libavcodec/cavsdec.c:1039: error: Integer Overflow L2
  ([-3, +oo] - 1):unsigned32 by call to `decode_mb_p`.

libavcodec/cavsdec.c:1034:17: Call
1032.     } else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) {
1033.         do {
1034.             if (check_for_slice(h))
                      ^
1035.                 skip_count = -1;
1036.             if (h->skip_mode_flag && (skip_count < 0))

libavcodec/cavsdec.c:900:1: Parameter `h->bc.bits_left`
  898. }
  899. 
  900. static inline int check_for_slice(AVSContext *h)
       ^
  901. {
  902.     BitstreamContext *bc = &h->bc;

libavcodec/cavsdec.c:1039:17: Call
1037.                 skip_count = get_ue_golomb(&h->bc);
1038.             if (h->skip_mode_flag && skip_count--) {
1039.                 decode_mb_p(h, P_SKIP);
                      ^
1040.             } else {
1041.                 mb_type = get_ue_golomb(&h->bc) + P_SKIP + h->skip_mode_flag;

libavcodec/cavsdec.c:717:1: Parameter `h->bc.bits_left`
  715. }
  716. 
  717. static void decode_mb_p(AVSContext *h, enum cavs_mb mb_type)
       ^
  718. {
  719.     BitstreamContext *bc = &h->bc;

libavcodec/cavsdec.c:747:36: Call
  745.         ref[1] = h->ref_flag ? 0 : bitstream_read_bit(bc);
  746.         ref[2] = h->ref_flag ? 0 : bitstream_read_bit(bc);
  747.         ref[3] = h->ref_flag ? 0 : bitstream_read_bit(bc);
                                          ^
  748.         ff_cavs_mv(h, MV_FWD_X0, MV_FWD_B3, MV_PRED_MEDIAN,   BLK_8X8, ref[0]);
  749.         ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN,   BLK_8X8, ref[1]);

