libavcodec/wmavoice.c:1784: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `bitstream_read_bit`.

libavcodec/wmavoice.c:1770:9: Call
1768.     if (s->sframe_cache_size > 0) {
1769.         bc = &s_bc;
1770.         bitstream_init(bc, s->sframe_cache, s->sframe_cache_size);
              ^
1771.         s->sframe_cache_size = 0;
1772.     }

libavcodec/bitstream.h:85:9: Assignment
  83.         bc->buffer    =
  84.         bc->ptr       = NULL;
  85.         bc->bits_left = 0;
              ^
  86.         return AVERROR_INVALIDDATA;
  87.     }

libavcodec/wmavoice.c:1784:10: Call
1782.      * are really WMAPro-in-WMAVoice-superframes. I've never seen those in
1783.      * the wild yet. */
1784.     if (!bitstream_read_bit(bc)) {
               ^
1785.         avpriv_request_sample(ctx, "WMAPro-in-WMAVoice");
1786.         return AVERROR_PATCHWELCOME;

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
  143. 
  144. /* Return one bit from the buffer. */
  145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
       ^
  146. {
  147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
  148.         refill_64(bc);
  149. 
  150.     return get_val(bc, 1);
                  ^
  151. }
  152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `bitstream_read_bit` 
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int synth_superframe(AVCodecContext *ctx, AVFrame *frame,\n                            int *got_frame_ptr)\n{\n    WMAVoiceContext *s = ctx->priv_data;\n    BitstreamContext *bc = &s->bc, s_bc;\n    int n, res, n_samples = 480;\n    double lsps[MAX_FRAMES][MAX_LSPS];\n    const double *mean_lsf = s->lsps == 16 ?\n        wmavoice_mean_lsf16[s->lsp_def_mode] : wmavoice_mean_lsf10[s->lsp_def_mode];\n    float excitation[MAX_SIGNAL_HISTORY + MAX_SFRAMESIZE + 12];\n    float synth[MAX_LSPS + MAX_SFRAMESIZE];\n    float *samples;\n    memcpy(synth,      s->synth_history,\n           s->lsps             * sizeof(*synth));\n    memcpy(excitation, s->excitation_history,\n           s->history_nsamples * sizeof(*excitation));\n    if (s->sframe_cache_size > 0) {\n        bc = &s_bc;\n        bitstream_init(bc, s->sframe_cache, s->sframe_cache_size);\n        s->sframe_cache_size = 0;\n    }\n    if ((res = check_bits_for_superframe(bc, s)) == 1) {\n        *got_frame_ptr = 0;\n        return 1;\n    } else if (res < 0)\n        return res;\n    if (!bitstream_read_bit(bc)) {\n        avpriv_request_sample(ctx, "WMAPro-in-WMAVoice");\n        return AVERROR_PATCHWELCOME;\n    }\n    if (bitstream_read_bit(bc)) {\n        if ((n_samples = bitstream_read(bc, 12)) > 480) {\n            av_log(ctx, AV_LOG_ERROR,\n                   "Superframe encodes >480 samples (%d), not allowed\\n",\n                   n_samples);\n            return AVERROR_INVALIDDATA;\n        }\n    }\n    if (s->has_residual_lsps) {\n        double prev_lsps[MAX_LSPS], a1[MAX_LSPS * 2], a2[MAX_LSPS * 2];\n        for (n = 0; n < s->lsps; n++)\n            prev_lsps[n] = s->prev_lsps[n] - mean_lsf[n];\n        if (s->lsps == 10) {\n            dequant_lsp10r(bc, lsps[2], prev_lsps, a1, a2, s->lsp_q_mode);\n        } else\n            dequant_lsp16r(bc, lsps[2], prev_lsps, a1, a2, s->lsp_q_mode);\n        for (n = 0; n < s->lsps; n++) {\n            lsps[0][n]  = mean_lsf[n] + (a1[n]           - a2[n * 2]);\n            lsps[1][n]  = mean_lsf[n] + (a1[s->lsps + n] - a2[n * 2 + 1]);\n            lsps[2][n] += mean_lsf[n];\n        }\n        for (n = 0; n < 3; n++)\n            stabilize_lsps(lsps[n], s->lsps);\n    }\n    frame->nb_samples = 480;\n    if ((res = ff_get_buffer(ctx, frame, 0)) < 0) {\n        av_log(ctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return res;\n    }\n    frame->nb_samples = n_samples;\n    samples = (float *)frame->data[0];\n    for (n = 0; n < 3; n++) {\n        if (!s->has_residual_lsps) {\n            int m;\n            if (s->lsps == 10) {\n                dequant_lsp10i(bc, lsps[n]);\n            } else\n                dequant_lsp16i(bc, lsps[n]);\n            for (m = 0; m < s->lsps; m++)\n                lsps[n][m] += mean_lsf[m];\n            stabilize_lsps(lsps[n], s->lsps);\n        }\n        if ((res = synth_frame(ctx, bc, n,\n                               &samples[n * MAX_FRAMESIZE],\n                               lsps[n], n == 0 ? s->prev_lsps : lsps[n - 1],\n                               &excitation[s->history_nsamples + n * MAX_FRAMESIZE],\n                               &synth[s->lsps + n * MAX_FRAMESIZE]))) {\n            *got_frame_ptr = 0;\n            return res;\n        }\n    }\n    if (bitstream_read_bit(bc)) {\n        res = bitstream_read(bc, 4);\n        bitstream_skip(bc, 10 * (res + 1));\n    }\n    *got_frame_ptr = 1;\n    memcpy(s->prev_lsps,           lsps[2],\n           s->lsps             * sizeof(*s->prev_lsps));\n    memcpy(s->synth_history,      &synth[MAX_SFRAMESIZE],\n           s->lsps             * sizeof(*synth));\n    memcpy(s->excitation_history, &excitation[MAX_SFRAMESIZE],\n           s->history_nsamples * sizeof(*excitation));\n    if (s->do_apf)\n        memmove(s->zero_exc_pf,       &s->zero_exc_pf[MAX_SFRAMESIZE],\n                s->history_nsamples * sizeof(*s->zero_exc_pf));\n    return 0;\n}', 'static inline int bitstream_init(BitstreamContext *bc, const uint8_t *buffer,\n                                 unsigned bit_size)\n{\n    unsigned buffer_size;\n    if (bit_size > INT_MAX - 7 || !buffer) {\n        buffer        =\n        bc->buffer    =\n        bc->ptr       = NULL;\n        bc->bits_left = 0;\n        return AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    bc->buffer       = buffer;\n    bc->buffer_end   = buffer + buffer_size;\n    bc->ptr          = bc->buffer;\n    bc->size_in_bits = bit_size;\n    bc->bits_left    = 0;\n    bc->bits         = 0;\n    refill_64(bc);\n    return 0;\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']