libavcodec/svq1dec.c:651: error: Integer Overflow L2
  ([0, +oo] - 22):unsigned32 by call to `bitstream_skip`.

libavcodec/svq1dec.c:622:21: Call
620. 
621.     /* decode frame header */
622.     s->frame_code = bitstream_read(&s->bc, 22);
                         ^
623. 
624.     if ((s->frame_code & ~0x70) || !(s->frame_code & 0x60))

libavcodec/bitstream.h:183:1: Parameter `bc->bits_left`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/svq1dec.c:650:9: Call
648.             src[i] = ((src[i] << 16) | (src[i] >> 16)) ^ src[7 - i];
649. 
650.         bitstream_init8(&s->bc, buf, buf_size);
             ^
651.         bitstream_skip(&s->bc, 22);
652.     }

libavcodec/bitstream.h:104:1: Parameter `bc->bits_left`
  102. 
  103. /* Initialize BitstreamContext with buffer size in bytes instead of bits. */
  104. static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,
       ^
  105.                                   unsigned byte_size)
  106. {

libavcodec/svq1dec.c:651:9: Call
649. 
650.         bitstream_init8(&s->bc, buf, buf_size);
651.         bitstream_skip(&s->bc, 22);
             ^
652.     }
653. 

libavcodec/bitstream.h:241:1: Parameter `n`
  239. 
  240. /* Skip n bits in the buffer. */
  241. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
       ^
  242. {
  243.     if (n <= bc->bits_left)

libavcodec/bitstream.h:244:9: Call
  242. {
  243.     if (n <= bc->bits_left)
  244.         skip_remaining(bc, n);
               ^
  245.     else {
  246.         n -= bc->bits_left;

libavcodec/bitstream.h:230:1: <LHS trace>
228. }
229. 
230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
231. {
232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: Parameter `bc->bits_left`
    228. }
    229. 
    230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
         ^
    231. {
    232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: <RHS trace>
228. }
229. 
230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
231. {
232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: Parameter `n`
    228. }
    229. 
    230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
         ^
    231. {
    232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:237:5: Binary operation: ([0, +oo] - 22):unsigned32 by call to `bitstream_skip` 
    235.     bc->bits <<= n;
    236. #endif
    237.     bc->bits_left -= n;
             ^
    238. }
    239. 

