libavformat/avidec.c:718: error: Integer Overflow L1
  ([0, 2] - 55296):unsigned32.

libavformat/avidec.c:718:13: <LHS trace>
716.             uint8_t tmp;
717.             uint32_t ch;
718.             GET_UTF16(ch, ptr < end-1 ? bytestream_get_le16(&ptr) : 0, break;);
                 ^
719.             PUT_UTF8(ch, tmp, if(d-desc < sizeof(desc)-1)  *d++ = tmp;);
720.         }

libavformat/avidec.c:718:13: Assignment
716.             uint8_t tmp;
717.             uint32_t ch;
718.             GET_UTF16(ch, ptr < end-1 ? bytestream_get_le16(&ptr) : 0, break;);
                 ^
719.             PUT_UTF8(ch, tmp, if(d-desc < sizeof(desc)-1)  *d++ = tmp;);
720.         }

libavformat/avidec.c:718:13: Assignment
716.             uint8_t tmp;
717.             uint32_t ch;
718.             GET_UTF16(ch, ptr < end-1 ? bytestream_get_le16(&ptr) : 0, break;);
                 ^
719.             PUT_UTF8(ch, tmp, if(d-desc < sizeof(desc)-1)  *d++ = tmp;);
720.         }

libavformat/avidec.c:718:13: Binary operation: ([0, 2] - 55296):unsigned32
716.             uint8_t tmp;
717.             uint32_t ch;
718.             GET_UTF16(ch, ptr < end-1 ? bytestream_get_le16(&ptr) : 0, break;);
                 ^
719.             PUT_UTF8(ch, tmp, if(d-desc < sizeof(desc)-1)  *d++ = tmp;);
720.         }

static int read_gab2_sub(AVStream *st, AVPacket *pkt) {
    if (!strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data+5) == 2) {
        uint8_t desc[256], *d = desc;
        uint8_t *end, *ptr = pkt->data+7;
        unsigned int size, desc_len = bytestream_get_le32(&ptr);
        int score = AVPROBE_SCORE_MAX / 2;
        AVIStream *ast = st->priv_data;
        AVInputFormat *sub_demuxer;
        AVRational time_base;
        ByteIOContext *pb;
        AVProbeData pd;
        if (desc_len > FFMAX(pkt->size-17, 0))
            return 0;
        end = ptr + desc_len;
        while (ptr < end-1) {
            uint8_t tmp;
            uint32_t ch;
            GET_UTF16(ch, ptr < end-1 ? bytestream_get_le16(&ptr) : 0, break;);
            PUT_UTF8(ch, tmp, if(d-desc < sizeof(desc)-1)  *d++ = tmp;);
        }
        *d = 0;
        if (*desc)
            av_metadata_set2(&st->metadata, "title", desc, 0);
        ptr = end + 2;
        size = bytestream_get_le32(&ptr);
        size = FFMIN(size, pkt->size+pkt->data-ptr);
        pd = (AVProbeData) { .buf = ptr, .buf_size = size };
        if (!(sub_demuxer = av_probe_input_format2(&pd, 1, &score)))
            return 0;
        pb = av_alloc_put_byte(ptr, size, 0, NULL, NULL, NULL, NULL);
        if (!av_open_input_stream(&ast->sub_ctx, pb, "", sub_demuxer, NULL)) {
            av_read_packet(ast->sub_ctx, &ast->sub_pkt);
            *st->codec = *ast->sub_ctx->streams[0]->codec;
            ast->sub_ctx->streams[0]->codec->extradata = NULL;
            time_base = ast->sub_ctx->streams[0]->time_base;
            av_set_pts_info(st, 64, time_base.num, time_base.den);
        }
        ast->sub_buffer = pkt->data;
        memset(pkt, 0, sizeof(*pkt));
        return 1;
    }
    return 0;
}
['static int read_gab2_sub(AVStream *st, AVPacket *pkt) {\n    if (!strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data+5) == 2) {\n        uint8_t desc[256], *d = desc;\n        uint8_t *end, *ptr = pkt->data+7;\n        unsigned int size, desc_len = bytestream_get_le32(&ptr);\n        int score = AVPROBE_SCORE_MAX / 2;\n        AVIStream *ast = st->priv_data;\n        AVInputFormat *sub_demuxer;\n        AVRational time_base;\n        ByteIOContext *pb;\n        AVProbeData pd;\n        if (desc_len > FFMAX(pkt->size-17, 0))\n            return 0;\n        end = ptr + desc_len;\n        while (ptr < end-1) {\n            uint8_t tmp;\n            uint32_t ch;\n            GET_UTF16(ch, ptr < end-1 ? bytestream_get_le16(&ptr) : 0, break;);\n            PUT_UTF8(ch, tmp, if(d-desc < sizeof(desc)-1)  *d++ = tmp;);\n        }\n        *d = 0;\n        if (*desc)\n            av_metadata_set2(&st->metadata, "title", desc, 0);\n        ptr = end + 2;\n        size = bytestream_get_le32(&ptr);\n        size = FFMIN(size, pkt->size+pkt->data-ptr);\n        pd = (AVProbeData) { .buf = ptr, .buf_size = size };\n        if (!(sub_demuxer = av_probe_input_format2(&pd, 1, &score)))\n            return 0;\n        pb = av_alloc_put_byte(ptr, size, 0, NULL, NULL, NULL, NULL);\n        if (!av_open_input_stream(&ast->sub_ctx, pb, "", sub_demuxer, NULL)) {\n            av_read_packet(ast->sub_ctx, &ast->sub_pkt);\n            *st->codec = *ast->sub_ctx->streams[0]->codec;\n            ast->sub_ctx->streams[0]->codec->extradata = NULL;\n            time_base = ast->sub_ctx->streams[0]->time_base;\n            av_set_pts_info(st, 64, time_base.num, time_base.den);\n        }\n        ast->sub_buffer = pkt->data;\n        memset(pkt, 0, sizeof(*pkt));\n        return 1;\n    }\n    return 0;\n}']