libavcodec/mlp_parser.c:159: error: Integer Overflow L2
  ([0, 2⋅`*bc->buffer` + 28] - 2):unsigned32 by call to `ff_mlp_checksum16`.

libavcodec/mlp_parser.c:146:1: Parameter `*bc->buffer`
144.  */
145. 
146. int ff_mlp_read_major_sync(void *log, MLPHeaderInfo *mh, BitstreamContext *bc)
     ^
147. {
148.     int ratebits, channel_arrangement, header_size;

libavcodec/mlp_parser.c:153:19: Call
151.     assert(bitstream_tell(bc) == 0);
152. 
153.     header_size = ff_mlp_get_major_sync_size(bc->buffer, bc->size_in_bits >> 3);
                       ^
154.     if (header_size < 0 || bc->size_in_bits < header_size << 3) {
155.         av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\n");

libavcodec/mlp_parser.c:128:9: Assignment
  126.     int size = 28;
  127.     if (bufsize < 28)
  128.         return -1;
               ^
  129. 
  130.     if (AV_RB32(buf) == 0xf8726fba) {

libavcodec/mlp_parser.c:153:5: Assignment
151.     assert(bitstream_tell(bc) == 0);
152. 
153.     header_size = ff_mlp_get_major_sync_size(bc->buffer, bc->size_in_bits >> 3);
         ^
154.     if (header_size < 0 || bc->size_in_bits < header_size << 3) {
155.         av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\n");

libavcodec/mlp_parser.c:159:16: Call
157.     }
158. 
159.     checksum = ff_mlp_checksum16(bc->buffer, header_size - 2);
                    ^
160.     if (checksum != AV_RL16(bc->buffer + header_size - 2)) {
161.         av_log(log, AV_LOG_ERROR, "major sync info header checksum error\n");

libavcodec/mlp.c:64:1: <LHS trace>
62. }
63. 
64. uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)
    ^
65. {
66.     uint16_t crc;

libavcodec/mlp.c:64:1: Parameter `buf_size`
  62. }
  63. 
  64. uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)
      ^
  65. {
  66.     uint16_t crc;

libavcodec/mlp.c:68:11: Binary operation: ([0, 2⋅*bc->buffer + 28] - 2):unsigned32 by call to `ff_mlp_checksum16` 
  66.     uint16_t crc;
  67. 
  68.     crc = av_crc(crc_2D, 0, buf, buf_size - 2);
                ^
  69.     crc ^= AV_RL16(buf + buf_size - 2);
  70.     return crc;

uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)
{
    uint16_t crc;
    crc = av_crc(crc_2D, 0, buf, buf_size - 2);
    crc ^= AV_RL16(buf + buf_size - 2);
    return crc;
}
['int ff_mlp_read_major_sync(void *log, MLPHeaderInfo *mh, BitstreamContext *bc)\n{\n    int ratebits, channel_arrangement, header_size;\n    uint16_t checksum;\n    assert(bitstream_tell(bc) == 0);\n    header_size = ff_mlp_get_major_sync_size(bc->buffer, bc->size_in_bits >> 3);\n    if (header_size < 0 || bc->size_in_bits < header_size << 3) {\n        av_log(log, AV_LOG_ERROR, "packet too short, unable to read major sync\\n");\n        return -1;\n    }\n    checksum = ff_mlp_checksum16(bc->buffer, header_size - 2);\n    if (checksum != AV_RL16(bc->buffer + header_size - 2)) {\n        av_log(log, AV_LOG_ERROR, "major sync info header checksum error\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (bitstream_read(bc, 24) != 0xf8726f)\n        return AVERROR_INVALIDDATA;\n    mh->stream_type = bitstream_read(bc, 8);\n    mh->header_size = header_size;\n    if (mh->stream_type == 0xbb) {\n        mh->group1_bits = mlp_quants[bitstream_read(bc, 4)];\n        mh->group2_bits = mlp_quants[bitstream_read(bc, 4)];\n        ratebits = bitstream_read(bc, 4);\n        mh->group1_samplerate = mlp_samplerate(ratebits);\n        mh->group2_samplerate = mlp_samplerate(bitstream_read(bc, 4));\n        bitstream_skip(bc, 11);\n        channel_arrangement    = bitstream_read(bc, 5);\n        mh->channels_mlp       = mlp_channels[channel_arrangement];\n        mh->channel_layout_mlp = mlp_layout[channel_arrangement];\n    } else if (mh->stream_type == 0xba) {\n        mh->group1_bits = 24;\n        mh->group2_bits = 0;\n        ratebits = bitstream_read(bc, 4);\n        mh->group1_samplerate = mlp_samplerate(ratebits);\n        mh->group2_samplerate = 0;\n        bitstream_skip(bc, 4);\n        mh->channel_modifier_thd_stream0 = bitstream_read(bc, 2);\n        mh->channel_modifier_thd_stream1 = bitstream_read(bc, 2);\n        channel_arrangement            = bitstream_read(bc, 5);\n        mh->channels_thd_stream1       = truehd_channels(channel_arrangement);\n        mh->channel_layout_thd_stream1 = truehd_layout(channel_arrangement);\n        mh->channel_modifier_thd_stream2 = bitstream_read(bc, 2);\n        channel_arrangement            = bitstream_read(bc, 13);\n        mh->channels_thd_stream2       = truehd_channels(channel_arrangement);\n        mh->channel_layout_thd_stream2 = truehd_layout(channel_arrangement);\n    } else\n        return AVERROR_INVALIDDATA;\n    mh->access_unit_size = 40 << (ratebits & 7);\n    mh->access_unit_size_pow2 = 64 << (ratebits & 7);\n    bitstream_skip(bc, 48);\n    mh->is_vbr = bitstream_read_bit(bc);\n    mh->peak_bitrate = (bitstream_read(bc, 15) * mh->group1_samplerate + 8) >> 4;\n    mh->num_substreams = bitstream_read(bc, 4);\n    bitstream_skip(bc, 4 + (header_size - 17) * 8);\n    return 0;\n}', 'static int ff_mlp_get_major_sync_size(const uint8_t * buf, int bufsize)\n{\n    int has_extension, extensions = 0;\n    int size = 28;\n    if (bufsize < 28)\n        return -1;\n    if (AV_RB32(buf) == 0xf8726fba) {\n        has_extension = buf[25] & 1;\n        if (has_extension) {\n            extensions = buf[26] >> 4;\n            size += 2 + extensions * 2;\n        }\n    }\n    return size;\n}', 'uint16_t ff_mlp_checksum16(const uint8_t *buf, unsigned int buf_size)\n{\n    uint16_t crc;\n    crc = av_crc(crc_2D, 0, buf, buf_size - 2);\n    crc ^= AV_RL16(buf + buf_size - 2);\n    return crc;\n}']