libavcodec/cbs_h265_syntax_template.c:876: error: Integer Overflow L2
  (32 - [0, max(63, `rw->bits_left`)]):unsigned32 by call to `ff_cbs_read_unsigned`.

libavcodec/cbs_h265_syntax_template.c:867:1: Parameter `rw->bits_left`
865. }
866. 
867. static int FUNC(pps_range_extension)(CodedBitstreamContext *ctx, RWContext *rw,
     ^
868.                                      H265RawPPS *current)
869. {

libavcodec/cbs_h265_syntax_template.c:876:5: Call
874.     if (current->transform_skip_enabled_flag)
875.         ue(log2_max_transform_skip_block_size_minus2, 0, 4);
876.     flag(cross_component_prediction_enabled_flag);
         ^
877. 
878.     flag(chroma_qp_offset_list_enabled_flag);

libavcodec/cbs.c:307:1: Parameter `bc->bits_left`
  305. }
  306. 
  307. int ff_cbs_read_unsigned(CodedBitstreamContext *ctx, BitstreamContext *bc,
       ^
  308.                          int width, const char *name, uint32_t *write_to,
  309.                          uint32_t range_min, uint32_t range_max)

libavcodec/cbs.c:325:13: Call
  323.         position = bitstream_tell(bc);
  324. 
  325.     value = bitstream_read(bc, width);
                   ^
  326. 
  327.     if (ctx->trace_enable) {

libavcodec/bitstream.h:182:1: Parameter `n`
    180. 
    181. /* Return n bits from the buffer. n has to be in the 0-32 range. */
    182. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
         ^
    183. {
    184.     if (!n)

libavcodec/bitstream.h:188:9: Call
    186. 
    187.     if (n > bc->bits_left) {
    188.         refill_32(bc);
                 ^
    189.         if (bc->bits_left < 32)
    190.             bc->bits_left = n;

libavcodec/bitstream.h:59:1: <RHS trace>
57. }
58. 
59. static inline void refill_32(BitstreamContext *bc)
    ^
60. {
61.     if (bc->ptr >= bc->buffer_end)

libavcodec/bitstream.h:59:1: Parameter `bc->bits_left`
      57. }
      58. 
      59. static inline void refill_32(BitstreamContext *bc)
          ^
      60. {
      61.     if (bc->ptr >= bc->buffer_end)

libavcodec/bitstream.h:67:5: Binary operation: (32 - [0, max(63, rw->bits_left)]):unsigned32 by call to `ff_cbs_read_unsigned` 
      65.     bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;
      66. #else
      67.     bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);
              ^
      68. #endif
      69.     bc->ptr       += 4;

static inline void refill_32(BitstreamContext *bc)
{
    if (bc->ptr >= bc->buffer_end)
        return;
#ifdef BITSTREAM_READER_LE
    bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;
#else
    bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);
#endif
    bc->ptr       += 4;
    bc->bits_left += 32;
}
['static int FUNC(pps_range_extension)(CodedBitstreamContext *ctx, RWContext *rw,\n                                     H265RawPPS *current)\n{\n    CodedBitstreamH265Context *h265 = ctx->priv_data;\n    const H265RawSPS *sps = h265->active_sps;\n    int err, i;\n    if (current->transform_skip_enabled_flag)\n        ue(log2_max_transform_skip_block_size_minus2, 0, 4);\n    flag(cross_component_prediction_enabled_flag);\n    flag(chroma_qp_offset_list_enabled_flag);\n    if (current->chroma_qp_offset_list_enabled_flag) {\n        ue(diff_cu_chroma_qp_offset_depth,\n           0, sps->log2_diff_max_min_luma_coding_block_size);\n        ue(chroma_qp_offset_list_len_minus1, 0, 5);\n        for (i = 0; i <= current->chroma_qp_offset_list_len_minus1; i++) {\n            se(cb_qp_offset_list[i], -12, +12);\n            se(cr_qp_offset_list[i], -12, +12);\n        }\n    }\n    ue(log2_sao_offset_scale_luma,   0, FFMAX(0, sps->bit_depth_luma_minus8   - 2));\n    ue(log2_sao_offset_scale_chroma, 0, FFMAX(0, sps->bit_depth_chroma_minus8 - 2));\n    return 0;\n}', 'int ff_cbs_read_unsigned(CodedBitstreamContext *ctx, BitstreamContext *bc,\n                         int width, const char *name, uint32_t *write_to,\n                         uint32_t range_min, uint32_t range_max)\n{\n    uint32_t value;\n    int position;\n    av_assert0(width <= 32);\n    if (bitstream_bits_left(bc) < width) {\n        av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid value at "\n               "%s: bitstream ended.\\n", name);\n        return AVERROR_INVALIDDATA;\n    }\n    if (ctx->trace_enable)\n        position = bitstream_tell(bc);\n    value = bitstream_read(bc, width);\n    if (ctx->trace_enable) {\n        char bits[33];\n        int i;\n        for (i = 0; i < width; i++)\n            bits[i] = value >> (width - i - 1) & 1 ? \'1\' : \'0\';\n        bits[i] = 0;\n        ff_cbs_trace_syntax_element(ctx, position, name, bits, value);\n    }\n    if (value < range_min || value > range_max) {\n        av_log(ctx->log_ctx, AV_LOG_ERROR, "%s out of range: "\n               "%"PRIu32", but must be in [%"PRIu32",%"PRIu32"].\\n",\n               name, value, range_min, range_max);\n        return AVERROR_INVALIDDATA;\n    }\n    *write_to = value;\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline void refill_32(BitstreamContext *bc)\n{\n    if (bc->ptr >= bc->buffer_end)\n        return;\n#ifdef BITSTREAM_READER_LE\n    bc->bits       = (uint64_t)AV_RL32(bc->ptr) << bc->bits_left | bc->bits;\n#else\n    bc->bits       = bc->bits | (uint64_t)AV_RB32(bc->ptr) << (32 - bc->bits_left);\n#endif\n    bc->ptr       += 4;\n    bc->bits_left += 32;\n}']