libavcodec/h261dec.c:441: error: Integer Overflow L2
  ([0, +oo] - 2):unsigned32 by call to `h261_decode_block`.

libavcodec/h261dec.c:393:26: Call
391.     // Read mquant
392.     if (IS_QUANT(h->mtype))
393.         ff_set_qscale(s, bitstream_read(&s->bc, 5));
                              ^
394. 
395.     s->mb_intra = IS_INTRA4x4(h->mtype);

libavcodec/bitstream.h:183:1: Parameter `bc->bits_left`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/h261dec.c:441:17: Call
439.         s->bdsp.clear_blocks(s->block[0]);
440.         for (i = 0; i < 6; i++) {
441.             if (h261_decode_block(h, s->block[i], i, cbp & 32) < 0)
                     ^
442.                 return SLICE_ERROR;
443.             cbp += cbp;

libavcodec/h261dec.c:259:1: Parameter `h->s.bc.bits_left`
  257.  * @return <0 if an error occurred
  258.  */
  259. static int h261_decode_block(H261Context *h, int16_t *block, int n, int coded)
       ^
  260. {
  261.     MpegEncContext *const s = &h->s;

libavcodec/h261dec.c:293:21: Call
  291.         // 0    1       1s
  292.         // *    *       0*
  293.         int check = bitstream_peek(&s->bc, 2);
                           ^
  294.         i = 0;
  295.         if (check & 0x2) {

libavcodec/bitstream.h:215:1: Parameter `n`
    213. /* Return n bits from the buffer, but do not change the buffer state.
    214.  * n has to be in the 0-32 range. */
    215. static inline unsigned bitstream_peek(BitstreamContext *bc, unsigned n)
         ^
    216. {
    217.     if (n > bc->bits_left)

libavcodec/h261dec.c:296:13: Call
  294.         i = 0;
  295.         if (check & 0x2) {
  296.             bitstream_skip(&s->bc, 2);
                   ^
  297.             block[0] = (check & 0x1) ? -1 : 1;
  298.             i        = 1;

libavcodec/bitstream.h:241:1: Parameter `n`
    239. 
    240. /* Skip n bits in the buffer. */
    241. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
         ^
    242. {
    243.     if (n <= bc->bits_left)

libavcodec/bitstream.h:244:9: Call
    242. {
    243.     if (n <= bc->bits_left)
    244.         skip_remaining(bc, n);
                 ^
    245.     else {
    246.         n -= bc->bits_left;

libavcodec/bitstream.h:230:1: <LHS trace>
228. }
229. 
230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
231. {
232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: Parameter `bc->bits_left`
      228. }
      229. 
      230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
           ^
      231. {
      232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: <RHS trace>
228. }
229. 
230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
231. {
232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: Parameter `n`
      228. }
      229. 
      230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
           ^
      231. {
      232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:237:5: Binary operation: ([0, +oo] - 2):unsigned32 by call to `h261_decode_block` 
      235.     bc->bits <<= n;
      236. #endif
      237.     bc->bits_left -= n;
               ^
      238. }
      239. 

