libavcodec/vb.c:66: error: Integer Overflow L2
  ([0, `*c->stream.buffer`] - 1):unsigned32.

libavcodec/vb.c:61:1: <LHS trace>
59. };
60. 
61. static void vb_decode_palette(VBDecContext *c, int data_size)
    ^
62. {
63.     int start, size, i;

libavcodec/vb.c:61:1: Parameter `*c->stream.buffer`
59. };
60. 
61. static void vb_decode_palette(VBDecContext *c, int data_size)
    ^
62. {
63.     int start, size, i;

libavcodec/vb.c:65:13: Call
63.     int start, size, i;
64. 
65.     start = bytestream2_get_byte(&c->stream);
                ^
66.     size = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;
67.     if(start + size > 255){

libavcodec/bytestream.h:72:1: Parameter `*g->buffer`
  70. DEF  (be24, 3, AV_RB24, AV_WB24)
  71. DEF  (be16, 2, AV_RB16, AV_WB16)
  72. DEF  (byte, 1, AV_RB8 , AV_WB8 )
      ^
  73. 
  74. #undef DEF

libavcodec/vb.c:66:13: Call
64. 
65.     start = bytestream2_get_byte(&c->stream);
66.     size = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;
                ^
67.     if(start + size > 255){
68.         av_log(c->avctx, AV_LOG_ERROR, "Palette change runs beyond entry 256\n");

libavcodec/bytestream.h:72:1: Assignment
  70. DEF  (be24, 3, AV_RB24, AV_WB24)
  71. DEF  (be16, 2, AV_RB16, AV_WB16)
  72. DEF  (byte, 1, AV_RB8 , AV_WB8 )
      ^
  73. 
  74. #undef DEF

libavcodec/vb.c:66:5: Binary operation: ([0, *c->stream.buffer] - 1):unsigned32
64. 
65.     start = bytestream2_get_byte(&c->stream);
66.     size = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;
        ^
67.     if(start + size > 255){
68.         av_log(c->avctx, AV_LOG_ERROR, "Palette change runs beyond entry 256\n");

static void vb_decode_palette(VBDecContext *c, int data_size)
{
    int start, size, i;
    start = bytestream2_get_byte(&c->stream);
    size = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;
    if(start + size > 255){
        av_log(c->avctx, AV_LOG_ERROR, "Palette change runs beyond entry 256\n");
        return;
    }
    if(size*3+2 > data_size){
        av_log(c->avctx, AV_LOG_ERROR, "Palette data runs beyond chunk size\n");
        return;
    }
    for(i = start; i <= start + size; i++)
        c->pal[i] = bytestream2_get_be24(&c->stream);
}
['static void vb_decode_palette(VBDecContext *c, int data_size)\n{\n    int start, size, i;\n    start = bytestream2_get_byte(&c->stream);\n    size = (bytestream2_get_byte(&c->stream) - 1) & 0xFF;\n    if(start + size > 255){\n        av_log(c->avctx, AV_LOG_ERROR, "Palette change runs beyond entry 256\\n");\n        return;\n    }\n    if(size*3+2 > data_size){\n        av_log(c->avctx, AV_LOG_ERROR, "Palette data runs beyond chunk size\\n");\n        return;\n    }\n    for(i = start; i <= start + size; i++)\n        c->pal[i] = bytestream2_get_be24(&c->stream);\n}', 'DEF  (byte, 1, AV_RB8 , AV_WB8 )']