libavcodec/aac.c:1034: error: Integer Overflow L2
  ([0, +oo] - 90):unsigned32 by call to `decode_scalefactors`.

libavcodec/aac.c:1025:19: Call
1023.     pulse.num_pulse = 0;
1024. 
1025.     global_gain = get_bits(gb, 8);
                        ^
1026. 
1027.     if (!common_window && !scale_flag) {

libavcodec/get_bits.h:388:5: Call
  386.     register int tmp;
  387.     OPEN_READER(re, s)
  388.     UPDATE_CACHE(re, s)
           ^
  389.     tmp= SHOW_UBITS(re, s, n);
  390.     LAST_SKIP_BITS(re, s, n)

libavutil/bswap.h:52:1: Parameter `x`
    50. 
    51. #ifndef bswap_32
    52. static av_always_inline av_const uint32_t bswap_32(uint32_t x)
        ^
    53. {
    54.     x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);

libavutil/bswap.h:54:5: Assignment
    52. static av_always_inline av_const uint32_t bswap_32(uint32_t x)
    53. {
    54.     x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);
            ^
    55.     x= (x>>16) | (x<<16);
    56.     return x;

libavutil/bswap.h:55:5: Assignment
    53. {
    54.     x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);
    55.     x= (x>>16) | (x<<16);
            ^
    56.     return x;
    57. }

libavutil/bswap.h:56:5: Assignment
    54.     x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);
    55.     x= (x>>16) | (x<<16);
    56.     return x;
            ^
    57. }
    58. #endif

libavcodec/get_bits.h:388:5: Assignment
  386.     register int tmp;
  387.     OPEN_READER(re, s)
  388.     UPDATE_CACHE(re, s)
           ^
  389.     tmp= SHOW_UBITS(re, s, n);
  390.     LAST_SKIP_BITS(re, s, n)

libavcodec/get_bits.h:389:5: Assignment
  387.     OPEN_READER(re, s)
  388.     UPDATE_CACHE(re, s)
  389.     tmp= SHOW_UBITS(re, s, n);
           ^
  390.     LAST_SKIP_BITS(re, s, n)
  391.     CLOSE_READER(re, s)

libavcodec/get_bits.h:392:5: Assignment
  390.     LAST_SKIP_BITS(re, s, n)
  391.     CLOSE_READER(re, s)
  392.     return tmp;
           ^
  393. }
  394. 

libavcodec/aac.c:1025:5: Assignment
1023.     pulse.num_pulse = 0;
1024. 
1025.     global_gain = get_bits(gb, 8);
          ^
1026. 
1027.     if (!common_window && !scale_flag) {

libavcodec/aac.c:1034:9: Call
1032.     if (decode_band_types(ac, sce->band_type, sce->band_type_run_end, gb, ics) < 0)
1033.         return -1;
1034.     if (decode_scalefactors(ac, sce->sf, gb, global_gain, ics, sce->band_type, sce->band_type_run_end) < 0)
              ^
1035.         return -1;
1036. 

libavcodec/aac.c:668:1: <LHS trace>
666.  * @return  Returns error status. 0 - OK, !0 - error
667.  */
668. static int decode_scalefactors(AACContext * ac, float sf[120], GetBitContext * gb,
     ^
669.         unsigned int global_gain, IndividualChannelStream * ics,
670.         enum BandType band_type[120], int band_type_run_end[120]) {

libavcodec/aac.c:668:1: Parameter `global_gain`
  666.  * @return  Returns error status. 0 - OK, !0 - error
  667.  */
  668. static int decode_scalefactors(AACContext * ac, float sf[120], GetBitContext * gb,
       ^
  669.         unsigned int global_gain, IndividualChannelStream * ics,
  670.         enum BandType band_type[120], int band_type_run_end[120]) {

