libavcodec/sgidec.c:230: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi`.

libavcodec/sgidec.c:179:17: Call
177.     dimension = bytestream_get_be16(&in_buf);
178.     s->width  = bytestream_get_be16(&in_buf);
179.     s->height = bytestream_get_be16(&in_buf);
                     ^
180.     s->depth  = bytestream_get_be16(&in_buf);
181. 

libavcodec/bytestream.h:51:1: Call
  49. DEF  (be32, 4, AV_RB32, AV_WB32)
  50. DEF  (be24, 3, AV_RB24, AV_WB24)
  51. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  52. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  53. 

libavutil/bswap.h:58:1: Parameter `x`
    56. 
    57. #ifndef av_bswap16
    58. static av_always_inline av_const uint16_t av_bswap16(uint16_t x)
        ^
    59. {
    60.     x= (x>>8) | (x<<8);

libavutil/bswap.h:60:5: Assignment
    58. static av_always_inline av_const uint16_t av_bswap16(uint16_t x)
    59. {
    60.     x= (x>>8) | (x<<8);
            ^
    61.     return x;
    62. }

libavutil/bswap.h:61:5: Assignment
    59. {
    60.     x= (x>>8) | (x<<8);
    61.     return x;
            ^
    62. }
    63. #endif

libavcodec/bytestream.h:51:1: Assignment
  49. DEF  (be32, 4, AV_RB32, AV_WB32)
  50. DEF  (be24, 3, AV_RB24, AV_WB24)
  51. DEF  (be16, 2, AV_RB16, AV_WB16)
      ^
  52. DEF  (byte, 1, AV_RB8 , AV_WB8 )
  53. 

libavcodec/sgidec.c:179:5: Assignment
177.     dimension = bytestream_get_be16(&in_buf);
178.     s->width  = bytestream_get_be16(&in_buf);
179.     s->height = bytestream_get_be16(&in_buf);
         ^
180.     s->depth  = bytestream_get_be16(&in_buf);
181. 

libavcodec/sgidec.c:230:15: Call
228.         ret = read_rle_sgi(out_end, in_buf, in_end, s);
229.     } else {
230.         ret = read_uncompressed_sgi(out_buf, out_end, in_buf, in_end, s);
                   ^
231.     }
232. 

libavcodec/sgidec.c:124:1: <LHS trace>
122.  * @return 0 if read success, otherwise return -1.
123.  */
124. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
     ^
125.                 const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
126. {

libavcodec/sgidec.c:124:1: Parameter `s->height`
  122.  * @return 0 if read success, otherwise return -1.
  123.  */
  124. static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
       ^
  125.                 const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
  126. {

libavcodec/sgidec.c:136:10: Binary operation: ([0, +oo] - 1):unsigned32 by call to `read_uncompressed_sgi` 
  134.     }
  135. 
  136.     for (y = s->height - 1; y >= 0; y--) {
                ^
  137.         out_end = out_buf + (y * s->linesize);
  138.         for (x = s->width; x > 0; x--) {

