libavcodec/aacdec.c:1849: error: Integer Overflow L2
  ([0, +oo] - 90):unsigned32 by call to `decode_scalefactors`.

libavcodec/aacdec.c:1839:19: Call
1837.     pulse.num_pulse = 0;
1838. 
1839.     global_gain = get_bits(gb, 8);
                        ^
1840. 
1841.     if (!common_window && !scale_flag) {

libavcodec/get_bits.h:244:5: Call
  242.     register int tmp;
  243.     OPEN_READER(re, s);
  244.     UPDATE_CACHE(re, s);
           ^
  245.     tmp = SHOW_UBITS(re, s, n);
  246.     LAST_SKIP_BITS(re, s, n);

libavutil/ppc/intreadwrite.h:77:5: Assignment
    75.     uint32_t v;
    76.     __asm__ ("lwbrx   %0, %y1" : "=r"(v) : "Z"(*(const uint32_t*)p));
    77.     return v;
            ^
    78. }
    79. 

libavcodec/get_bits.h:244:5: Assignment
  242.     register int tmp;
  243.     OPEN_READER(re, s);
  244.     UPDATE_CACHE(re, s);
           ^
  245.     tmp = SHOW_UBITS(re, s, n);
  246.     LAST_SKIP_BITS(re, s, n);

libavcodec/get_bits.h:245:5: Assignment
  243.     OPEN_READER(re, s);
  244.     UPDATE_CACHE(re, s);
  245.     tmp = SHOW_UBITS(re, s, n);
           ^
  246.     LAST_SKIP_BITS(re, s, n);
  247.     CLOSE_READER(re, s);

libavcodec/get_bits.h:248:5: Assignment
  246.     LAST_SKIP_BITS(re, s, n);
  247.     CLOSE_READER(re, s);
  248.     return tmp;
           ^
  249. }
  250. 

libavcodec/aacdec.c:1839:5: Assignment
1837.     pulse.num_pulse = 0;
1838. 
1839.     global_gain = get_bits(gb, 8);
          ^
1840. 
1841.     if (!common_window && !scale_flag) {

libavcodec/aacdec.c:1849:16: Call
1847.                                  sce->band_type_run_end, gb, ics)) < 0)
1848.         return ret;
1849.     if ((ret = decode_scalefactors(ac, sce->sf, gb, global_gain, ics,
                     ^
1850.                                   sce->band_type, sce->band_type_run_end)) < 0)
1851.         return ret;

libavcodec/aacdec.c:1282:1: <LHS trace>
1280.  * @return  Returns error status. 0 - OK, !0 - error
1281.  */
1282. static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
      ^
1283.                                unsigned int global_gain,
1284.                                IndividualChannelStream *ics,

libavcodec/aacdec.c:1282:1: Parameter `global_gain`
  1280.  * @return  Returns error status. 0 - OK, !0 - error
  1281.  */
  1282. static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
        ^
  1283.                                unsigned int global_gain,
  1284.                                IndividualChannelStream *ics,

libavcodec/aacdec.c:1289:21: Binary operation: ([0, +oo] - 90):unsigned32 by call to `decode_scalefactors` 
  1287. {
  1288.     int g, i, idx = 0;
  1289.     int offset[3] = { global_gain, global_gain - 90, 0 };
                            ^
  1290.     int clipped_offset;
  1291.     int noise_flag = 1;

