\n        if (ch_left < ch) {\n            av_log(vc->avctx, AV_LOG_ERROR, "Too many channels in vorbis_floor_decode.\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        if (ch) {\n            ret = vorbis_residue_decode(vc, residue, ch, do_not_decode, ch_res_ptr, vlen, ch_left);\n            if (ret < 0)\n                return ret;\n        }\n        ch_res_ptr += ch * vlen;\n        ch_left -= ch;\n    }\n    if (ch_left > 0)\n        return AVERROR_INVALIDDATA;\n    for (i = mapping->coupling_steps - 1; i >= 0; --i) {\n        float *mag, *ang;\n        mag = vc->channel_residues+res_chan[mapping->magnitude[i]] * blocksize / 2;\n        ang = vc->channel_residues+res_chan[mapping->angle[i]]     * blocksize / 2;\n        vc->dsp.vorbis_inverse_coupling(mag, ang, blocksize / 2);\n    }\n    mdct = &vc->mdct[blockflag];\n    for (j = vc->audio_channels-1;j >= 0; j--) {\n        ch_res_ptr   = vc->channel_residues + res_chan[j] * blocksize / 2;\n        vc->fdsp.vector_fmul(floor_ptr[j], floor_ptr[j], ch_res_ptr, blocksize / 2);\n        mdct->imdct_half(mdct, ch_res_ptr, floor_ptr[j]);\n    }\n    retlen = (blocksize + vc->blocksize[previous_window]) / 4;\n    for (j = 0; j < vc->audio_channels; j++) {\n        unsigned bs0 = vc->blocksize[0];\n        unsigned bs1 = vc->blocksize[1];\n        float *residue    = vc->channel_residues + res_chan[j] * blocksize / 2;\n        float *saved      = vc->saved + j * bs1 / 4;\n        float *ret        = floor_ptr[j];\n        float *buf        = residue;\n        const float *win  = vc->win[blockflag & previous_window];\n        if (blockflag == previous_window) {\n            vc->fdsp.vector_fmul_window(ret, saved, buf, win, blocksize / 4);\n        } else if (blockflag > previous_window) {\n            vc->fdsp.vector_fmul_window(ret, saved, buf, win, bs0 / 4);\n            memcpy(ret+bs0/2, buf+bs0/4, ((bs1-bs0)/4) * sizeof(float));\n        } else {\n            memcpy(ret, saved, ((bs1 - bs0) / 4) * sizeof(float));\n            vc->fdsp.vector_fmul_window(ret + (bs1 - bs0) / 4, saved + (bs1 - bs0) / 4, buf, win, bs0 / 4);\n        }\n        memcpy(saved, buf + blocksize / 4, blocksize / 4 * sizeof(float));\n    }\n    vc->previous_window = blockflag;\n    return retlen;\n}', 'static inline int vorbis_residue_decode(vorbis_context *vc, vorbis_residue *vr,\n                                        unsigned ch,\n                                        uint8_t *do_not_decode,\n                                        float *vec, unsigned vlen,\n                                        unsigned ch_left)\n{\n    if (vr->type == 2)\n        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 2);\n    else if (vr->type == 1)\n        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 1);\n    else if (vr->type == 0)\n        return vorbis_residue_decode_internal(vc, vr, ch, do_not_decode, vec, vlen, ch_left, 0);\n    else {\n        av_log(vc->avctx, AV_LOG_ERROR, " Invalid residue type while residue decode?! \\n");\n        return AVERROR_INVALIDDATA;\n    }\n}', 'static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc,\n                                                           vorbis_residue *vr,\n                                                           unsigned ch,\n                                                           uint8_t *do_not_decode,\n                                                           float *vec,\n                                                           unsigned vlen,\n                                                           unsigned ch_left,\n                                                           int vr_type)\n{\n    GetBitContext *gb = &vc->gb;\n    unsigned c_p_c        = vc->codebooks[vr->classbook].dimensions;\n    uint8_t *classifs = vr->classifs;\n    unsigned pass, ch_used, i, j, k, l;\n    unsigned max_output = (ch - 1) * vlen;\n    int ptns_to_read = vr->ptns_to_read;\n    if (vr_type == 2) {\n        for (j = 1; j < ch; ++j)\n            do_not_decode[0] &= do_not_decode[j];\n        if (do_not_decode[0])\n            return 0;\n        ch_used = 1;\n        max_output += vr->end / ch;\n    } else {\n        ch_used = ch;\n        max_output += vr->end;\n    }\n    if (max_output > ch_left * vlen) {\n        av_log(vc->avctx, AV_LOG_ERROR, "Insufficient output buffer\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    ff_dlog(NULL, " residue type 0/1/2 decode begin, ch: %d  cpc %d  \\n", ch, c_p_c);\n    for (pass = 0; pass <= vr->maxpass; ++pass) {\n        int voffset, partition_count, j_times_ptns_to_read;\n        voffset = vr->begin;\n        for (partition_count = 0; partition_count < ptns_to_read;) {\n            if (!pass) {\n                int ret = setup_classifs(vc, vr, do_not_decode, ch_used, partition_count);\n                if (ret < 0)\n                    return ret;\n            }\n            for (i = 0; (i < c_p_c) && (partition_count < ptns_to_read); ++i) {\n                for (j_times_ptns_to_read = 0, j = 0; j < ch_used; ++j) {\n                    unsigned voffs;\n                    if (!do_not_decode[j]) {\n                        unsigned vqclass = classifs[j_times_ptns_to_read + partition_count];\n                        int vqbook  = vr->books[vqclass][pass];\n                        if (vqbook >= 0 && vc->codebooks[vqbook].codevectors) {\n                            unsigned coffs;\n                            unsigned dim  = vc->codebooks[vqbook].dimensions;\n                            unsigned step = FASTDIV(vr->partition_size << 1, dim << 1);\n                            vorbis_codebook codebook = vc->codebooks[vqbook];\n                            if (vr_type == 0) {\n                                voffs = voffset+j*vlen;\n                                for (k = 0; k < step; ++k) {\n                                    coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * dim;\n                                    for (l = 0; l < dim; ++l)\n                                        