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([-3, +oo] - 1):unsigned32 by call to `decode_mb_p` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int decode_pic(AVSContext *h)\n{\n    int ret;\n    int skip_count    = -1;\n    enum cavs_mb mb_type;\n    if (!h->top_qp) {\n        av_log(h->avctx, AV_LOG_ERROR, "No sequence header decoded yet\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    av_frame_unref(h->cur.f);\n    bitstream_skip(&h->bc, 16);\n    if (h->stc == PIC_PB_START_CODE) {\n        h->cur.f->pict_type = bitstream_read(&h->bc, 2) + AV_PICTURE_TYPE_I;\n        if (h->cur.f->pict_type > AV_PICTURE_TYPE_B) {\n            av_log(h->avctx, AV_LOG_ERROR, "illegal picture type\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        if (!h->DPB[0].f->data[0] ||\n           (!h->DPB[1].f->data[0] && h->cur.f->pict_type == AV_PICTURE_TYPE_B))\n            return AVERROR_INVALIDDATA;\n    } else {\n        h->cur.f->pict_type = AV_PICTURE_TYPE_I;\n        if (bitstream_read_bit(&h->bc))\n            bitstream_skip(&h->bc, 24);\n        if (h->low_delay || !(bitstream_peek(&h->bc, 9) & 1))\n            h->stream_revision = 1;\n        else if (bitstream_peek(&h->bc, 11) & 3)\n            h->stream_revision = 1;\n        if (h->stream_revision > 0)\n            bitstream_skip(&h->bc, 1);\n    }\n    ret = ff_get_buffer(h->avctx, h->cur.f, h->cur.f->pict_type == AV_PICTURE_TYPE_B ?\n                        0 : AV_GET_BUFFER_FLAG_REF);\n    if (ret < 0)\n        return ret;\n    if (!h->edge_emu_buffer) {\n        int alloc_size = FFALIGN(FFABS(h->cur.f->linesize[0]) + 32, 32);\n        h->edge_emu_buffer = av_mallocz(alloc_size * 2 * 24);\n        if (!h->edge_emu_buffer)\n            return AVERROR(ENOMEM);\n    }\n    ff_cavs_init_pic(h);\n    h->cur.poc = bitstream_read(&h->bc, 8) * 2;\n    if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {\n        h->dist[0] = (h->cur.poc - h->DPB[0].poc  + 512) % 512;\n    } else {\n        h->dist[0] = (h->DPB[0].poc  - h->cur.poc + 512) % 512;\n    }\n    h->dist[1] = (h->cur.poc - h->DPB[1].poc  + 512) % 512;\n    h->scale_den[0] = h->dist[0] ? 512/h->dist[0] : 0;\n    h->scale_den[1] = h->dist[1] ? 512/h->dist[1] : 0;\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_B) {\n        h->sym_factor = h->dist[0] * h->scale_den[1];\n    } else {\n        h->direct_den[0] = h->dist[0] ? 16384 / h->dist[0] : 0;\n        h->direct_den[1] = h->dist[1] ? 16384 / h->dist[1] : 0;\n    }\n    if (h->low_delay)\n        get_ue_golomb(&h->bc);\n    h->progressive   = bitstream_read_bit(&h->bc);\n    h->pic_structure = 1;\n    if (!h->progressive)\n        h->pic_structure = bitstream_read_bit(&h->bc);\n    if (!h->pic_structure && h->stc == PIC_PB_START_CODE)\n        bitstream_skip(&h->bc, 1);\n    bitstream_skip(&h->bc, 1);\n    bitstream_skip(&h->bc, 1);\n    h->qp_fixed = bitstream_read_bit(&h->bc);\n    h->qp       = bitstream_read(&h->bc, 6);\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {\n        if (!h->progressive && !h->pic_structure)\n            bitstream_skip(&h->bc, 1);\n        bitstream_skip(&h->bc, 4);\n    } else {\n        if (!(h->cur.f->pict_type == AV_PICTURE_TYPE_B && h->pic_structure == 1))\n            h->ref_flag        = bitstream_read_bit(&h->bc);\n        bitstream_skip(&h->bc, 4);\n        h->skip_mode_flag      = bitstream_read_bit(&h->bc);\n    }\n    h->loop_filter_disable     = bitstream_read_bit(&h->bc);\n    if (!h->loop_filter_disable && bitstream_read_bit(&h->bc)) {\n        h->alpha_offset        = get_se_golomb(&h->bc);\n        h->beta_offset         = get_se_golomb(&h->bc);\n    } else {\n        h->alpha_offset = h->beta_offset  = 0;\n    }\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {\n        do {\n            check_for_slice(h);\n            decode_mb_i(h, 0);\n        } while (ff_cavs_next_mb(h));\n    } else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) {\n        do {\n            if (check_for_slice(h))\n                skip_count = -1;\n            if (h->skip_mode_flag && (skip_count < 0))\n                skip_count = get_ue_golomb(&h->bc);\n            if (h->skip_mode_flag && skip_count--) {\n                decode_mb_p(h, P_SKIP);\n            } else {\n                mb_type = get_ue_golomb(&h->bc) + P_SKIP + h->skip_mode_flag;\n                if (mb_type > P_8X8)\n                    decode_mb_i(h, mb_type - P_8X8 - 1);\n                else\n                    decode_mb_p(h, mb_type);\n            }\n        } while (ff_cavs_next_mb(h));\n    } else {\n        do {\n            if (check_for_slice(h))\n                skip_count = -1;\n            if (h->skip_mode_flag && (skip_count < 0))\n                skip_count = get_ue_golomb(&h->bc);\n            if (h->skip_mode_flag && skip_count--) {\n                decode_mb_b(h, B_SKIP);\n            } else {\n                mb_type = get_ue_golomb(&h->bc) + B_SKIP + h->skip_mode_flag;\n                if (mb_type > B_8X8)\n                    decode_mb_i(h, mb_type - B_8X8 - 1);\n                else\n                    decode_mb_b(h, mb_type);\n            }\n        } while (ff_cavs_next_mb(h));\n    }\n    if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {\n        av_frame_unref(h->DPB[1].f);\n        FFSWAP(AVSFrame, h->cur, h->DPB[1]);\n        FFSWAP(AVSFrame, h->DPB[0], h->DPB[1]);\n    }\n    return 0;\n}', 'static inline int check_for_slice(AVSContext *h)\n{\n    BitstreamContext *bc = &h->bc;\n    int align;\n    if (h->mbx)\n        return 0;\n    align = (-bitstream_tell(bc)) & 7;\n    if (!align && (bitstream_peek(bc, 8) == 0x80))\n        align = 8;\n    if ((bitstream_peek(bc, 24 + align) & 0xFFFFFF) == 0x000001) {\n        bitstream_skip(bc, 24 + align);\n        h->stc = bitstream_read(bc, 8);\n        if (h->stc >= h->mb_height)\n            return 0;\n        decode_slice_header(h, bc);\n        return 1;\n    }\n    return 0;\n}', 'static void decode_mb_p(AVSContext *h, enum cavs_mb mb_type)\n{\n    BitstreamContext *bc = &h->bc;\n    int ref[4];\n    ff_cavs_init_mb(h);\n    switch (mb_type) {\n    case P_SKIP:\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_C2, MV_PRED_PSKIP,  BLK_16X16, 0);\n        break;\n    case P_16X16:\n        ref[0] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_C2, MV_PRED_MEDIAN, BLK_16X16, ref[0]);\n        break;\n    case P_16X8:\n        ref[0] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[2] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_C2, MV_PRED_TOP,    BLK_16X8, ref[0]);\n        ff_cavs_mv(h, MV_FWD_X2, MV_FWD_A1, MV_PRED_LEFT,   BLK_16X8, ref[2]);\n        break;\n    case P_8X16:\n        ref[0] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[1] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_B3, MV_PRED_LEFT,     BLK_8X16, ref[0]);\n        ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_TOPRIGHT, BLK_8X16, ref[1]);\n        break;\n    case P_8X8:\n        ref[0] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[1] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[2] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ref[3] = h->ref_flag ? 0 : bitstream_read_bit(bc);\n        ff_cavs_mv(h, MV_FWD_X0, MV_FWD_B3, MV_PRED_MEDIAN,   BLK_8X8, ref[0]);\n        ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN,   BLK_8X8, ref[1]);\n        ff_cavs_mv(h, MV_FWD_X2, MV_FWD_X1, MV_PRED_MEDIAN,   BLK_8X8, ref[2]);\n        ff_cavs_mv(h, MV_FWD_X3, MV_FWD_X0, MV_PRED_MEDIAN,   BLK_8X8, ref[3]);\n    }\n    ff_cavs_inter(h, mb_type);\n    set_intra_mode_default(h);\n    store_mvs(h);\n    if (mb_type != P_SKIP)\n        decode_residual_inter(h);\n    ff_cavs_filter(h, mb_type);\n    h->col_type_base[h->mbidx] = mb_type;\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']