libavcodec/flicvideo.c:387: error: Integer Overflow L2
  ([min(0, `buf->l`), max(0, `buf->l`)] - 6):unsigned32.

libavcodec/flicvideo.c:135:1: <LHS trace>
133. }
134. 
135. static int flic_decode_frame_8BPP(AVCodecContext *avctx,
     ^
136.                                   void *data, int *got_frame,
137.                                   const uint8_t *buf, int buf_size)

libavcodec/flicvideo.c:135:1: Parameter `buf->l`
133. }
134. 
135. static int flic_decode_frame_8BPP(AVCodecContext *avctx,
     ^
136.                                   void *data, int *got_frame,
137.                                   const uint8_t *buf, int buf_size)

libavcodec/flicvideo.c:190:22: Call
188.     /* iterate through the chunks */
189.     while ((frame_size > 0) && (num_chunks > 0)) {
190.         chunk_size = bytestream2_get_le32(&g2);
                          ^
191.         chunk_type = bytestream2_get_le16(&g2);
192. 

libavcodec/bytestream.h:85:1: Assignment
  83. 
  84. DEF(uint64_t,     le64, 8, AV_RL64, AV_WL64)
  85. DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)
      ^
  86. DEF(unsigned int, le24, 3, AV_RL24, AV_WL24)
  87. DEF(unsigned int, le16, 2, AV_RL16, AV_WL16)

libavcodec/flicvideo.c:190:9: Assignment
188.     /* iterate through the chunks */
189.     while ((frame_size > 0) && (num_chunks > 0)) {
190.         chunk_size = bytestream2_get_le32(&g2);
             ^
191.         chunk_type = bytestream2_get_le16(&g2);
192. 

libavcodec/flicvideo.c:387:17: Binary operation: ([min(0, buf->l), max(0, buf->l)] - 6):unsigned32
385.         case FLI_COPY:
386.             /* copy the chunk (uncompressed frame) */
387.             if (chunk_size - 6 > s->avctx->width * s->avctx->height) {
                     ^
388.                 av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \
389.                        "bigger than image, skipping chunk\n", chunk_size - 6);

static int flic_decode_frame_8BPP(AVCodecContext *avctx,
                                  void *data, int *got_frame,
                                  const uint8_t *buf, int buf_size)
{
    FlicDecodeContext *s = avctx->priv_data;
    GetByteContext g2;
    int stream_ptr_after_color_chunk;
    int pixel_ptr;
    int palette_ptr;
    unsigned char palette_idx1;
    unsigned char palette_idx2;
    unsigned int frame_size;
    int num_chunks;
    unsigned int chunk_size;
    int chunk_type;
    int i, j, ret;
    int color_packets;
    int color_changes;
    int color_shift;
    unsigned char r, g, b;
    int lines;
    int compressed_lines;
    int starting_line;
    signed short line_packets;
    int y_ptr;
    int byte_run;
    int pixel_skip;
    int pixel_countdown;
    unsigned char *pixels;
    unsigned int pixel_limit;
    bytestream2_init(&g2, buf, buf_size);
    if ((ret = ff_reget_buffer(avctx, s->frame)) < 0) {
        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
        return ret;
    }
    pixels = s->frame->data[0];
    pixel_limit = s->avctx->height * s->frame->linesize[0];
    frame_size = bytestream2_get_le32(&g2);
    bytestream2_skip(&g2, 2);
    num_chunks = bytestream2_get_le16(&g2);
    bytestream2_skip(&g2, 8);
    frame_size -= 16;
    while ((frame_size > 0) && (num_chunks > 0)) {
        chunk_size = bytestream2_get_le32(&g2);
        chunk_type = bytestream2_get_le16(&g2);
        switch (chunk_type) {
        case FLI_256_COLOR:
        case FLI_COLOR:
            stream_ptr_after_color_chunk = bytestream2_tell(&g2) + chunk_size - 6;
            if ((chunk_type == FLI_256_COLOR) && (s->fli_type != FLC_MAGIC_CARPET_SYNTHETIC_TYPE_CODE))
                color_shift = 0;
            else
                color_shift = 2;
            color_packets = bytestream2_get_le16(&g2);
            palette_ptr = 0;
            for (i = 0; i < color_packets; i++) {
                palette_ptr += bytestream2_get_byte(&g2);
                color_changes = bytestream2_get_byte(&g2);
                if (color_changes == 0)
                    color_changes = 256;
                for (j = 0; j < color_changes; j++) {
                    unsigned int entry;
                    if ((unsigned)palette_ptr >= 256)
                        palette_ptr = 0;
                    r = bytestream2_get_byte(&g2) << color_shift;
                    g = bytestream2_get_byte(&g2) << color_shift;
                    b = bytestream2_get_byte(&g2) << color_shift;
                    entry = (r << 16) | (g << 8) | b;
                    if (s->palette[palette_ptr] != entry)