static inline void skip_remaining(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    bc->bits >>= n;
#else
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
}
['static int svq1_decode_frame(AVCodecContext *avctx, void *data,\n                             int *got_frame, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    SVQ1Context     *s = avctx->priv_data;\n    AVFrame       *cur = data;\n    uint8_t *current;\n    int result, i, x, y, width, height;\n    svq1_pmv *pmv;\n    bitstream_init8(&s->bc, buf, buf_size);\n    s->frame_code = bitstream_read(&s->bc, 22);\n    if ((s->frame_code & ~0x70) || !(s->frame_code & 0x60))\n        return AVERROR_INVALIDDATA;\n    if (s->frame_code != 0x20) {\n        uint32_t *src;\n        if (buf_size < 9 * 4) {\n            av_log(avctx, AV_LOG_ERROR, "Input packet too small\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        av_fast_padded_malloc(&s->pkt_swapped,\n                              &s->pkt_swapped_allocated,\n                              buf_size);\n        if (!s->pkt_swapped)\n            return AVERROR(ENOMEM);\n        memcpy(s->pkt_swapped, buf, buf_size);\n        buf = s->pkt_swapped;\n        src = (uint32_t *)(s->pkt_swapped + 4);\n        for (i = 0; i < 4; i++)\n            src[i] = ((src[i] << 16) | (src[i] >> 16)) ^ src[7 - i];\n        bitstream_init8(&s->bc, buf, buf_size);\n        bitstream_skip(&s->bc, 22);\n    }\n    result = svq1_decode_frame_header(avctx, cur);\n    if (result != 0) {\n        ff_dlog(avctx, "Error in svq1_decode_frame_header %i\\n", result);\n        return result;\n    }\n    result = ff_set_dimensions(avctx, s->width, s->height);\n    if (result < 0)\n        return result;\n    if ((avctx->skip_frame >= AVDISCARD_NONREF && s->nonref) ||\n        (avctx->skip_frame >= AVDISCARD_NONKEY &&\n         cur->pict_type != AV_PICTURE_TYPE_I) ||\n        avctx->skip_frame >= AVDISCARD_ALL)\n        return buf_size;\n    result = ff_get_buffer(avctx, cur, s->nonref ? 0 : AV_GET_BUFFER_FLAG_REF);\n    if (result < 0)\n        return result;\n    pmv = av_malloc((FFALIGN(s->width, 16) / 8 + 3) * sizeof(*pmv));\n    if (!pmv)\n        return AVERROR(ENOMEM);\n    for (i = 0; i < 3; i++) {\n        int linesize = cur->linesize[i];\n        if (i == 0) {\n            width    = FFALIGN(s->width,  16);\n            height   = FFALIGN(s->height, 16);\n        } else {\n            if (avctx->flags & AV_CODEC_FLAG_GRAY)\n                break;\n            width    = FFALIGN(s->width  / 4, 16);\n            height   = FFALIGN(s->height / 4, 16);\n        }\n        current = cur->data[i];\n        if (cur->pict_type == AV_PICTURE_TYPE_I) {\n            for (y = 0; y < height; y += 16) {\n                for (x = 0; x < width; x += 16) {\n                    result = svq1_decode_block_intra(&s->bc, &current[x],\n                                                     linesize);\n                    if (result != 0) {\n                        av_log(avctx, AV_LOG_INFO,\n                               "Error in svq1_decode_block %i (keyframe)\\n",\n                               result);\n                        goto err;\n                    }\n                }\n                current += 16 * linesize;\n            }\n        } else {\n            uint8_t *previous = s->prev->data[i];\n            if (!previous ||\n                s->prev->width != s->width || s->prev->height != s->height) {\n                av_log(avctx, AV_LOG_ERROR, "Missing reference frame.\\n");\n                result = AVERROR_INVALIDDATA;\n                goto err;\n            }\n            memset(pmv, 0, ((width / 8) + 3) * sizeof(svq1_pmv));\n            for (y = 0; y < height; y += 16) {\n                for (x = 0; x < width; x += 16) {\n                    result = svq1_decode_delta_block(avctx, &s->hdsp,\n                                                     &s->bc, &current[x],\n                                                     previous, linesize,\n                                                     pmv, x, y, width, height);\n                    if (result != 0) {\n                        ff_dlog(avctx,\n                                "Error in svq1_decode_delta_block %i\\n",\n                                result);\n                        goto err;\n                    }\n                }\n                pmv[0].x     =\n                    pmv[0].y = 0;\n                current += 16 * linesize;\n            }\n        }\n    }\n    if (!s->nonref) {\n        av_frame_unref(s->prev);\n        result = av_frame_ref(s->prev, cur);\n        if (result < 0)\n            goto err;\n    }\n    *got_frame = 1;\n    result     = buf_size;\nerr:\n    av_free(pmv);\n    return result;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,\n                                  unsigned byte_size)\n{\n    if (byte_size > INT_MAX / 8)\n        return AVERROR_INVALIDDATA;\n    return bitstream_init(bc, buffer, byte_size * 8);\n}', 'static inline void bitstream_skip(BitstreamContext *bc, unsigned n)\n{\n    if (n <= bc->bits_left)\n        skip_remaining(bc, n);\n    else {\n        n -= bc->bits_left;\n        skip_remaining(bc, bc->bits_left);\n        if (n >= 64) {\n            unsigned skip = n / 8;\n            n -= skip * 8;\n            bc->ptr += skip;\n        }\n        refill_64(bc);\n        if (n)\n            skip_remaining(bc, n);\n    }\n}', 'static inline void skip_remaining(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    bc->bits >>= n;\n#else\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n}']