libavformat/asfdec.c:285: error: Integer Overflow L2
  (2 × [`len`, min(2147483646, `len`)]):signed32.

libavformat/asfdec.c:277:1: <RHS trace>
275. }
276. 
277. static void get_tag(AVFormatContext *s, const char *key, int type, int len)
     ^
278. {
279.     char *value;

libavformat/asfdec.c:277:1: Parameter `len`
275. }
276. 
277. static void get_tag(AVFormatContext *s, const char *key, int type, int len)
     ^
278. {
279.     char *value;

libavformat/asfdec.c:285:13: Binary operation: (2 × [len, min(2147483646, len)]):signed32
283.         return;
284. 
285.     value = av_malloc(2 * len + 1);
                 ^
286.     if (!value)
287.         goto finish;

static void get_tag(AVFormatContext *s, const char *key, int type, int len)
{
    char *value;
    int64_t off = avio_tell(s->pb);
    if ((unsigned)len >= (UINT_MAX - 1) / 2)
        return;
    value = av_malloc(2 * len + 1);
    if (!value)
        goto finish;
    if (type == 0) {
        avio_get_str16le(s->pb, len, value, 2 * len + 1);
    } else if (type > 1 && type <= 5) {
        uint64_t num = get_value(s->pb, type);
        snprintf(value, len, "%"PRIu64, num);
    } else if (type == 1 && !strcmp(key, "WM/Picture")) {
        asf_read_picture(s, len);
        goto finish;
    } else {
        av_log(s, AV_LOG_DEBUG,
               "Unsupported value type %d in tag %s.\n", type, key);
        goto finish;
    }
    if (*value)
        av_dict_set(&s->metadata, key, value, 0);
finish:
    av_freep(&value);
    avio_seek(s->pb, off + len, SEEK_SET);
}
['static void get_tag(AVFormatContext *s, const char *key, int type, int len)\n{\n    char *value;\n    int64_t off = avio_tell(s->pb);\n    if ((unsigned)len >= (UINT_MAX - 1) / 2)\n        return;\n    value = av_malloc(2 * len + 1);\n    if (!value)\n        goto finish;\n    if (type == 0) {\n        avio_get_str16le(s->pb, len, value, 2 * len + 1);\n    } else if (type > 1 && type <= 5) {\n        uint64_t num = get_value(s->pb, type);\n        snprintf(value, len, "%"PRIu64, num);\n    } else if (type == 1 && !strcmp(key, "WM/Picture")) {\n        asf_read_picture(s, len);\n        goto finish;\n    } else {\n        av_log(s, AV_LOG_DEBUG,\n               "Unsupported value type %d in tag %s.\\n", type, key);\n        goto finish;\n    }\n    if (*value)\n        av_dict_set(&s->metadata, key, value, 0);\nfinish:\n    av_freep(&value);\n    avio_seek(s->pb, off + len, SEEK_SET);\n}']