libavcodec/aacdec.c:1329: error: Integer Overflow L2
  ([0, +oo] - 90):unsigned32 by call to `decode_scalefactors`.

libavcodec/aacdec.c:1320:19: Call
1318.     pulse.num_pulse = 0;
1319. 
1320.     global_gain = get_bits(gb, 8);
                        ^
1321. 
1322.     if (!common_window && !scale_flag) {

libavcodec/get_bits.h:285:5: Call
  283.     register int tmp;
  284.     OPEN_READER(re, s);
  285.     UPDATE_CACHE(re, s);
           ^
  286.     tmp = SHOW_UBITS(re, s, n);
  287.     LAST_SKIP_BITS(re, s, n);

libavutil/bswap.h:66:1: Parameter `x`
    64. 
    65. #ifndef av_bswap32
    66. static av_always_inline av_const uint32_t av_bswap32(uint32_t x)
        ^
    67. {
    68.     x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);

libavutil/bswap.h:68:5: Assignment
    66. static av_always_inline av_const uint32_t av_bswap32(uint32_t x)
    67. {
    68.     x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);
            ^
    69.     x= (x>>16) | (x<<16);
    70.     return x;

libavutil/bswap.h:69:5: Assignment
    67. {
    68.     x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);
    69.     x= (x>>16) | (x<<16);
            ^
    70.     return x;
    71. }

libavutil/bswap.h:70:5: Assignment
    68.     x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);
    69.     x= (x>>16) | (x<<16);
    70.     return x;
            ^
    71. }
    72. #endif

libavcodec/get_bits.h:285:5: Assignment
  283.     register int tmp;
  284.     OPEN_READER(re, s);
  285.     UPDATE_CACHE(re, s);
           ^
  286.     tmp = SHOW_UBITS(re, s, n);
  287.     LAST_SKIP_BITS(re, s, n);

libavcodec/get_bits.h:286:5: Assignment
  284.     OPEN_READER(re, s);
  285.     UPDATE_CACHE(re, s);
  286.     tmp = SHOW_UBITS(re, s, n);
           ^
  287.     LAST_SKIP_BITS(re, s, n);
  288.     CLOSE_READER(re, s);

libavcodec/get_bits.h:289:5: Assignment
  287.     LAST_SKIP_BITS(re, s, n);
  288.     CLOSE_READER(re, s);
  289.     return tmp;
           ^
  290. }
  291. 

libavcodec/aacdec.c:1320:5: Assignment
1318.     pulse.num_pulse = 0;
1319. 
1320.     global_gain = get_bits(gb, 8);
          ^
1321. 
1322.     if (!common_window && !scale_flag) {

libavcodec/aacdec.c:1329:9: Call
1327.     if (decode_band_types(ac, sce->band_type, sce->band_type_run_end, gb, ics) < 0)
1328.         return -1;
1329.     if (decode_scalefactors(ac, sce->sf, gb, global_gain, ics, sce->band_type, sce->band_type_run_end) < 0)
              ^
1330.         return -1;
1331. 

libavcodec/aacdec.c:780:1: <LHS trace>
778.  * @return  Returns error status. 0 - OK, !0 - error
779.  */
780. static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
     ^
781.                                unsigned int global_gain,
782.                                IndividualChannelStream *ics,

libavcodec/aacdec.c:780:1: Parameter `global_gain`
  778.  * @return  Returns error status. 0 - OK, !0 - error
  779.  */
  780. static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
       ^
  781.                                unsigned int global_gain,
  782.                                IndividualChannelStream *ics,

libavcodec/aacdec.c:787:21: Binary operation: ([0, +oo] - 90):unsigned32 by call to `decode_scalefactors` 
  785. {
  786.     int g, i, idx = 0;
  787.     int offset[3] = { global_gain, global_gain - 90, 0 };
                           ^
  788.     int clipped_offset;
  789.     int noise_flag = 1;

