libavcodec/on2avc.c:826: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `on2avc_read_ms_info`.

libavcodec/on2avc.c:811:27: Call
809.     }
810.     c->prev_window_type = c->window_type;
811.     c->window_type      = bitstream_read(&bc, 3);
                               ^
812.     if (c->window_type >= WINDOW_TYPE_EXT4 && c->avctx->channels == 1) {
813.         av_log(c->avctx, AV_LOG_ERROR, "stereo mode window for mono audio\n");

libavcodec/bitstream.h:183:1: Parameter `bc->bits_left`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/on2avc.c:826:5: Call
824.         c->grouping[i] = !bitstream_read_bit(&bc);
825. 
826.     on2avc_read_ms_info(c, &bc);
         ^
827.     for (i = 0; i < c->avctx->channels; i++)
828.         if ((ret = on2avc_read_channel_data(c, &bc, i)) < 0)

libavcodec/on2avc.c:89:1: Parameter `bc->bits_left`
  87. } On2AVCContext;
  88. 
  89. static void on2avc_read_ms_info(On2AVCContext *c, BitstreamContext *bc)
      ^
  90. {
  91.     int w, b, band_off = 0;

libavcodec/on2avc.c:93:21: Call
  91.     int w, b, band_off = 0;
  92. 
  93.     c->ms_present = bitstream_read_bit(bc);
                          ^
  94.     if (!c->ms_present)
  95.         return;

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `on2avc_read_ms_info` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int on2avc_decode_subframe(On2AVCContext *c, const uint8_t *buf,\n                                  int buf_size, AVFrame *dst, int offset)\n{\n    BitstreamContext bc;\n    int i, ret;\n    bitstream_init8(&bc, buf, buf_size);\n    if (bitstream_read_bit(&bc)) {\n        av_log(c->avctx, AV_LOG_ERROR, "enh bit set\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    c->prev_window_type = c->window_type;\n    c->window_type      = bitstream_read(&bc, 3);\n    if (c->window_type >= WINDOW_TYPE_EXT4 && c->avctx->channels == 1) {\n        av_log(c->avctx, AV_LOG_ERROR, "stereo mode window for mono audio\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    c->band_start  = c->modes[c->window_type].band_start;\n    c->num_windows = c->modes[c->window_type].num_windows;\n    c->num_bands   = c->modes[c->window_type].num_bands;\n    c->is_long     = (c->window_type != WINDOW_TYPE_8SHORT);\n    c->grouping[0] = 1;\n    for (i = 1; i < c->num_windows; i++)\n        c->grouping[i] = !bitstream_read_bit(&bc);\n    on2avc_read_ms_info(c, &bc);\n    for (i = 0; i < c->avctx->channels; i++)\n        if ((ret = on2avc_read_channel_data(c, &bc, i)) < 0)\n            return AVERROR_INVALIDDATA;\n    if (c->avctx->channels == 2 && c->ms_present)\n        on2avc_apply_ms(c);\n    if (c->window_type < WINDOW_TYPE_EXT4) {\n        for (i = 0; i < c->avctx->channels; i++)\n            on2avc_reconstruct_channel(c, i, dst, offset);\n    } else {\n        on2avc_reconstruct_stereo(c, dst, offset);\n    }\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static void on2avc_read_ms_info(On2AVCContext *c, BitstreamContext *bc)\n{\n    int w, b, band_off = 0;\n    c->ms_present = bitstream_read_bit(bc);\n    if (!c->ms_present)\n        return;\n    for (w = 0; w < c->num_windows; w++) {\n        if (!c->grouping[w]) {\n            memcpy(c->ms_info + band_off,\n                   c->ms_info + band_off - c->num_bands,\n                   c->num_bands * sizeof(*c->ms_info));\n            band_off += c->num_bands;\n            continue;\n        }\n        for (b = 0; b < c->num_bands; b++)\n            c->ms_info[band_off++] = bitstream_read_bit(bc);\n    }\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']