libavformat/bmv.c:94: error: Buffer Overrun L3
  Offset: 1 Size: [1, 2147483631].

libavformat/bmv.c:85:19: <Length trace>
83.         if (type == BMV_END)
84.             return AVERROR_EOF;
85.         c->size = avio_rl24(s->pb);
                      ^
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:85:19: Call
83.         if (type == BMV_END)
84.             return AVERROR_EOF;
85.         c->size = avio_rl24(s->pb);
                      ^
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;

libavformat/aviobuf.c:553:11: Call
  551. {
  552.     unsigned int val;
  553.     val = avio_rl16(s);
                 ^
  554.     val |= avio_r8(s) << 16;
  555.     return val;

libavformat/aviobuf.c:545:11: Call
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
                   ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:443:5: Assignment
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
      443.     return 0;
               ^
      444. }
      445. 

libavformat/aviobuf.c:545:5: Assignment
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:546:5: Assignment
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:547:5: Assignment
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:553:5: Assignment
  551. {
  552.     unsigned int val;
  553.     val = avio_rl16(s);
           ^
  554.     val |= avio_r8(s) << 16;
  555.     return val;

libavformat/aviobuf.c:554:5: Assignment
  552.     unsigned int val;
  553.     val = avio_rl16(s);
  554.     val |= avio_r8(s) << 16;
           ^
  555.     return val;
  556. }

libavformat/aviobuf.c:555:5: Assignment
  553.     val = avio_rl16(s);
  554.     val |= avio_r8(s) << 16;
  555.     return val;
           ^
  556. }
  557. 

libavformat/bmv.c:85:9: Assignment
83.         if (type == BMV_END)
84.             return AVERROR_EOF;
85.         c->size = avio_rl24(s->pb);
            ^
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;

libavformat/bmv.c:88:20: Call
86.         if (!c->size)
87.             return AVERROR_INVALIDDATA;
88.         if ((err = av_reallocp(&c->packet, c->size + 1)) < 0)
                       ^
89.             return err;
90.         c->packet[0] = type;

libavutil/mem.c:145:9: Call
  143. 
  144.     if (!size) {
  145.         av_freep(ptr);
               ^
  146.         return 0;
  147.     }

libavutil/mem.c:201:5: Assignment
    199.     void **ptr = (void **)arg;
    200.     av_free(*ptr);
    201.     *ptr = NULL;
             ^
    202. }
    203. 

libavformat/bmv.c:94:30: Array access: Offset: 1 Size: [1, 2147483631]
92.             return AVERROR(EIO);
93.         if (type & BMV_AUDIO) {
94.             int audio_size = c->packet[1] * 65 + 1;
                                 ^
95.             if (audio_size >= c->size) {
96.                 av_log(s, AV_LOG_ERROR, "Reported audio size %d is bigger than packet size (%d)\n",

static int bmv_read_packet(AVFormatContext *s, AVPacket *pkt)
{
    BMVContext *c = s->priv_data;
    int type, err;
    void *tmp;
    while (c->get_next) {
        if (s->pb->eof_reached)
            return AVERROR_EOF;
        type = avio_r8(s->pb);
        if (type == BMV_NOP)
            continue;
        if (type == BMV_END)
            return AVERROR_EOF;
        c->size = avio_rl24(s->pb);
        if (!c->size)
            return AVERROR_INVALIDDATA;
        if ((err = av_reallocp(&c->packet, c->size + 1)) < 0)
            return err;
        c->packet[0] = type;
        if (avio_read(s->pb, c->packet + 1, c->size) != c->size)
            return AVERROR(EIO);
        if (type & BMV_AUDIO) {
            int audio_size = c->packet[1] * 65 + 1;
            if (audio_size >= c->size) {
                av_log(s, AV_LOG_ERROR, "Reported audio size %d is bigger than packet size (%d)\n",
                       audio_size, c->size);
                return AVERROR_INVALIDDATA;
            }
            if (av_new_packet(pkt, audio_size) < 0)
                return AVERROR(ENOMEM);
            memcpy(pkt->data, c->packet + 1, pkt->size);
            pkt->stream_index = 1;
            pkt->pts          = c->audio_pos;
            pkt->duration     = c->packet[1] * 32;
            c->audio_pos += pkt->duration;
            c->get_next   = 0;
            return pkt->size;
        } else
            break;
    }
    if (av_new_packet(pkt, c->size + 1) < 0)
        return AVERROR(ENOMEM);
    pkt->stream_index = 0;
    c->get_next = 1;
    memcpy(pkt->data, c->packet, pkt->size);
    return pkt->size;
}
['static int bmv_read_packet(AVFormatContext *s, AVPacket *pkt)\n{\n    BMVContext *c = s->priv_data;\n    int type, err;\n    void *tmp;\n    while (c->get_next) {\n        if (s->pb->eof_reached)\n            return AVERROR_EOF;\n        type = avio_r8(s->pb);\n        if (type == BMV_NOP)\n            continue;\n        if (type == BMV_END)\n            return AVERROR_EOF;\n        c->size = avio_rl24(s->pb);\n        if (!c->size)\n            return AVERROR_INVALIDDATA;\n        if ((err = av_reallocp(&c->packet, c->size + 1)) < 0)\n            return err;\n        c->packet[0] = type;\n        if (avio_read(s->pb, c->packet + 1, c->size) != c->size)\n            return AVERROR(EIO);\n        if (type & BMV_AUDIO) {\n            int audio_size = c->packet[1] * 65 + 1;\n            if (audio_size >= c->size) {\n                av_log(s, AV_LOG_ERROR, "Reported audio size %d is bigger than packet size (%d)\\n",\n                       audio_size, c->size);\n                return AVERROR_INVALIDDATA;\n            }\n            if (av_new_packet(pkt, audio_size) < 0)\n                return AVERROR(ENOMEM);\n            memcpy(pkt->data, c->packet + 1, pkt->size);\n            pkt->stream_index = 1;\n            pkt->pts          = c->audio_pos;\n            pkt->duration     = c->packet[1] * 32;\n            c->audio_pos += pkt->duration;\n            c->get_next   = 0;\n            return pkt->size;\n        } else\n            break;\n    }\n    if (av_new_packet(pkt, c->size + 1) < 0)\n        return AVERROR(ENOMEM);\n    pkt->stream_index = 0;\n    c->get_next = 1;\n    memcpy(pkt->data, c->packet, pkt->size);\n    return pkt->size;\n}', 'unsigned int avio_rl24(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rl16(s);\n    val |= avio_r8(s) << 16;\n    return val;\n}', 'unsigned int avio_rl16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s);\n    val |= avio_r8(s) << 8;\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}', 'int av_reallocp(void *ptr, size_t size)\n{\n    void **ptrptr = ptr;\n    void *ret;\n    if (!size) {\n        av_freep(ptr);\n        return 0;\n    }\n    ret = av_realloc(*ptrptr, size);\n    if (!ret) {\n        av_freep(ptr);\n        return AVERROR(ENOMEM);\n    }\n    *ptrptr = ret;\n    return 0;\n}', 'void av_freep(void *arg)\n{\n    void **ptr = (void **)arg;\n    av_free(*ptr);\n    *ptr = NULL;\n}']