libavcodec/webp.c:507: error: Integer Overflow L2
  ([0, +oo] - 1):unsigned32 by call to `decode_entropy_coded_image`.

libavcodec/webp.c:505:5: Call
503.     int block_bits, blocks_w, blocks_h, ret;
504. 
505.     PARSE_BLOCK_SIZE(s->width, s->height);
         ^
506. 
507.     ret = decode_entropy_coded_image(s, IMAGE_ROLE_COLOR_TRANSFORM, blocks_w,

libavcodec/bitstream.h:183:1: Parameter `bc->bits_left`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavcodec/webp.c:507:11: Call
505.     PARSE_BLOCK_SIZE(s->width, s->height);
506. 
507.     ret = decode_entropy_coded_image(s, IMAGE_ROLE_COLOR_TRANSFORM, blocks_w,
               ^
508.                                      blocks_h);
509.     if (ret < 0)

libavcodec/webp.c:575:1: Parameter `s->bc.bits_left`
  573. }
  574. 
  575. static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
       ^
  576.                                       int w, int h)
  577. {

libavcodec/webp.c:603:9: Call
  601.         return ret;
  602. 
  603.     if (bitstream_read_bit(&s->bc)) {
               ^
  604.         img->color_cache_bits = bitstream_read(&s->bc, 4);
  605.         if (img->color_cache_bits < 1 || img->color_cache_bits > 11) {