static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
                               unsigned int global_gain,
                               IndividualChannelStream *ics,
                               enum BandType band_type[120],
                               int band_type_run_end[120])
{
    int g, i, idx = 0;
    int offset[3] = { global_gain, global_gain - 90, 0 };
    int clipped_offset;
    int noise_flag = 1;
    static const char *sf_str[3] = { "Global gain", "Noise gain", "Intensity stereo position" };
    for (g = 0; g < ics->num_window_groups; g++) {
        for (i = 0; i < ics->max_sfb;) {
            int run_end = band_type_run_end[idx];
            if (band_type[idx] == ZERO_BT) {
                for (; i < run_end; i++, idx++)
                    sf[idx] = 0.;
            } else if ((band_type[idx] == INTENSITY_BT) || (band_type[idx] == INTENSITY_BT2)) {
                for (; i < run_end; i++, idx++) {
                    offset[2] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    clipped_offset = av_clip(offset[2], -155, 100);
                    if (offset[2] != clipped_offset) {
                        av_log_ask_for_sample(ac->avctx, "Intensity stereo "
                                "position clipped (%d -> %d).\nIf you heard an "
                                "audible artifact, there may be a bug in the "
                                "decoder. ", offset[2], clipped_offset);
                    }
                    sf[idx] = ff_aac_pow2sf_tab[-clipped_offset + POW_SF2_ZERO];
                }
            } else if (band_type[idx] == NOISE_BT) {
                for (; i < run_end; i++, idx++) {
                    if (noise_flag-- > 0)
                        offset[1] += get_bits(gb, 9) - 256;
                    else
                        offset[1] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    clipped_offset = av_clip(offset[1], -100, 155);
                    if (offset[2] != clipped_offset) {
                        av_log_ask_for_sample(ac->avctx, "Noise gain clipped "
                                "(%d -> %d).\nIf you heard an audible "
                                "artifact, there may be a bug in the decoder. ",
                                offset[1], clipped_offset);
                    }
                    sf[idx] = -ff_aac_pow2sf_tab[clipped_offset + POW_SF2_ZERO];
                }
            } else {
                for (; i < run_end; i++, idx++) {
                    offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    if (offset[0] > 255U) {
                        av_log(ac->avctx, AV_LOG_ERROR,
                               "%s (%d) out of range.\n", sf_str[0], offset[0]);
                        return -1;
                    }
                    sf[idx] = -ff_aac_pow2sf_tab[offset[0] - 100 + POW_SF2_ZERO];
                }
            }
        }
    }
    return 0;
}
['static int decode_ics(AACContext *ac, SingleChannelElement *sce,\n                      GetBitContext *gb, int common_window, int scale_flag)\n{\n    Pulse pulse;\n    TemporalNoiseShaping    *tns = &sce->tns;\n    IndividualChannelStream *ics = &sce->ics;\n    float *out = sce->coeffs;\n    int global_gain, pulse_present = 0;\n    pulse.num_pulse = 0;\n    global_gain = get_bits(gb, 8);\n    if (!common_window && !scale_flag) {\n        if (decode_ics_info(ac, ics, gb, 0) < 0)\n            return -1;\n    }\n    if (decode_band_types(ac, sce->band_type, sce->band_type_run_end, gb, ics) < 0)\n        return -1;\n    if (decode_scalefactors(ac, sce->sf, gb, global_gain, ics, sce->band_type, sce->band_type_run_end) < 0)\n        return -1;\n    pulse_present = 0;\n    if (!scale_flag) {\n        if ((pulse_present = get_bits1(gb))) {\n            if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {\n                av_log(ac->avctx, AV_LOG_ERROR, "Pulse tool not allowed in eight short sequence.\\n");\n                return -1;\n            }\n            if (decode_pulses(&pulse, gb, ics->swb_offset, ics->num_swb)) {\n                av_log(ac->avctx, AV_LOG_ERROR, "Pulse data corrupt or invalid.\\n");\n                return -1;\n            }\n        }\n        if ((tns->present = get_bits1(gb)) && decode_tns(ac, tns, gb, ics))\n            return -1;\n        if (get_bits1(gb)) {\n            av_log_missing_feature(ac->avctx, "SSR", 1);\n            return -1;\n        }\n    }\n    if (decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present, &pulse, ics, sce->band_type) < 0)\n        return -1;\n    if (ac->m4ac.object_type == AOT_AAC_MAIN && !common_window)\n        apply_prediction(ac, sce);\n    return 0;\n}', 'static inline unsigned int get_bits(GetBitContext *s, int n){\n    register int tmp;\n    OPEN_READER(re, s);\n    UPDATE_CACHE(re, s);\n    tmp = SHOW_UBITS(re, s, n);\n    LAST_SKIP_BITS(re, s, n);\n    CLOSE_READER(re, s);\n    return tmp;\n}', 'static av_always_inline av_const uint32_t av_bswap32(uint32_t x)\n{\n    x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);\n    x= (x>>16) | (x<<16);\n    return x;\n}', 'static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,\n                               unsigned int global_gain,\n                               IndividualChannelStream *ics,\n                               enum BandType band_type[120],\n                               int band_type_run_end[120])\n{\n    int g, i, idx = 0;\n    int offset[3] = { global_gain, global_gain - 90, 0 };\n    int clipped_offset;\n    int noise_flag = 1;\n    static const char *sf_str[3] = { "Global gain", "Noise gain", "Intensity stereo position" };\n    for (g = 0; g < ics->num_window_groups; g++) {\n        for (i = 0; i < ics->max_sfb;) {\n            int run_end = band_type_run_end[idx];\n            if (band_type[idx] == ZERO_BT) {\n                for (; i < run_end; i++, idx++)\n                    sf[idx] = 0.;\n            } else if ((band_type[idx] == INTENSITY_BT) || (band_type[idx] == INTENSITY_BT2)) {\n                for (; i < run_end; i++, idx++) {\n                    offset[2] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    clipped_offset = av_clip(offset[2], -155, 100);\n                    if (offset[2] != clipped_offset) {\n                        av_log_ask_for_sample(ac->avctx, "Intensity stereo "\n                                "position clipped (%d -> %d).\\nIf you heard an "\n                                "audible artifact, there may be a bug in the "\n                                "decoder. ", offset[2], clipped_offset);\n                    }\n                    sf[idx] = ff_aac_pow2sf_tab[-clipped_offset + POW_SF2_ZERO];\n                }\n            } else if (band_type[idx] == NOISE_BT) {\n                for (; i < run_end; i++, idx++) {\n                    if (noise_flag-- > 0)\n                        offset[1] += get_bits(gb, 9) - 256;\n                    else\n                        offset[1] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    clipped_offset = av_clip(offset[1], -100, 155);\n                    if (offset[2] != clipped_offset) {\n                        av_log_ask_for_sample(ac->avctx, "Noise gain clipped "\n                                "(%d -> %d).\\nIf you heard an audible "\n                                "artifact, there may be a bug in the decoder. ",\n                                offset[1], clipped_offset);\n                    }\n                    sf[idx] = -ff_aac_pow2sf_tab[clipped_offset + POW_SF2_ZERO];\n                }\n            } else {\n                for (; i < run_end; i++, idx++) {\n                    offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    if (offset[0] > 255U) {\n                        av_log(ac->avctx, AV_LOG_ERROR,\n                               "%s (%d) out of range.\\n", sf_str[0], offset[0]);\n                        return -1;\n                    }\n                    sf[idx] = -ff_aac_pow2sf_tab[offset[0] - 100 + POW_SF2_ZERO];\n                }\n            }\n        }\n    }\n    return 0;\n}']