libavformat/oggparsespeex.c:71: error: Integer Overflow L1
  (7405290916 + 8):signed32.

libavformat/oggparsespeex.c:56:9: <LHS trace>
54.         int frames_per_packet;
55.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
56.         st->codec->codec_id = CODEC_ID_SPEEX;
            ^
57. 
58.         st->codec->sample_rate = AV_RL32(p + 36);

libavformat/oggparsespeex.c:56:9: Assignment
54.         int frames_per_packet;
55.         st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
56.         st->codec->codec_id = CODEC_ID_SPEEX;
            ^
57. 
58.         st->codec->sample_rate = AV_RL32(p + 36);

libavformat/oggparsespeex.c:58:9: Assignment
56.         st->codec->codec_id = CODEC_ID_SPEEX;
57. 
58.         st->codec->sample_rate = AV_RL32(p + 36);
            ^
59.         st->codec->channels = AV_RL32(p + 48);
60. 

libavformat/oggparsespeex.c:59:9: Assignment
57. 
58.         st->codec->sample_rate = AV_RL32(p + 36);
59.         st->codec->channels = AV_RL32(p + 48);
            ^
60. 
61.         /* We treat the whole Speex packet as a single frame everywhere Speex

libavformat/oggparsespeex.c:65:9: Assignment
63.            and joining individual Speex frames, which are not always
64.            byte-aligned. */
65.         st->codec->frame_size = AV_RL32(p + 56);
            ^
66.         frames_per_packet     = AV_RL32(p + 64);
67.         if (frames_per_packet)

libavformat/oggparsespeex.c:68:13: Assignment
66.         frames_per_packet     = AV_RL32(p + 64);
67.         if (frames_per_packet)
68.             st->codec->frame_size *= frames_per_packet;
                ^
69. 
70.         st->codec->extradata_size = os->psize;

libavformat/oggparsespeex.c:70:9: Assignment
68.             st->codec->frame_size *= frames_per_packet;
69. 
70.         st->codec->extradata_size = os->psize;
            ^
71.         st->codec->extradata = av_malloc(st->codec->extradata_size
72.                                          + FF_INPUT_BUFFER_PADDING_SIZE);

libavformat/oggparsespeex.c:71:32: Binary operation: (7405290916 + 8):signed32
69. 
70.         st->codec->extradata_size = os->psize;
71.         st->codec->extradata = av_malloc(st->codec->extradata_size
                                   ^
72.                                          + FF_INPUT_BUFFER_PADDING_SIZE);
73.         memcpy(st->codec->extradata, p, st->codec->extradata_size);

static int speex_header(AVFormatContext *s, int idx) {
    struct ogg *ogg = s->priv_data;
    struct ogg_stream *os = ogg->streams + idx;
    struct speex_params *spxp = os->private;
    AVStream *st = s->streams[idx];
    uint8_t *p = os->buf + os->pstart;
    if (!spxp) {
        spxp = av_mallocz(sizeof(*spxp));
        os->private = spxp;
    }
    if (spxp->seq > 1)
        return 0;
    if (spxp->seq == 0) {
        int frames_per_packet;
        st->codec->codec_type = AVMEDIA_TYPE_AUDIO;
        st->codec->codec_id = CODEC_ID_SPEEX;
        st->codec->sample_rate = AV_RL32(p + 36);
        st->codec->channels = AV_RL32(p + 48);
        st->codec->frame_size = AV_RL32(p + 56);
        frames_per_packet     = AV_RL32(p + 64);
        if (frames_per_packet)
            st->codec->frame_size *= frames_per_packet;
        st->codec->extradata_size = os->psize;
        st->codec->extradata = av_malloc(st->codec->extradata_size
                                         + FF_INPUT_BUFFER_PADDING_SIZE);
        memcpy(st->codec->extradata, p, st->codec->extradata_size);
        st->time_base.num = 1;
        st->time_base.den = st->codec->sample_rate;
    } else
        ff_vorbis_comment(s, &st->metadata, p, os->psize);
    spxp->seq++;
    return 1;
}
['static int speex_header(AVFormatContext *s, int idx) {\n    struct ogg *ogg = s->priv_data;\n    struct ogg_stream *os = ogg->streams + idx;\n    struct speex_params *spxp = os->private;\n    AVStream *st = s->streams[idx];\n    uint8_t *p = os->buf + os->pstart;\n    if (!spxp) {\n        spxp = av_mallocz(sizeof(*spxp));\n        os->private = spxp;\n    }\n    if (spxp->seq > 1)\n        return 0;\n    if (spxp->seq == 0) {\n        int frames_per_packet;\n        st->codec->codec_type = AVMEDIA_TYPE_AUDIO;\n        st->codec->codec_id = CODEC_ID_SPEEX;\n        st->codec->sample_rate = AV_RL32(p + 36);\n        st->codec->channels = AV_RL32(p + 48);\n        st->codec->frame_size = AV_RL32(p + 56);\n        frames_per_packet     = AV_RL32(p + 64);\n        if (frames_per_packet)\n            st->codec->frame_size *= frames_per_packet;\n        st->codec->extradata_size = os->psize;\n        st->codec->extradata = av_malloc(st->codec->extradata_size\n                                         + FF_INPUT_BUFFER_PADDING_SIZE);\n        memcpy(st->codec->extradata, p, st->codec->extradata_size);\n        st->time_base.num = 1;\n        st->time_base.den = st->codec->sample_rate;\n    } else\n        ff_vorbis_comment(s, &st->metadata, p, os->psize);\n    spxp->seq++;\n    return 1;\n}']