libavcodec/cavsdec.c:1165: error: Integer Overflow L2
  (16 - [0, 64]):unsigned32 by call to `decode_pic`.

libavcodec/cavsdec.c:1163:13: Call
1161.             if (!h->got_keyframe)
1162.                 break;
1163.             bitstream_init(&h->bc, buf_ptr, input_size);
                  ^
1164.             h->stc = stc;
1165.             if (decode_pic(h))

libavcodec/bitstream.h:84:9: Assignment
  82.         bc->buffer    =
  83.         bc->ptr       = NULL;
  84.         bc->bits_left = 0;
              ^
  85.         return AVERROR_INVALIDDATA;
  86.     }

libavcodec/cavsdec.c:1165:17: Call
1163.             bitstream_init(&h->bc, buf_ptr, input_size);
1164.             h->stc = stc;
1165.             if (decode_pic(h))
                      ^
1166.                 break;
1167.             *got_frame = 1;

libavcodec/cavsdec.c:928:1: Parameter `h->bc.bits_left`
  926.  ****************************************************************************/
  927. 
  928. static int decode_pic(AVSContext *h)
       ^
  929. {
  930.     int ret;

libavcodec/cavsdec.c:941:5: Call
  939.     av_frame_unref(h->cur.f);
  940. 
  941.     bitstream_skip(&h->bc, 16); // bbv_dwlay
           ^
  942.     if (h->stc == PIC_PB_START_CODE) {
  943.         h->cur.f->pict_type = bitstream_read(&h->bc, 2) + AV_PICTURE_TYPE_I;

libavcodec/bitstream.h:240:1: <LHS trace>
238. 
239. /* Skip n bits in the buffer. */
240. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
     ^
241. {
242.     if (n < bc->bits_left)

libavcodec/bitstream.h:240:1: Parameter `n`
    238. 
    239. /* Skip n bits in the buffer. */
    240. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
         ^
    241. {
    242.     if (n < bc->bits_left)

libavcodec/bitstream.h:240:1: <RHS trace>
238. 
239. /* Skip n bits in the buffer. */
240. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
     ^
241. {
242.     if (n < bc->bits_left)

libavcodec/bitstream.h:240:1: Parameter `n`
    238. 
    239. /* Skip n bits in the buffer. */
    240. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
         ^
    241. {
    242.     if (n < bc->bits_left)

libavcodec/bitstream.h:245:9: Binary operation: (16 - [0, 64]):unsigned32 by call to `decode_pic` 
    243.         skip_remaining(bc, n);
    244.     else {
    245.         n -= bc->bits_left;
                 ^
    246.         bc->bits      = 0;
    247.         bc->bits_left = 0;