static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,
                               unsigned int global_gain,
                               IndividualChannelStream *ics,
                               enum BandType band_type[120],
                               int band_type_run_end[120])
{
    int g, i, idx = 0;
    int offset[3] = { global_gain, global_gain - 90, 0 };
    int clipped_offset;
    int noise_flag = 1;
    for (g = 0; g < ics->num_window_groups; g++) {
        for (i = 0; i < ics->max_sfb;) {
            int run_end = band_type_run_end[idx];
            if (band_type[idx] == ZERO_BT) {
                for (; i < run_end; i++, idx++)
                    sf[idx] = 0.0;
            } else if ((band_type[idx] == INTENSITY_BT) ||
                       (band_type[idx] == INTENSITY_BT2)) {
                for (; i < run_end; i++, idx++) {
                    offset[2] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    clipped_offset = av_clip(offset[2], -155, 100);
                    if (offset[2] != clipped_offset) {
                        avpriv_request_sample(ac->avctx,
                                              "If you heard an audible artifact, there may be a bug in the decoder. "
                                              "Clipped intensity stereo position (%d -> %d)",
                                              offset[2], clipped_offset);
                    }
                    sf[idx] = ff_aac_pow2sf_tab[-clipped_offset + POW_SF2_ZERO];
                }
            } else if (band_type[idx] == NOISE_BT) {
                for (; i < run_end; i++, idx++) {
                    if (noise_flag-- > 0)
                        offset[1] += get_bits(gb, 9) - 256;
                    else
                        offset[1] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    clipped_offset = av_clip(offset[1], -100, 155);
                    if (offset[1] != clipped_offset) {
                        avpriv_request_sample(ac->avctx,
                                              "If you heard an audible artifact, there may be a bug in the decoder. "
                                              "Clipped noise gain (%d -> %d)",
                                              offset[1], clipped_offset);
                    }
                    sf[idx] = -ff_aac_pow2sf_tab[clipped_offset + POW_SF2_ZERO];
                }
            } else {
                for (; i < run_end; i++, idx++) {
                    offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    if (offset[0] > 255U) {
                        av_log(ac->avctx, AV_LOG_ERROR,
                               "Scalefactor (%d) out of range.\n", offset[0]);
                        return AVERROR_INVALIDDATA;
                    }
                    sf[idx] = -ff_aac_pow2sf_tab[offset[0] - 100 + POW_SF2_ZERO];
                }
            }
        }
    }
    return 0;
}
['static int decode_ics(AACContext *ac, SingleChannelElement *sce,\n                      GetBitContext *gb, int common_window, int scale_flag)\n{\n    Pulse pulse;\n    TemporalNoiseShaping    *tns = &sce->tns;\n    IndividualChannelStream *ics = &sce->ics;\n    float *out = sce->coeffs;\n    int global_gain, eld_syntax, er_syntax, pulse_present = 0;\n    int ret;\n    eld_syntax = ac->oc[1].m4ac.object_type == AOT_ER_AAC_ELD;\n    er_syntax  = ac->oc[1].m4ac.object_type == AOT_ER_AAC_LC ||\n                 ac->oc[1].m4ac.object_type == AOT_ER_AAC_LTP ||\n                 ac->oc[1].m4ac.object_type == AOT_ER_AAC_LD ||\n                 ac->oc[1].m4ac.object_type == AOT_ER_AAC_ELD;\n    pulse.num_pulse = 0;\n    global_gain = get_bits(gb, 8);\n    if (!common_window && !scale_flag) {\n        if (decode_ics_info(ac, ics, gb) < 0)\n            return AVERROR_INVALIDDATA;\n    }\n    if ((ret = decode_band_types(ac, sce->band_type,\n                                 sce->band_type_run_end, gb, ics)) < 0)\n        return ret;\n    if ((ret = decode_scalefactors(ac, sce->sf, gb, global_gain, ics,\n                                  sce->band_type, sce->band_type_run_end)) < 0)\n        return ret;\n    pulse_present = 0;\n    if (!scale_flag) {\n        if (!eld_syntax && (pulse_present = get_bits1(gb))) {\n            if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {\n                av_log(ac->avctx, AV_LOG_ERROR,\n                       "Pulse tool not allowed in eight short sequence.