libavcodec/8bps.c:131: error: Integer Overflow L2
  ([1, +oo] - 2):unsigned32.

libavcodec/8bps.c:63:1: <LHS trace>
61.  *
62.  */
63. static int decode_frame(AVCodecContext *avctx, void *data,
    ^
64.                         int *data_size, AVPacket *avpkt)
65. {

libavcodec/8bps.c:63:1: Parameter `*avpkt->data`
61.  *
62.  */
63. static int decode_frame(AVCodecContext *avctx, void *data,
    ^
64.                         int *data_size, AVPacket *avpkt)
65. {

libavcodec/8bps.c:111:22: Assignment
109.                 if (dp + 1 >= buf + buf_size)
110.                     return -1;
111.                 if ((count = *dp++) <= 127) {
                          ^
112.                     count++;
113.                     dlen -= count + 1;

libavcodec/8bps.c:112:21: Assignment
110.                     return -1;
111.                 if ((count = *dp++) <= 127) {
112.                     count++;
                         ^
113.                     dlen -= count + 1;
114.                     if (pixptr + count * px_inc > pixptr_end)

libavcodec/8bps.c:113:21: Assignment
111.                 if ((count = *dp++) <= 127) {
112.                     count++;
113.                     dlen -= count + 1;
                         ^
114.                     if (pixptr + count * px_inc > pixptr_end)
115.                         break;

libavcodec/8bps.c:131:21: Binary operation: ([1, +oo] - 2):unsigned32
129.                     }
130.                     dp++;
131.                     dlen -= 2;
                         ^
132.                 }
133.             }

static int decode_frame(AVCodecContext *avctx, void *data,
                        int *data_size, AVPacket *avpkt)
{
    const uint8_t *buf = avpkt->data;
    int buf_size       = avpkt->size;
    EightBpsContext * const c = avctx->priv_data;
    const unsigned char *encoded = buf;
    unsigned char *pixptr, *pixptr_end;
    unsigned int height = avctx->height;
    unsigned int dlen, p, row;
    const unsigned char *lp, *dp;
    unsigned char count;
    unsigned int px_inc;
    unsigned int planes     = c->planes;
    unsigned char *planemap = c->planemap;
    if (c->pic.data[0])
        avctx->release_buffer(avctx, &c->pic);
    c->pic.reference    = 0;
    c->pic.buffer_hints = FF_BUFFER_HINTS_VALID;
    if (avctx->get_buffer(avctx, &c->pic) < 0){
        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
        return -1;
    }
    dp = encoded + planes * (height << 1);
    if (planes == 4)
        planes--;
    px_inc = planes + (avctx->pix_fmt == PIX_FMT_RGB32);
    for (p = 0; p < planes; p++) {
        lp = encoded + p * (height << 1);
        for (row = 0; row < height; row++) {
            pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p];
            pixptr_end = pixptr + c->pic.linesize[0];
            dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2));
            while (dlen > 0) {
                if (dp + 1 >= buf + buf_size)
                    return -1;
                if ((count = *dp++) <= 127) {
                    count++;
                    dlen -= count + 1;
                    if (pixptr + count * px_inc > pixptr_end)
                        break;
                    if (dp + count > buf + buf_size)
                        return -1;
                    while (count--) {
                        *pixptr = *dp++;
                        pixptr += px_inc;
                    }
                } else {
                    count = 257 - count;
                    if (pixptr + count * px_inc > pixptr_end)
                        break;
                    while (count--) {
                        *pixptr = *dp;
                        pixptr += px_inc;
                    }
                    dp++;
                    dlen -= 2;
                }
            }
        }
    }
    if (avctx->bits_per_coded_sample <= 8) {
        const uint8_t *pal = av_packet_get_side_data(avpkt,
                                                     AV_PKT_DATA_PALETTE,
                                                     NULL);
        if (pal) {
            c->pic.palette_has_changed = 1;
            memcpy(c->pal, pal, AVPALETTE_SIZE);
        }
        memcpy (c->pic.data[1], c->pal, AVPALETTE_SIZE);
    }
    *data_size = sizeof(AVFrame);
    *(AVFrame*)data = c->pic;
    return buf_size;
}
['static int decode_frame(AVCodecContext *avctx, void *data,\n                        int *data_size, AVPacket *avpkt)\n{\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    EightBpsContext * const c = avctx->priv_data;\n    const unsigned char *encoded = buf;\n    unsigned char *pixptr, *pixptr_end;\n    unsigned int height = avctx->height;\n    unsigned int dlen, p, row;\n    const unsigned char *lp, *dp;\n    unsigned char count;\n    unsigned int px_inc;\n    unsigned int planes     = c->planes;\n    unsigned char *planemap = c->planemap;\n    if (c->pic.data[0])\n        avctx->release_buffer(avctx, &c->pic);\n    c->pic.reference    = 0;\n    c->pic.buffer_hints = FF_BUFFER_HINTS_VALID;\n    if (avctx->get_buffer(avctx, &c->pic) < 0){\n        av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\\n");\n        return -1;\n    }\n    dp = encoded + planes * (height << 1);\n    if (planes == 4)\n        planes--;\n    px_inc = planes + (avctx->pix_fmt == PIX_FMT_RGB32);\n    for (p = 0; p < planes; p++) {\n        lp = encoded + p * (height << 1);\n        for (row = 0; row < height; row++) {\n            pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p];\n            pixptr_end = pixptr + c->pic.linesize[0];\n            dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2));\n            while (dlen > 0) {\n                if (dp + 1 >= buf + buf_size)\n                    return -1;\n                if ((count = *dp++) <= 127) {\n                    count++;\n                    dlen -= count + 1;\n                    if (pixptr + count * px_inc > pixptr_end)\n                        break;\n                    if (dp + count > buf + buf_size)\n                        return -1;\n                    while (count--) {\n                        *pixptr = *dp++;\n                        pixptr += px_inc;\n                    }\n                } else {\n                    count = 257 - count;\n                    if (pixptr + count * px_inc > pixptr_end)\n                        break;\n                    while (count--) {\n                        *pixptr = *dp;\n                        pixptr += px_inc;\n                    }\n                    dp++;\n                    dlen -= 2;\n                }\n            }\n        }\n    }\n    if (avctx->bits_per_coded_sample <= 8) {\n        const uint8_t *pal = av_packet_get_side_data(avpkt,\n                                                     AV_PKT_DATA_PALETTE,\n                                                     NULL);\n        if (pal) {\n            c->pic.palette_has_changed = 1;\n            memcpy(c->pal, pal, AVPALETTE_SIZE);\n        }\n        memcpy (c->pic.data[1], c->pal, AVPALETTE_SIZE);\n    }\n    *data_size = sizeof(AVFrame);\n    *(AVFrame*)data = c->pic;\n    return buf_size;\n}']