libavcodec/aac.c:673:21: Binary operation: ([0, +oo] - 90):unsigned32 by call to `decode_scalefactors` 
  671.     const int sf_offset = ac->sf_offset + (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE ? 12 : 0);
  672.     int g, i, idx = 0;
  673.     int offset[3] = { global_gain, global_gain - 90, 100 };
                           ^
  674.     int noise_flag = 1;
  675.     static const char *sf_str[3] = { "Global gain", "Noise gain", "Intensity stereo position" };

static int decode_scalefactors(AACContext * ac, float sf[120], GetBitContext * gb,
        unsigned int global_gain, IndividualChannelStream * ics,
        enum BandType band_type[120], int band_type_run_end[120]) {
    const int sf_offset = ac->sf_offset + (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE ? 12 : 0);
    int g, i, idx = 0;
    int offset[3] = { global_gain, global_gain - 90, 100 };
    int noise_flag = 1;
    static const char *sf_str[3] = { "Global gain", "Noise gain", "Intensity stereo position" };
    for (g = 0; g < ics->num_window_groups; g++) {
        for (i = 0; i < ics->max_sfb;) {
            int run_end = band_type_run_end[idx];
            if (band_type[idx] == ZERO_BT) {
                for(; i < run_end; i++, idx++)
                    sf[idx] = 0.;
            }else if((band_type[idx] == INTENSITY_BT) || (band_type[idx] == INTENSITY_BT2)) {
                for(; i < run_end; i++, idx++) {
                    offset[2] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    if(offset[2] > 255U) {
                        av_log(ac->avccontext, AV_LOG_ERROR,
                            "%s (%d) out of range.\n", sf_str[2], offset[2]);
                        return -1;
                    }
                    sf[idx]  = ff_aac_pow2sf_tab[-offset[2] + 300];
                }
            }else if(band_type[idx] == NOISE_BT) {
                for(; i < run_end; i++, idx++) {
                    if(noise_flag-- > 0)
                        offset[1] += get_bits(gb, 9) - 256;
                    else
                        offset[1] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    if(offset[1] > 255U) {
                        av_log(ac->avccontext, AV_LOG_ERROR,
                            "%s (%d) out of range.\n", sf_str[1], offset[1]);
                        return -1;
                    }
                    sf[idx]  = -ff_aac_pow2sf_tab[ offset[1] + sf_offset + 100];
                }
            }else {
                for(; i < run_end; i++, idx++) {
                    offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;
                    if(offset[0] > 255U) {
                        av_log(ac->avccontext, AV_LOG_ERROR,
                            "%s (%d) out of range.\n", sf_str[0], offset[0]);
                        return -1;
                    }
                    sf[idx] = -ff_aac_pow2sf_tab[ offset[0] + sf_offset];
                }
            }
        }
    }
    return 0;
}
['static int decode_ics(AACContext * ac, SingleChannelElement * sce, GetBitContext * gb, int common_window, int scale_flag) {\n    Pulse pulse;\n    TemporalNoiseShaping * tns = &sce->tns;\n    IndividualChannelStream * ics = &sce->ics;\n    float * out = sce->coeffs;\n    int global_gain, pulse_present = 0;\n    pulse.num_pulse = 0;\n    global_gain = get_bits(gb, 8);\n    if (!common_window && !scale_flag) {\n        if (decode_ics_info(ac, ics, gb, 0) < 0)\n            return -1;\n    }\n    if (decode_band_types(ac, sce->band_type, sce->band_type_run_end, gb, ics) < 0)\n        return -1;\n    if (decode_scalefactors(ac, sce->sf, gb, global_gain, ics, sce->band_type, sce->band_type_run_end) < 0)\n        return -1;\n    pulse_present = 0;\n    if (!scale_flag) {\n        if ((pulse_present = get_bits1(gb))) {\n            if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) {\n                av_log(ac->avccontext, AV_LOG_ERROR, "Pulse tool not allowed in eight short sequence.