vec[voffs + k + l * step] += codebook.codevectors[coffs + l];\n                                }\n                            } else if (vr_type == 1) {\n                                voffs = voffset + j * vlen;\n                                for (k = 0; k < step; ++k) {\n                                    coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * dim;\n                                    for (l = 0; l < dim; ++l, ++voffs) {\n                                        vec[voffs]+=codebook.codevectors[coffs+l];\n                                        ff_dlog(NULL, " pass %d offs: %d curr: %f change: %f cv offs.: %d  \\n",\n                                                pass, voffs, vec[voffs], codebook.codevectors[coffs+l], coffs);\n                                    }\n                                }\n                            } else if (vr_type == 2 && ch == 2 && (voffset & 1) == 0 && (dim & 1) == 0) {\n                                voffs = voffset >> 1;\n                                if (dim == 2) {\n                                    for (k = 0; k < step; ++k) {\n                                        coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * 2;\n                                        vec[voffs + k       ] += codebook.codevectors[coffs    ];\n                                        vec[voffs + k + vlen] += codebook.codevectors[coffs + 1];\n                                    }\n                                } else if (dim == 4) {\n                                    for (k = 0; k < step; ++k, voffs += 2) {\n                                        coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * 4;\n                                        vec[voffs           ] += codebook.codevectors[coffs    ];\n                                        vec[voffs + 1       ] += codebook.codevectors[coffs + 2];\n                                        vec[voffs + vlen    ] += codebook.codevectors[coffs + 1];\n                                        vec[voffs + vlen + 1] += codebook.codevectors[coffs + 3];\n                                    }\n                                } else\n                                for (k = 0; k < step; ++k) {\n                                    coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * dim;\n                                    for (l = 0; l < dim; l += 2, voffs++) {\n                                        vec[voffs       ] += codebook.codevectors[coffs + l    ];\n                                        vec[voffs + vlen] += codebook.codevectors[coffs + l + 1];\n                                        ff_dlog(NULL, " pass %d offs: %d curr: %f change: %f cv offs.: %d+%d  \\n",\n                                                pass, voffset / ch + (voffs % ch) * vlen,\n                                                vec[voffset / ch + (voffs % ch) * vlen],\n                                                codebook.codevectors[coffs + l], coffs, l);\n                                    }\n                                }\n                            } else if (vr_type == 2) {\n                                unsigned voffs_div = FASTDIV(voffset << 1, ch <<1);\n                                unsigned voffs_mod = voffset - voffs_div * ch;\n                                for (k = 0; k < step; ++k) {\n                                    coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * dim;\n                                    for (l = 0; l < dim; ++l) {\n                                        vec[voffs_div + voffs_mod * vlen] +=\n                                            codebook.codevectors[coffs + l];\n                                        ff_dlog(NULL, " pass %d offs: %d curr: %f change: %f cv offs.: %d+%d  \\n",\n                                                pass, voffs_div + voffs_mod * vlen,\n                                                vec[voffs_div + voffs_mod * vlen],\n                                                codebook.codevectors[coffs + l], coffs, l);\n                                        if (++voffs_mod == ch) {\n                                            voffs_div++;\n                                            voffs_mod = 0;\n                                        }\n                                    }\n                                }\n                            }\n                        }\n                    }\n                    j_times_ptns_to_read += ptns_to_read;\n                }\n                ++partition_count;\n                voffset += vr->partition_size;\n            }\n        }\n    }\n    return 0;\n}', 'static av_always_inline int setup_classifs(vorbis_context *vc,\n                                           vorbis_residue *vr,\n                                           uint8_t *do_not_decode,\n                                           unsigned ch_used,\n                                           int partition_count)\n{\n    vorbis_codebook *codebook = vc->codebooks + vr->classbook;\n    int p, j, i;\n    unsigned c_p_c         = codebook->dimensions;\n    unsigned inverse_class = ff_inverse[vr->classifications];\n    int temp, temp2;\n    for (p = 0, j = 0; j < ch_used; ++j) {\n        if (!do_not_decode[j]) {\n            temp = get_vlc2(&vc->gb, codebook->vlc.table,\n                                     codebook->nb_bits, 3);\n            ff_dlog(NULL, "Classword: %u\\n", temp);\n            if (temp < 0) {\n                av_log(vc->avctx, AV_LOG_ERROR,\n                       "Invalid vlc code decoding %d channel.", j);\n                return AVERROR_INVALIDDATA;\n            }\n            for (i = partition_count + c_p_c - 1; i >= partition_count; i--) {\n                temp2 = (((uint64_t)temp) * inverse_class) >> 32;\n                if (i < vr->ptns_to_read)\n                    vr->classifs[p + i] = temp - temp2 * vr->classifications;\n                temp = temp2;\n            }\n        }\n        p += vr->ptns_to_read;\n    }\n    return 0;\n}']