                        s->new_palette = 1;
                    s->palette[palette_ptr++] = entry;
                }
            }
            if (stream_ptr_after_color_chunk - bytestream2_tell(&g2) > 0)
                bytestream2_skip(&g2, stream_ptr_after_color_chunk - bytestream2_tell(&g2));
            break;
        case FLI_DELTA:
            y_ptr = 0;
            compressed_lines = bytestream2_get_le16(&g2);
            while (compressed_lines > 0) {
                line_packets = bytestream2_get_le16(&g2);
                if ((line_packets & 0xC000) == 0xC000) {
                    line_packets = -line_packets;
                    y_ptr += line_packets * s->frame->linesize[0];
                } else if ((line_packets & 0xC000) == 0x4000) {
                    av_log(avctx, AV_LOG_ERROR, "Undefined opcode (%x) in DELTA_FLI\n", line_packets);
                } else if ((line_packets & 0xC000) == 0x8000) {
                    pixel_ptr= y_ptr + s->frame->linesize[0] - 1;
                    CHECK_PIXEL_PTR(0);
                    pixels[pixel_ptr] = line_packets & 0xff;
                } else {
                    compressed_lines--;
                    pixel_ptr = y_ptr;
                    CHECK_PIXEL_PTR(0);
                    pixel_countdown = s->avctx->width;
                    for (i = 0; i < line_packets; i++) {
                        pixel_skip = bytestream2_get_byte(&g2);
                        pixel_ptr += pixel_skip;
                        pixel_countdown -= pixel_skip;
                        byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                        if (byte_run < 0) {
                            byte_run = -byte_run;
                            palette_idx1 = bytestream2_get_byte(&g2);
                            palette_idx2 = bytestream2_get_byte(&g2);
                            CHECK_PIXEL_PTR(byte_run * 2);
                            for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {
                                pixels[pixel_ptr++] = palette_idx1;
                                pixels[pixel_ptr++] = palette_idx2;
                            }
                        } else {
                            CHECK_PIXEL_PTR(byte_run * 2);
                            for (j = 0; j < byte_run * 2; j++, pixel_countdown--) {
                                pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                            }
                        }
                    }
                    y_ptr += s->frame->linesize[0];
                }
            }
            break;
        case FLI_LC:
            starting_line = bytestream2_get_le16(&g2);
            y_ptr = 0;
            y_ptr += starting_line * s->frame->linesize[0];
            compressed_lines = bytestream2_get_le16(&g2);
            while (compressed_lines > 0) {
                pixel_ptr = y_ptr;
                CHECK_PIXEL_PTR(0);
                pixel_countdown = s->avctx->width;
                line_packets = bytestream2_get_byte(&g2);
                if (line_packets > 0) {
                    for (i = 0; i < line_packets; i++) {
                        pixel_skip = bytestream2_get_byte(&g2);
                        pixel_ptr += pixel_skip;
                        pixel_countdown -= pixel_skip;
                        byte_run = sign_extend(bytestream2_get_byte(&g2),8);
                        if (byte_run > 0) {
                            CHECK_PIXEL_PTR(byte_run);
                            for (j = 0; j < byte_run; j++, pixel_countdown--) {
                                pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                            }
                        } else if (byte_run < 0) {
                            byte_run = -byte_run;
                            palette_idx1 = bytestream2_get_byte(&g2);
                            CHECK_PIXEL_PTR(byte_run);
                            for (j = 0; j < byte_run; j++, pixel_countdown--) {
                                pixels[pixel_ptr++] = palette_idx1;
                            }
                        }
                    }
                }
                y_ptr += s->frame->linesize[0];
                compressed_lines--;
            }
            break;
        case FLI_BLACK:
            memset(pixels, 0,
                s->frame->linesize[0] * s->avctx->height);
            break;
        case FLI_BRUN:
            y_ptr = 0;
            for (lines = 0; lines < s->avctx->height; lines++) {
                pixel_ptr = y_ptr;