\\n");\n                return -1;\n            }\n            if (decode_pulses(&pulse, gb, ics->swb_offset, ics->num_swb)) {\n                av_log(ac->avccontext, AV_LOG_ERROR, "Pulse data corrupt or invalid.\\n");\n                return -1;\n            }\n        }\n        if ((tns->present = get_bits1(gb)) && decode_tns(ac, tns, gb, ics))\n            return -1;\n        if (get_bits1(gb)) {\n            ff_log_missing_feature(ac->avccontext, "SSR", 1);\n            return -1;\n        }\n    }\n    if (decode_spectrum_and_dequant(ac, out, gb, sce->sf, pulse_present, &pulse, ics, sce->band_type) < 0)\n        return -1;\n    if(ac->m4ac.object_type == AOT_AAC_MAIN && !common_window)\n        apply_prediction(ac, sce);\n    return 0;\n}', 'static inline unsigned int get_bits(GetBitContext *s, int n){\n    register int tmp;\n    OPEN_READER(re, s)\n    UPDATE_CACHE(re, s)\n    tmp= SHOW_UBITS(re, s, n);\n    LAST_SKIP_BITS(re, s, n)\n    CLOSE_READER(re, s)\n    return tmp;\n}', 'static av_always_inline av_const uint32_t bswap_32(uint32_t x)\n{\n    x= ((x<<8)&0xFF00FF00) | ((x>>8)&0x00FF00FF);\n    x= (x>>16) | (x<<16);\n    return x;\n}', 'static int decode_scalefactors(AACContext * ac, float sf[120], GetBitContext * gb,\n        unsigned int global_gain, IndividualChannelStream * ics,\n        enum BandType band_type[120], int band_type_run_end[120]) {\n    const int sf_offset = ac->sf_offset + (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE ? 12 : 0);\n    int g, i, idx = 0;\n    int offset[3] = { global_gain, global_gain - 90, 100 };\n    int noise_flag = 1;\n    static const char *sf_str[3] = { "Global gain", "Noise gain", "Intensity stereo position" };\n    for (g = 0; g < ics->num_window_groups; g++) {\n        for (i = 0; i < ics->max_sfb;) {\n            int run_end = band_type_run_end[idx];\n            if (band_type[idx] == ZERO_BT) {\n                for(; i < run_end; i++, idx++)\n                    sf[idx] = 0.;\n            }else if((band_type[idx] == INTENSITY_BT) || (band_type[idx] == INTENSITY_BT2)) {\n                for(; i < run_end; i++, idx++) {\n                    offset[2] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    if(offset[2] > 255U) {\n                        av_log(ac->avccontext, AV_LOG_ERROR,\n                            "%s (%d) out of range.\\n", sf_str[2], offset[2]);\n                        return -1;\n                    }\n                    sf[idx]  = ff_aac_pow2sf_tab[-offset[2] + 300];\n                }\n            }else if(band_type[idx] == NOISE_BT) {\n                for(; i < run_end; i++, idx++) {\n                    if(noise_flag-- > 0)\n                        offset[1] += get_bits(gb, 9) - 256;\n                    else\n                        offset[1] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    if(offset[1] > 255U) {\n                        av_log(ac->avccontext, AV_LOG_ERROR,\n                            "%s (%d) out of range.\\n", sf_str[1], offset[1]);\n                        return -1;\n                    }\n                    sf[idx]  = -ff_aac_pow2sf_tab[ offset[1] + sf_offset + 100];\n                }\n            }else {\n                for(; i < run_end; i++, idx++) {\n                    offset[0] += get_vlc2(gb, vlc_scalefactors.table, 7, 3) - 60;\n                    if(offset[0] > 255U) {\n                        av_log(ac->avccontext, AV_LOG_ERROR,\n                            "%s (%d) out of range.\\n", sf_str[0], offset[0]);\n                        return -1;\n                    }\n                    sf[idx] = -ff_aac_pow2sf_tab[ offset[0] + sf_offset];\n                }\n            }\n        }\n    }\n    return 0;\n}']