static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,
                const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)
{
    int x, y, z;
    const uint8_t *ptr;
    unsigned int offset = s->height * s->width * s->bytes_per_channel;
    if (offset * s->depth > in_end - in_buf) {
       return -1;
    }
    for (y = s->height - 1; y >= 0; y--) {
        out_end = out_buf + (y * s->linesize);
        for (x = s->width; x > 0; x--) {
            ptr = in_buf += s->bytes_per_channel;
            for(z = 0; z < s->depth; z ++) {
                memcpy(out_end, ptr, s->bytes_per_channel);
                out_end += s->bytes_per_channel;
                ptr += offset;
            }
        }
    }
    return 0;
}
['static int decode_frame(AVCodecContext *avctx,\n                        void *data, int *data_size,\n                        AVPacket *avpkt)\n{\n    const uint8_t *in_buf = avpkt->data;\n    int buf_size = avpkt->size;\n    SgiState *s = avctx->priv_data;\n    AVFrame *picture = data;\n    AVFrame *p = &s->picture;\n    const uint8_t *in_end = in_buf + buf_size;\n    unsigned int dimension, rle;\n    int ret = 0;\n    uint8_t *out_buf, *out_end;\n    if (buf_size < SGI_HEADER_SIZE){\n        av_log(avctx, AV_LOG_ERROR, "buf_size too small (%d)\\n", buf_size);\n        return -1;\n    }\n    if (bytestream_get_be16(&in_buf) != SGI_MAGIC) {\n        av_log(avctx, AV_LOG_ERROR, "bad magic number\\n");\n        return -1;\n    }\n    rle = bytestream_get_byte(&in_buf);\n    s->bytes_per_channel = bytestream_get_byte(&in_buf);\n    dimension = bytestream_get_be16(&in_buf);\n    s->width  = bytestream_get_be16(&in_buf);\n    s->height = bytestream_get_be16(&in_buf);\n    s->depth  = bytestream_get_be16(&in_buf);\n    if (s->bytes_per_channel != 1 && (s->bytes_per_channel != 2 || rle)) {\n        av_log(avctx, AV_LOG_ERROR, "wrong channel number\\n");\n        return -1;\n    }\n    if (dimension != 2 && dimension != 3) {\n        av_log(avctx, AV_LOG_ERROR, "wrong dimension number\\n");\n        return -1;\n    }\n    if (s->depth == SGI_GRAYSCALE) {\n        avctx->pix_fmt = s->bytes_per_channel == 2 ? PIX_FMT_GRAY16BE : PIX_FMT_GRAY8;\n    } else if (s->depth == SGI_RGB) {\n        avctx->pix_fmt = s->bytes_per_channel == 2 ? PIX_FMT_RGB48BE : PIX_FMT_RGB24;\n    } else if (s->depth == SGI_RGBA && s->bytes_per_channel == 1) {\n        avctx->pix_fmt = PIX_FMT_RGBA;\n    } else {\n        av_log(avctx, AV_LOG_ERROR, "wrong picture format\\n");\n        return -1;\n    }\n    if (avcodec_check_dimensions(avctx, s->width, s->height))\n        return -1;\n    avcodec_set_dimensions(avctx, s->width, s->height);\n    if (p->data[0])\n        avctx->release_buffer(avctx, p);\n    p->reference = 0;\n    if (avctx->get_buffer(avctx, p) < 0) {\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed.\\n");\n        return -1;\n    }\n    p->pict_type = FF_I_TYPE;\n    p->key_frame = 1;\n    out_buf = p->data[0];\n    out_end = out_buf + p->linesize[0] * s->height;\n    s->linesize = p->linesize[0];\n    in_buf += SGI_HEADER_SIZE - 12;\n    if (rle) {\n        ret = read_rle_sgi(out_end, in_buf, in_end, s);\n    } else {\n        ret = read_uncompressed_sgi(out_buf, out_end, in_buf, in_end, s);\n    }\n    if (ret == 0) {\n        *picture   = s->picture;\n        *data_size = sizeof(AVPicture);\n        return buf_size;\n    } else {\n        return -1;\n    }\n}', 'DEF  (be16, 2, AV_RB16, AV_WB16)', 'static av_always_inline av_const uint16_t av_bswap16(uint16_t x)\n{\n    x= (x>>8) | (x<<8);\n    return x;\n}', 'static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end,\n                const uint8_t *in_buf, const uint8_t *in_end, SgiState* s)\n{\n    int x, y, z;\n    const uint8_t *ptr;\n    unsigned int offset = s->height * s->width * s->bytes_per_channel;\n    if (offset * s->depth > in_end - in_buf) {\n       return -1;\n    }\n    for (y = s->height - 1; y >= 0; y--) {\n        out_end = out_buf + (y * s->linesize);\n        for (x = s->width; x > 0; x--) {\n            ptr = in_buf += s->bytes_per_channel;\n            for(z = 0; z < s->depth; z ++) {\n                memcpy(out_end, ptr, s->bytes_per_channel);\n                out_end += s->bytes_per_channel;\n                ptr += offset;\n            }\n        }\n    }\n    return 0;\n}']