                 bytestream2_skip(&g2, 1);
                pixel_countdown = s->avctx->width;
                while (pixel_countdown > 0) {
                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
                    if (!byte_run) {
                        av_log(avctx, AV_LOG_ERROR, "Invalid byte run value.\n");
                        return AVERROR_INVALIDDATA;
                    }
                    if (byte_run > 0) {
                        palette_idx1 = bytestream2_get_byte(&g2);
                        CHECK_PIXEL_PTR(byte_run);
                        for (j = 0; j < byte_run; j++) {
                            pixels[pixel_ptr++] = palette_idx1;
                            pixel_countdown--;
                            if (pixel_countdown < 0)
                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\n",
                                       pixel_countdown, lines);
                        }
                    } else {
                        byte_run = -byte_run;
                        CHECK_PIXEL_PTR(byte_run);
                        for (j = 0; j < byte_run; j++) {
                            pixels[pixel_ptr++] = bytestream2_get_byte(&g2);
                            pixel_countdown--;
                            if (pixel_countdown < 0)
                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\n",
                                       pixel_countdown, lines);
                        }
                    }
                }
                y_ptr += s->frame->linesize[0];
            }
            break;
        case FLI_COPY:
            if (chunk_size - 6 > s->avctx->width * s->avctx->height) {
                av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \
                       "bigger than image, skipping chunk\n", chunk_size - 6);
                bytestream2_skip(&g2, chunk_size - 6);
            } else {
                for (y_ptr = 0; y_ptr < s->frame->linesize[0] * s->avctx->height;
                     y_ptr += s->frame->linesize[0]) {
                    bytestream2_get_buffer(&g2, &pixels[y_ptr],
                                           s->avctx->width);
                }
            }
            break;
        case FLI_MINI:
            bytestream2_skip(&g2, chunk_size - 6);
            break;
        default:
            av_log(avctx, AV_LOG_ERROR, "Unrecognized chunk type: %d\n", chunk_type);
            break;
        }
        frame_size -= chunk_size;
        num_chunks--;
    }
    if ((bytestream2_get_bytes_left(&g2) != 0) &&
        (bytestream2_get_bytes_left(&g2) != 1))
        av_log(avctx, AV_LOG_ERROR, "Processed FLI chunk where chunk size = %d " \
               "and final chunk ptr = %d\n", buf_size,
               buf_size - bytestream2_get_bytes_left(&g2));
    memcpy(s->frame->data[1], s->palette, AVPALETTE_SIZE);
    if (s->new_palette) {
        s->frame->palette_has_changed = 1;
        s->new_palette = 0;
    }
    if ((ret = av_frame_ref(data, s->frame)) < 0)
        return ret;
    *got_frame = 1;
    return buf_size;
}
['static int flic_decode_frame_8BPP(AVCodecContext *avctx,\n                                  void *data, int *got_frame,\n                                  const uint8_t *buf, int buf_size)\n{\n    FlicDecodeContext *s = avctx->priv_data;\n    GetByteContext g2;\n    int stream_ptr_after_color_chunk;\n    int pixel_ptr;\n    int palette_ptr;\n    unsigned char palette_idx1;\n    unsigned char palette_idx2;\n    unsigned int frame_size;\n    int num_chunks;\n    unsigned int chunk_size;\n    int chunk_type;\n    int i, j, ret;\n    int color_packets;\n    int color_changes;\n    int color_shift;\n    unsigned char r, g, b;\n    int lines;\n    int compressed_lines;\n    int starting_line;\n    signed short line_packets;\n    int y_ptr;\n    int byte_run;\n    int pixel_skip;\n    int pixel_countdown;\n    unsigned char *pixels;\n    unsigned int pixel_limit;\n    bytestream2_init(&g2, buf, buf_size);\n    if ((ret = ff_reget_buffer(avctx, s->frame)) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\\n");\n        return ret;\n    }\n    pixels = s->frame->data[0];\n    pixel_limit = s->avctx->height * s->frame->linesize[0];\n    frame_size = bytestream2_get_le32(&g2);\n    bytestream2_skip(&g2, 2);\n    num_chunks = bytestream2_get_le16(&g2);\n    bytestream2_skip(&g2, 8);\n    frame_size -= 16;\n    while ((frame_size > 0) && (num_chunks > 0)) {\n        chunk_size = bytestream2_get_le32(&g2);\n        chunk_type = bytestream2_get_le16(&g2);\n        