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `decode_entropy_coded_image` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int parse_transform_color(WebPContext *s)\n{\n    int block_bits, blocks_w, blocks_h, ret;\n    PARSE_BLOCK_SIZE(s->width, s->height);\n    ret = decode_entropy_coded_image(s, IMAGE_ROLE_COLOR_TRANSFORM, blocks_w,\n                                     blocks_h);\n    if (ret < 0)\n        return ret;\n    s->image[IMAGE_ROLE_COLOR_TRANSFORM].size_reduction = block_bits;\n    return 0;\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,\n                                      int w, int h)\n{\n    ImageContext *img;\n    HuffReader *hg;\n    int i, j, ret, x, y, width;\n    img       = &s->image[role];\n    img->role = role;\n    if (!img->frame) {\n        img->frame = av_frame_alloc();\n        if (!img->frame)\n            return AVERROR(ENOMEM);\n    }\n    img->frame->format = AV_PIX_FMT_ARGB;\n    img->frame->width  = w;\n    img->frame->height = h;\n    if (role == IMAGE_ROLE_ARGB && !img->is_alpha_primary) {\n        ThreadFrame pt = { .f = img->frame };\n        ret = ff_thread_get_buffer(s->avctx, &pt, 0);\n    } else\n        ret = av_frame_get_buffer(img->frame, 1);\n    if (ret < 0)\n        return ret;\n    if (bitstream_read_bit(&s->bc)) {\n        img->color_cache_bits = bitstream_read(&s->bc, 4);\n        if (img->color_cache_bits < 1 || img->color_cache_bits > 11) {\n            av_log(s->avctx, AV_LOG_ERROR, "invalid color cache bits: %d\\n",\n                   img->color_cache_bits);\n            return AVERROR_INVALIDDATA;\n        }\n        img->color_cache = av_mallocz_array(1 << img->color_cache_bits,\n                                            sizeof(*img->color_cache));\n        if (!img->color_cache)\n            return AVERROR(ENOMEM);\n    } else {\n        img->color_cache_bits = 0;\n    }\n    img->nb_huffman_groups = 1;\n    if (role == IMAGE_ROLE_ARGB && bitstream_read_bit(&s->bc)) {\n        ret = decode_entropy_image(s);\n        if (ret < 0)\n            return ret;\n        img->nb_huffman_groups = s->nb_huffman_groups;\n    }\n    img->huffman_groups = av_mallocz_array(img->nb_huffman_groups *\n                                           HUFFMAN_CODES_PER_META_CODE,\n                                           sizeof(*img->huffman_groups));\n    if (!img->huffman_groups)\n        return AVERROR(ENOMEM);\n    for (i = 0; i < img->nb_huffman_groups; i++) {\n        hg = &img->huffman_groups[i * HUFFMAN_CODES_PER_META_CODE];\n        for (j = 0; j < HUFFMAN_CODES_PER_META_CODE; j++) {\n            int alphabet_size = alphabet_sizes[j];\n            if (!j && img->color_cache_bits > 0)\n                alphabet_size += 1 << img->color_cache_bits;\n            if (bitstream_read_bit(&s->bc)) {\n                read_huffman_code_simple(s, &hg[j]);\n            } else {\n                ret = read_huffman_code_normal(s, &hg[j], alphabet_size);\n                if (ret < 0)\n                    return ret;\n            }\n        }\n    }\n    width = img->frame->width;\n    if (role == IMAGE_ROLE_ARGB && s->reduced_width > 0)\n        width = s->reduced_width;\n    x = 0; y = 0;\n    while (y < img->frame->height) {\n        int v;\n        hg = get_huffman_group(s, img, x, y);\n        v = huff_reader_get_symbol(&hg[HUFF_IDX_GREEN], &s->bc);\n        if (v < NUM_LITERAL_CODES) {\n            uint8_t *p = GET_PIXEL(img->frame, x, y);\n            p[2] = v;\n            p[1] = huff_reader_get_symbol(&hg[HUFF_IDX_RED],   &s->bc);\n            p[3] = huff_reader_get_symbol(&hg[HUFF_IDX_BLUE],  &s->bc);\n            p[0] = huff_reader_get_symbol(&hg[HUFF_IDX_ALPHA], &s->bc);\n            if (img->color_cache_bits)\n                color_cache_put(img, AV_RB32(p));\n            x++;\n            if (x == width) {\n                x = 0;\n                y++;\n            }\n        } else if (v < NUM_LITERAL_CODES + NUM_LENGTH_CODES) {\n            int prefix_code, length, distance, ref_x, ref_y;\n            prefix_code = v - NUM_LITERAL_CODES;\n            if (prefix_code < 4) {\n                length = prefix_code + 1;\n            } else {\n                int extra_bits = (prefix_code - 2) >> 1;\n                int offset     = 2 + (prefix_code & 1) << extra_bits;\n                length = offset + bitstream_read(&s->bc, extra_bits) + 1;\n            }\n            prefix_code = huff_reader_get_symbol(&hg[HUFF_IDX_DIST], &s->bc);\n            if (prefix_code > 39) {\n                av_log(s->avctx, AV_LOG_ERROR,\n                       "distance prefix code too large: %d\\n", prefix_code);\n                return AVERROR_INVALIDDATA;\n            }\n            if (prefix_code < 4) {\n                distance = prefix_code + 1;\n            } else {\n                int extra_bits = prefix_code - 2 >> 1;\n                int offset     = 2 + (prefix_code & 1) << extra_bits;\n                distance = offset + bitstream_read(&s->bc, extra_bits) + 1;\n            }\n            if (distance <= NUM_SHORT_DISTANCES) {\n                int xi = lz77_distance_offsets[distance - 1][0];\n                int yi = lz77_distance_offsets[distance - 1][1];\n                distance = FFMAX(1, xi + yi * width);\n            } else {\n                distance -= NUM_SHORT_DISTANCES;\n            }\n            ref_x = x;\n            ref_y = y;\n            if (distance <= x) {\n                ref_x -= distance;\n                distance = 0;\n            } else {\n                ref_x = 0;\n                distance -= x;\n            }\n            while (distance >= width) {\n                ref_y--;\n                distance -= width;\n            }\n            if (distance > 0) {\n                ref_x = width - distance;\n                ref_y--;\n            }\n            ref_x = FFMAX(0, ref_x);\n            ref_y = FFMAX(0, ref_y);\n            for (i = 0; i < length; i++) {\n                uint8_t *p_ref = GET_PIXEL(img->frame, ref_x, ref_y);\n                uint8_t *p     = GET_PIXEL(img->frame,     x,     y);\n                AV_COPY32(p, p_ref);\n                if (img->color_cache_bits)\n                    color_cache_put(img, AV_RB32(p));\n                x++;\n                ref_x++;\n                if (x == width) {\n                    x = 0;\n                    y++;\n                }\n                if (ref_x == width) {\n                    ref_x = 0;\n                    ref_y++;\n                }\n                if (y == img->frame->height || ref_y == img->frame->height)\n                    break;\n            }\n        } else {\n            uint8_t *p = GET_PIXEL(img->frame, x, y);\n            int cache_idx = v - (NUM_LITERAL_CODES + NUM_LENGTH_CODES);\n            if (!img->color_cache_bits) {\n                av_log(s->avctx, AV_LOG_ERROR, "color cache not found\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            if (cache_idx >= 1 << img->color_cache_bits) {\n                av_log(s->avctx, AV_LOG_ERROR,\n                       "color cache index out-of-bounds\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            AV_WB32(p, img->color_cache[cache_idx]);\n            x++;\n            if (x == width) {\n                x = 0;\n                y++;\n            }\n        }\n    }\n    return 0;\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']