libavcodec/eamad.c:302: error: Integer Overflow L2
  ([-1, +oo] - 1):unsigned32 by call to `decode_mb`.

libavcodec/eamad.c:298:5: Call
296.     s->bbdsp.bswap16_buf(s->bitstream_buf, (const uint16_t *)(buf + bytestream2_tell(&gb)),
297.                          bytestream2_get_bytes_left(&gb) / 2);
298.     bitstream_init8(&s->bc, s->bitstream_buf, bytestream2_get_bytes_left(&gb));
         ^
299. 
300.     for (s->mb_y=0; s->mb_y < (avctx->height+15)/16; s->mb_y++)

libavcodec/bitstream.h:104:1: Parameter `bc->bits_left`
  102. 
  103. /* Initialize BitstreamContext with buffer size in bytes instead of bits. */
  104. static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,
       ^
  105.                                   unsigned byte_size)
  106. {

libavcodec/eamad.c:302:13: Call
300.     for (s->mb_y=0; s->mb_y < (avctx->height+15)/16; s->mb_y++)
301.         for (s->mb_x=0; s->mb_x < (avctx->width +15)/16; s->mb_x++)
302.             decode_mb(s, frame, inter);
                 ^
303. 
304.     *got_frame = 1;

libavcodec/eamad.c:197:1: Parameter `s->bc.bits_left`
  195. }
  196. 
  197. static void decode_mb(MadContext *s, AVFrame *frame, int inter)
       ^
  198. {
  199.     int mv_map = 0;

libavcodec/eamad.c:204:17: Call
  202. 
  203.     if (inter) {
  204.         int v = bitstream_decode210(&s->bc);
                       ^
  205.         if (v < 2) {
  206.             mv_map = v ? bitstream_read(&s->bc, 6) : 63;

libavcodec/bitstream.h:372:1: Parameter `bc->bits_left`
    370. 
    371. /* Return decoded truncated unary code for the values 2, 1, 0. */
    372. static inline int bitstream_decode210(BitstreamContext *bc)
         ^
    373. {
    374.     if (bitstream_read_bit(bc))

libavcodec/bitstream.h:374:9: Call
    372. static inline int bitstream_decode210(BitstreamContext *bc)
    373. {
    374.     if (bitstream_read_bit(bc))
                 ^
    375.         return 0;
    376.     else

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
      143. 
      144. /* Return one bit from the buffer. */
      145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
           ^
      146. {
      147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
      148.         refill_64(bc);
      149. 
      150.     return get_val(bc, 1);
                      ^
      151. }
      152. 

libavcodec/bitstream.h:130:1: Parameter `n`
        128. }
        129. 
        130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
             ^
        131. {
        132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
        137.     bc->bits <<= n;
        138. #endif
        139.     bc->bits_left -= n;
                 ^
        140. 
        141.     return ret;

libavcodec/bitstream.h:377:20: Call
    375.         return 0;
    376.     else
    377.         return 2 - bitstream_read_bit(bc);
                            ^
    378. }
    379. 