static inline void skip_remaining(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    bc->bits >>= n;
#else
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
}
['static int h261_decode_mb(H261Context *h)\n{\n    MpegEncContext *const s = &h->s;\n    int i, cbp, xy;\n    cbp = 63;\n    do {\n        h->mba_diff = bitstream_read_vlc(&s->bc, h261_mba_vlc.table,\n                                         H261_MBA_VLC_BITS, 2);\n        if (h->mba_diff == MBA_STARTCODE) {\n            h->gob_start_code_skipped = 1;\n            return SLICE_END;\n        }\n    } while (h->mba_diff == MBA_STUFFING);\n    if (h->mba_diff < 0) {\n        if (bitstream_bits_left(&s->bc) <= 7)\n            return SLICE_END;\n        av_log(s->avctx, AV_LOG_ERROR, "illegal mba at %d %d\\n", s->mb_x, s->mb_y);\n        return SLICE_ERROR;\n    }\n    h->mba_diff    += 1;\n    h->current_mba += h->mba_diff;\n    if (h->current_mba > MBA_STUFFING)\n        return SLICE_ERROR;\n    s->mb_x = ((h->gob_number - 1) % 2) * 11 + ((h->current_mba - 1) % 11);\n    s->mb_y = ((h->gob_number - 1) / 2) * 3 + ((h->current_mba - 1) / 11);\n    xy      = s->mb_x + s->mb_y * s->mb_stride;\n    ff_init_block_index(s);\n    ff_update_block_index(s);\n    h->mtype = bitstream_read_vlc(&s->bc, h261_mtype_vlc.table, H261_MTYPE_VLC_BITS, 2);\n    if (h->mtype < 0 || h->mtype >= FF_ARRAY_ELEMS(ff_h261_mtype_map)) {\n        av_log(s->avctx, AV_LOG_ERROR, "Invalid mtype index %d\\n",\n               h->mtype);\n        return SLICE_ERROR;\n    }\n    h->mtype = ff_h261_mtype_map[h->mtype];\n    if (IS_QUANT(h->mtype))\n        ff_set_qscale(s, bitstream_read(&s->bc, 5));\n    s->mb_intra = IS_INTRA4x4(h->mtype);\n    if (IS_16X16(h->mtype)) {\n        if ((h->current_mba ==  1) || (h->current_mba == 12) ||\n            (h->current_mba == 23) || (h->mba_diff != 1)) {\n            h->current_mv_x = 0;\n            h->current_mv_y = 0;\n        }\n        h->current_mv_x = decode_mv_component(&s->bc, h->current_mv_x);\n        h->current_mv_y = decode_mv_component(&s->bc, h->current_mv_y);\n    } else {\n        h->current_mv_x = 0;\n        h->current_mv_y = 0;\n    }\n    if (HAS_CBP(h->mtype))\n        cbp = bitstream_read_vlc(&s->bc, h261_cbp_vlc.table, H261_CBP_VLC_BITS, 2) + 1;\n    if (s->mb_intra) {\n        s->current_picture.mb_type[xy] = MB_TYPE_INTRA;\n        goto intra;\n    }\n    s->mv_dir                      = MV_DIR_FORWARD;\n    s->mv_type                     = MV_TYPE_16X16;\n    s->current_picture.mb_type[xy] = MB_TYPE_16x16 | MB_TYPE_L0;\n    s->mv[0][0][0]                 = h->current_mv_x * 2;\n    s->mv[0][0][1]                 = h->current_mv_y * 2;\nintra:\n    if (s->mb_intra || HAS_CBP(h->mtype)) {\n        s->bdsp.clear_blocks(s->block[0]);\n        for (i = 0; i < 6; i++) {\n            if (h261_decode_block(h, s->block[i], i, cbp & 32) < 0)\n                return SLICE_ERROR;\n            cbp += cbp;\n        }\n    } else {\n        for (i = 0; i < 6; i++)\n            s->block_last_index[i] = -1;\n    }\n    ff_mpv_decode_mb(s, s->block);\n    return SLICE_OK;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static int h261_decode_block(H261Context *h, int16_t *block, int n, int coded)\n{\n    MpegEncContext *const s = &h->s;\n    int code, level, i, j, run;\n    RLTable *rl = &ff_h261_rl_tcoeff;\n    const uint8_t *scan_table;\n    scan_table = s->intra_scantable.permutated;\n    if (s->mb_intra) {\n        level = bitstream_read(&s->bc, 8);\n        if ((level & 0x7F) == 0) {\n            av_log(s->avctx, AV_LOG_ERROR, "illegal dc %d at %d %d\\n",\n                   level, s->mb_x, s->mb_y);\n            return -1;\n        }\n        if (level == 255)\n            level = 128;\n        block[0] = level;\n        i        = 1;\n    } else if (coded) {\n        int check = bitstream_peek(&s->bc, 2);\n        i = 0;\n        if (check & 0x2) {\n            bitstream_skip(&s->bc, 2);\n            block[0] = (check & 0x1) ? -1 : 1;\n            i        = 1;\n        }\n    } else {\n        i = 0;\n    }\n    if (!coded) {\n        s->block_last_index[n] = i - 1;\n        return 0;\n    }\n    for (;;) {\n        code = bitstream_read_vlc(&s->bc, rl->vlc.table, TCOEFF_VLC_BITS, 2);\n        if (code < 0) {\n            av_log(s->avctx, AV_LOG_ERROR, "illegal ac vlc code at %dx%d\\n",\n                   s->mb_x, s->mb_y);\n            return -1;\n        }\n        if (code == rl->n) {\n            run   = bitstream_read(&s->bc, 6);\n            level = bitstream_read_signed(&s->bc, 8);\n        } else if (code == 0) {\n            break;\n        } else {\n            run   = rl->table_run[code];\n            level = rl->table_level[code];\n            if (bitstream_read_bit(&s->bc))\n                level = -level;\n        }\n        i += run;\n        if (i >= 64) {\n            av_log(s->avctx, AV_LOG_ERROR, "run overflow at %dx%d\\n",\n                   s->mb_x, s->mb_y);\n            return -1;\n        }\n        j        = scan_table[i];\n        block[j] = level;\n        i++;\n    }\n    s->block_last_index[n] = i - 1;\n    return 0;\n}', 'static inline unsigned bitstream_peek(BitstreamContext *bc, unsigned n)\n{\n    if (n > bc->bits_left)\n        refill_32(bc);\n    return show_val(bc, n);\n}', 'static inline void bitstream_skip(BitstreamContext *bc, unsigned n)\n{\n    if (n <= bc->bits_left)\n        skip_remaining(bc, n);\n    else {\n        n -= bc->bits_left;\n        skip_remaining(bc, bc->bits_left);\n        if (n >= 64) {\n            unsigned skip = n / 8;\n            n -= skip * 8;\n            bc->ptr += skip;\n        }\n        refill_64(bc);\n        if (n)\n            skip_remaining(bc, n);\n    }\n}', 'static inline void skip_remaining(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    bc->bits >>= n;\n#else\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n}']