\\n");\n                return AVERROR_INVALIDDATA;\n            }\n            if (decode_pulses(&pulse, gb, ics->swb_offset, ics->num_swb)) {\n                av_log(ac->avctx, AV_LOG_ERROR,\n                       "Pulse data corrupt or invalid.\\n");\n                return AVERROR_INVALIDDATA;\n            }\n        }\n        tns->present = get_bits1(gb);\n        if (tns->present && !er_syntax)\n            if (decode_tns(ac, tns, gb, ics) < 0)\n                return AVERROR_INVALIDDATA;\n        if (!eld_syntax && get_bits1(gb)) {\n            avpriv_request_sample(ac->avctx, "SSR");\n            return AVERROR_PATCHWELCOME;\n        }\n        if (tns->present && er_syntax)\n            if (decode_tns(ac, tns, gb, ics) < 0)\n                return AVERROR_INVALIDDATA;\n    }\n    if (decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present,\n                                    &pulse, ics, sce->band_type) < 0)\n        return AVERROR_INVALIDDATA;\n    if (ac->oc[1].m4ac.object_type == AOT_AAC_MAIN && !common_window)\n        apply_prediction(ac, sce);\n    return 0;\n}', 'static inline unsigned int get_bits(GetBitContext *s, int n)\n{\n    register int tmp;\n    OPEN_READER(re, s);\n    UPDATE_CACHE(re, s);\n    tmp = SHOW_UBITS(re, s, n);\n    LAST_SKIP_BITS(re, s, n);\n    CLOSE_READER(re, s);\n    return tmp;\n}', 'static int decode_scalefactors(AACContext *ac, float sf[120], GetBitContext *gb,\n                               unsigned int global_gain,\n                               IndividualChannelStream *ics,\n                               enum BandType band_type[120],\n                               int band_type_run_end[120])\n{\n    int g, i, idx = 0;\n    int offset[3] = { global_gain, global_gain - 90, 0 };\n    int clipped_offset;\n    int noise_flag = 1;\n    for (g = 0; g < ics->num_window_groups; g++) {\n        for (i = 0; i < ics->max_sfb;) {\n            int run_end = band_type_run_end[idx];\n            if (band_type[idx] == ZERO_BT) {\n                for (; i < run_end; i++, idx++)\n                    sf[idx] = 0.0;\n            } else if ((band_type[idx] == INTENSITY_BT) ||\n                       (band_type[idx] == INTENSITY_BT2)) {\n                for (; i < run_end; i++, idx++) {\n                    offset[2] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    clipped_offset = av_clip(offset[2], -155, 100);\n                    if (offset[2] != clipped_offset) {\n                        avpriv_request_sample(ac->avctx,\n                                              "If you heard an audible artifact, there may be a bug in the decoder. "\n                                              "Clipped intensity stereo position (%d -> %d)",\n                                              offset[2], clipped_offset);\n                    }\n                    sf[idx] = ff_aac_pow2sf_tab[-clipped_offset + POW_SF2_ZERO];\n                }\n            } else if (band_type[idx] == NOISE_BT) {\n                for (; i < run_end; i++, idx++) {\n                    if (noise_flag-- > 0)\n                        offset[1] += get_bits(gb, 9) - 256;\n                    else\n                        offset[1] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    clipped_offset = av_clip(offset[1], -100, 155);\n                    if (offset[1] != clipped_offset) {\n                        avpriv_request_sample(ac->avctx,\n                                              "If you heard an audible artifact, there may be a bug in the decoder. "\n                                              "Clipped noise gain (%d -> %d)",\n                                              offset[1], clipped_offset);\n                    }\n                    sf[idx] = -ff_aac_pow2sf_tab[clipped_offset + POW_SF2_ZERO];\n                }\n            } else {\n                for (; i < run_end; i++, idx++) {\n                    offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    if (offset[0] > 255U) {\n                        av_log(ac->avctx, AV_LOG_ERROR,\n                               "Scalefactor (%d) out of range.\\n", offset[0]);\n                        return AVERROR_INVALIDDATA;\n                    }\n                    sf[idx] = -ff_aac_pow2sf_tab[offset[0] - 100 + POW_SF2_ZERO];\n                }\n            }\n        }\n    }\n    return 0;\n}']