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
      143. 
      144. /* Return one bit from the buffer. */
      145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
           ^
      146. {
      147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
      148.         refill_64(bc);
      149. 
      150.     return get_val(bc, 1);
                      ^
      151. }
      152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
        128. }
        129. 
        130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
             ^
        131. {
        132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
        128. }
        129. 
        130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
             ^
        131. {
        132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([-1, +oo] - 1):unsigned32 by call to `decode_mb` 
        137.     bc->bits <<= n;
        138. #endif
        139.     bc->bits_left -= n;
                 ^
        140. 
        141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int decode_frame(AVCodecContext *avctx,\n                        void *data, int *got_frame,\n                        AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    MadContext *s     = avctx->priv_data;\n    AVFrame *frame    = data;\n    GetByteContext gb;\n    int width, height;\n    int chunk_type;\n    int inter, ret;\n    bytestream2_init(&gb, buf, buf_size);\n    chunk_type = bytestream2_get_le32(&gb);\n    inter = (chunk_type == MADm_TAG || chunk_type == MADe_TAG);\n    bytestream2_skip(&gb, 10);\n    av_reduce(&avctx->framerate.den, &avctx->framerate.num,\n              bytestream2_get_le16(&gb), 1000, 1<<30);\n    width  = bytestream2_get_le16(&gb);\n    height = bytestream2_get_le16(&gb);\n    bytestream2_skip(&gb, 1);\n    calc_quant_matrix(s, bytestream2_get_byte(&gb));\n    bytestream2_skip(&gb, 2);\n    if (bytestream2_get_bytes_left(&gb) < 2) {\n        av_log(avctx, AV_LOG_ERROR, "Input data too small\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    if (avctx->width != width || avctx->height != height) {\n        av_frame_unref(s->last_frame);\n        if ((ret = ff_set_dimensions(avctx, width, height)) < 0)\n            return ret;\n    }\n    if ((ret = ff_get_buffer(avctx, frame, AV_GET_BUFFER_FLAG_REF)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return ret;\n    }\n    if (inter && !s->last_frame->data[0]) {\n        av_log(avctx, AV_LOG_WARNING, "Missing reference frame.\\n");\n        ret = ff_get_buffer(avctx, s->last_frame, AV_GET_BUFFER_FLAG_REF);\n        if (ret < 0)\n            return ret;\n        memset(s->last_frame->data[0], 0, s->last_frame->height *\n               s->last_frame->linesize[0]);\n        memset(s->last_frame->data[1], 0x80, s->last_frame->height / 2 *\n               s->last_frame->linesize[1]);\n        memset(s->last_frame->data[2], 0x80, s->last_frame->height / 2 *\n               s->last_frame->linesize[2]);\n    }\n    av_fast_padded_malloc(&s->bitstream_buf, &s->bitstream_buf_size,\n                          bytestream2_get_bytes_left(&gb));\n    if (!s->bitstream_buf)\n        return AVERROR(ENOMEM);\n    s->bbdsp.bswap16_buf(s->bitstream_buf, (const uint16_t *)(buf + bytestream2_tell(&gb)),\n                         bytestream2_get_bytes_left(&gb) / 2);\n    bitstream_init8(&s->bc, s->bitstream_buf, bytestream2_get_bytes_left(&gb));\n    for (s->mb_y=0; s->mb_y < (avctx->height+15)/16; s->mb_y++)\n        for (s->mb_x=0; s->mb_x < (avctx->width +15)/16; s->mb_x++)\n            decode_mb(s, frame, inter);\n    *got_frame = 1;\n    if (chunk_type != MADe_TAG) {\n        av_frame_unref(s->last_frame);\n        if ((ret = av_frame_ref(s->last_frame, frame)) < 0)\n            return ret;\n    }\n    return buf_size;\n}', 'static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,\n                                  unsigned byte_size)\n{\n    if (byte_size > INT_MAX / 8)\n        return AVERROR_INVALIDDATA;\n    return bitstream_init(bc, buffer, byte_size * 8);\n}', 'static void decode_mb(MadContext *s, AVFrame *frame, int inter)\n{\n    int mv_map = 0;\n    int mv_x, mv_y;\n    int j;\n    if (inter) {\n        int v = bitstream_decode210(&s->bc);\n        if (v < 2) {\n            mv_map = v ? bitstream_read(&s->bc, 6) : 63;\n            mv_x = decode_motion(&s->bc);\n            mv_y = decode_motion(&s->bc);\n        } else {\n            mv_map = 0;\n        }\n    }\n    for (j=0; j<6; j++) {\n        if (mv_map & (1<<j)) {\n            int add = 2 * decode_motion(&s->bc);\n            comp_block(s, frame, s->mb_x, s->mb_y, j, mv_x, mv_y, add);\n        } else {\n            s->bdsp.clear_block(s->block);\n            decode_block_intra(s, s->block);\n            idct_put(s, frame, s->block, s->mb_x, s->mb_y, j);\n        }\n    }\n}', 'static inline int bitstream_decode210(BitstreamContext *bc)\n{\n    if (bitstream_read_bit(bc))\n        return 0;\n    else\n        return 2 - bitstream_read_bit(bc);\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']