switch (chunk_type) {\n        case FLI_256_COLOR:\n        case FLI_COLOR:\n            stream_ptr_after_color_chunk = bytestream2_tell(&g2) + chunk_size - 6;\n            if ((chunk_type == FLI_256_COLOR) && (s->fli_type != FLC_MAGIC_CARPET_SYNTHETIC_TYPE_CODE))\n                color_shift = 0;\n            else\n                color_shift = 2;\n            color_packets = bytestream2_get_le16(&g2);\n            palette_ptr = 0;\n            for (i = 0; i < color_packets; i++) {\n                palette_ptr += bytestream2_get_byte(&g2);\n                color_changes = bytestream2_get_byte(&g2);\n                if (color_changes == 0)\n                    color_changes = 256;\n                for (j = 0; j < color_changes; j++) {\n                    unsigned int entry;\n                    if ((unsigned)palette_ptr >= 256)\n                        palette_ptr = 0;\n                    r = bytestream2_get_byte(&g2) << color_shift;\n                    g = bytestream2_get_byte(&g2) << color_shift;\n                    b = bytestream2_get_byte(&g2) << color_shift;\n                    entry = (r << 16) | (g << 8) | b;\n                    if (s->palette[palette_ptr] != entry)\n                        s->new_palette = 1;\n                    s->palette[palette_ptr++] = entry;\n                }\n            }\n            if (stream_ptr_after_color_chunk - bytestream2_tell(&g2) > 0)\n                bytestream2_skip(&g2, stream_ptr_after_color_chunk - bytestream2_tell(&g2));\n            break;\n        case FLI_DELTA:\n            y_ptr = 0;\n            compressed_lines = bytestream2_get_le16(&g2);\n            while (compressed_lines > 0) {\n                line_packets = bytestream2_get_le16(&g2);\n                if ((line_packets & 0xC000) == 0xC000) {\n                    line_packets = -line_packets;\n                    y_ptr += line_packets * s->frame->linesize[0];\n                } else if ((line_packets & 0xC000) == 0x4000) {\n                    av_log(avctx, AV_LOG_ERROR, "Undefined opcode (%x) in DELTA_FLI\\n", line_packets);\n                } else if ((line_packets & 0xC000) == 0x8000) {\n                    pixel_ptr= y_ptr + s->frame->linesize[0] - 1;\n                    CHECK_PIXEL_PTR(0);\n                    pixels[pixel_ptr] = line_packets & 0xff;\n                } else {\n                    compressed_lines--;\n                    pixel_ptr = y_ptr;\n                    CHECK_PIXEL_PTR(0);\n                    pixel_countdown = s->avctx->width;\n                    for (i = 0; i < line_packets; i++) {\n                        pixel_skip = bytestream2_get_byte(&g2);\n                        pixel_ptr += pixel_skip;\n                        pixel_countdown -= pixel_skip;\n                        byte_run = sign_extend(bytestream2_get_byte(&g2), 8);\n                        if (byte_run < 0) {\n                            byte_run = -byte_run;\n                            palette_idx1 = bytestream2_get_byte(&g2);\n                            palette_idx2 = bytestream2_get_byte(&g2);\n                            CHECK_PIXEL_PTR(byte_run * 2);\n                            for (j = 0; j < byte_run; j++, pixel_countdown -= 2) {\n                                pixels[pixel_ptr++] = palette_idx1;\n                                pixels[pixel_ptr++] = palette_idx2;\n                            }\n                        } else {\n                            CHECK_PIXEL_PTR(byte_run * 2);\n                            for (j = 0; j < byte_run * 2; j++, pixel_countdown--) {\n                                pixels[pixel_ptr++] = bytestream2_get_byte(&g2);\n                            }\n                        }\n                    }\n                    y_ptr += s->frame->linesize[0];\n                }\n            }\n            break;\n        case FLI_LC:\n            starting_line = bytestream2_get_le16(&g2);\n            y_ptr = 0;\n            y_ptr += starting_line * s->frame->linesize[0];\n            compressed_lines = bytestream2_get_le16(&g2);\n            while (compressed_lines > 0) {\n                pixel_ptr = y_ptr;\n                CHECK_PIXEL_PTR(0);\n                pixel_countdown = s->avctx->width;\n                line_packets = bytestream2_get_byte(&g2);\n                if (line_packets > 0) {\n                    for (i = 0; i < line_packets; i++) {\n                        pixel_skip = bytestream2_get_byte(&g2);\n                        pixel_ptr += pixel_skip;\n                        pixel_countdown -= pixel_skip;\n                        byte_run = sign_extend(bytestream2_get_byte(&g2),8);\n                        if (byte_run > 0) {\n                            CHECK_PIXEL_PTR(byte_run);\n                            for (j = 0; j < byte_run; j++, pixel_countdown--) {\n                                pixels[pixel_ptr++] = bytestream2_get_byte(&g2);\n                            }\n                        } else if (byte_run < 0) {\n                            byte_run = -byte_run;\n                            palette_idx1 = bytestream2_get_byte(&g2);\n                            CHECK_PIXEL_PTR(byte_run);\n                            for (j = 0; j < byte_run; j++, pixel_countdown--) {\n                                pixels[pixel_ptr++] = palette_idx1;\n                            }\n                        }\n                    }\n                }\n                y_ptr += s->frame->linesize[0];\n                compressed_lines--;\n            }\n            break;\n        case FLI_BLACK:\n            memset(pixels, 0,\n                s->frame->linesize[0] * s->avctx->height);\n            break;\n        case FLI_BRUN:\n            y_ptr = 0;\n            for (lines = 0; lines < s->avctx->height; lines++) {\n                pixel_ptr = y_ptr;\n                 bytestream2_skip(&g2, 1);\n                pixel_countdown = s->avctx->width;\n                while (pixel_countdown > 0) {\n                    byte_run = sign_extend(bytestream2_get_byte(&g2), 8);\n                    if (!byte_run) {\n                        av_log(avctx, AV_LOG_ERROR, "Invalid byte run value.\\n");\n                        return AVERROR_INVALIDDATA;\n                    }\n                    if (byte_run > 0) {\n                        palette_idx1 = bytestream2_get_byte(&g2);\n                        CHECK_PIXEL_PTR(byte_run);\n                        for (j = 0; j < byte_run; j++) {\n                            pixels[pixel_ptr++] = palette_idx1;\n                            pixel_countdown--;\n                            if (pixel_countdown < 0)\n                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\\n",\n                                       pixel_countdown, lines);\n                        }\n                    } else {\n                        byte_run = -byte_run;\n                        CHECK_PIXEL_PTR(byte_run);\n                        for (j = 0; j < byte_run; j++) {\n                            pixels[pixel_ptr++] = bytestream2_get_byte(&g2);\n                            pixel_countdown--;\n                            if (pixel_countdown < 0)\n                                av_log(avctx, AV_LOG_ERROR, "pixel_countdown < 0 (%d) at line %d\\n",\n                                       pixel_countdown, lines);\n                        }\n                    }\n                }\n                y_ptr += s->frame->linesize[0];\n            }\n            break;\n        case FLI_COPY:\n            if (chunk_size - 6 > s->avctx->width * s->avctx->height) {\n                av_log(avctx, AV_LOG_ERROR, "In chunk FLI_COPY : source data (%d bytes) " \\\n                       "bigger than image, skipping chunk\\n", chunk_size - 6);\n                bytestream2_skip(&g2, chunk_size - 6);\n            } else {\n                for (y_ptr = 0; y_ptr < s->frame->linesize[0] * s->avctx->height;\n                     y_ptr += s->frame->linesize[0]) {\n                    bytestream2_get_buffer(&g2, &pixels[y_ptr],\n                                           s->avctx->width);\n                }\n            }\n            break;\n        case FLI_MINI:\n            bytestream2_skip(&g2, chunk_size - 6);\n            break;\n        default:\n            av_log(avctx, AV_LOG_ERROR, "Unrecognized chunk type: %d\\n", chunk_type);\n            break;\n        }\n        frame_size -= chunk_size;\n        num_chunks--;\n    }\n    if ((bytestream2_get_bytes_left(&g2) != 0) &&\n        (bytestream2_get_bytes_left(&g2) != 1))\n        av_log(avctx, AV_LOG_ERROR, "Processed FLI chunk where chunk size = %d " \\\n               "and final chunk ptr = %d\\n", buf_size,\n               buf_size - bytestream2_get_bytes_left(&g2));\n    memcpy(s->frame->data[1], s->palette, AVPALETTE_SIZE);\n    if (s->new_palette) {\n        s->frame->palette_has_changed = 1;\n        s->new_palette = 0;\n    }\n    if ((ret = av_frame_ref(data, s->frame)) < 0)\n        return ret;\n    *got_frame = 1;\n    return buf_size;\n}', 'DEF(unsigned int, le32, 4, AV_RL32, AV_WL32)']