static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
{
    if (n < bc->bits_left)
        skip_remaining(bc, n);
    else {
        n -= bc->bits_left;
        bc->bits      = 0;
        bc->bits_left = 0;
        if (n >= 64) {
            unsigned skip = n / 8;
            n -= skip * 8;
            bc->ptr += skip;
        }
        refill_64(bc);
        if (n)
            skip_remaining(bc, n);
    }
}
['static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,\n                             AVPacket *avpkt)\n{\n    AVSContext *h      = avctx->priv_data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    uint32_t stc       = -1;\n    int input_size, ret;\n    const uint8_t *buf_end;\n    const uint8_t *buf_ptr;\n    if (buf_size == 0) {\n        if (!h->low_delay && h->DPB[0].f->data[0]) {\n            *got_frame = 1;\n            av_frame_move_ref(data, h->DPB[0].f);\n        }\n        return 0;\n    }\n    buf_ptr = buf;\n    buf_end = buf + buf_size;\n    for(;;) {\n        buf_ptr = avpriv_find_start_code(buf_ptr, buf_end, &stc);\n        if ((stc & 0xFFFFFE00) || buf_ptr == buf_end)\n            return FFMAX(0, buf_ptr - buf);\n        input_size = (buf_end - buf_ptr) * 8;\n        switch (stc) {\n        case CAVS_START_CODE:\n            bitstream_init(&h->bc, buf_ptr, input_size);\n            decode_seq_header(h);\n            break;\n        case PIC_I_START_CODE:\n            if (!h->got_keyframe) {\n                av_frame_unref(h->DPB[0].f);\n                av_frame_unref(h->DPB[1].f);\n                h->got_keyframe = 1;\n            }\n        case PIC_PB_START_CODE:\n            *got_frame = 0;\n            if (!h->got_keyframe)\n                break;\n            bitstream_init(&h->bc, buf_ptr, input_size);\n            h->stc = stc;\n            if (decode_pic(h))\n                break;\n            *got_frame = 1;\n            if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {\n                if (h->DPB[1].f->data[0]) {\n                    if ((ret = av_frame_ref(data, h->DPB[1].f)) < 0)\n                        return ret;\n                } else {\n                    *got_frame = 0;\n                }\n            } else {\n                av_frame_move_ref(data, h->cur.f);\n            }\n            break;\n        case EXT_START_CODE:\n            break;\n        case USER_START_CODE:\n            break;\n        default:\n            if (stc <= SLICE_MAX_START_CODE) {\n                bitstream_init(&h->bc, buf_ptr, input_size);\n                decode_slice_header(h, &h->bc);\n            }\n            break;\n        }\n    }\n}', 'static inline int bitstream_init(BitstreamContext *bc, const uint8_t *buffer,\n                                 unsigned bit_size)\n{\n    unsigned buffer_size;\n    if (bit_size > INT_MAX - 7 || !buffer) {\n        buffer        =\n        bc->buffer    =\n        bc->ptr       = NULL;\n        bc->bits_left = 0;\n        return AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    bc->buffer       = buffer;\n    bc->buffer_end   = buffer + buffer_size;\n    bc->ptr          = bc->buffer;\n    bc->size_in_bits = bit_size;\n    bc->bits_left    = 0;\n    bc->bits         = 0;\n    refill_64(bc);\n    return 0;\n}', 'static int decode_pic(AVSContext *h)\n{\n    int ret;\n    int skip_count    = -1;\n    enum cavs_mb mb_type;\n    if (!h->top_qp) {\n        av_log(h->avctx, AV_LOG_ERROR, "No sequence header decoded yet\\n");\n        return AVERROR_INVALIDDATA;\n    }\n    av_frame_unref(h->cur.f);\n    bitstream_skip(&h->bc, 16);\n    if (h->stc == PIC_PB_START_CODE) {\n        h->cur.f->pict_type = bitstream_read(&h->bc, 2) + AV_PICTURE_TYPE_I;\n        if (h->cur.f->pict_type > AV_PICTURE_TYPE_B) {\n            av_log(h->avctx, AV_LOG_ERROR, "illegal picture type\\n");\n            return AVERROR_INVALIDDATA;\n        }\n        if (!h->DPB[0].f->data[0] ||\n           (!h->DPB[1].f->data[0] && h->cur.f->pict_type == AV_PICTURE_TYPE_B))\n            return AVERROR_INVALIDDATA;\n    } else {\n        h->cur.f->pict_type = AV_PICTURE_TYPE_I;\n        if (bitstream_read_bit(&h->bc))\n            bitstream_skip(&h->bc, 24);\n        if (h->low_delay || !(bitstream_peek(&h->bc, 9) & 1))\n            h->stream_revision = 1;\n        else if (bitstream_peek(&h->bc, 11) & 3)\n            h->stream_revision = 1;\n        if (h->stream_revision > 0)\n            bitstream_skip(&h->bc, 1);\n    }\n    ret = ff_get_buffer(h->avctx, h->cur.f, h->cur.f->pict_type == AV_PICTURE_TYPE_B ?\n                        0 : AV_GET_BUFFER_FLAG_REF);\n    if (ret < 0)\n        return ret;\n    if (!h->edge_emu_buffer) {\n        int alloc_size = FFALIGN(FFABS(h->cur.f->linesize[0]) + 32, 32);\n        h->edge_emu_buffer = av_mallocz(alloc_size * 2 * 24);\n        if (!h->edge_emu_buffer)\n            return AVERROR(ENOMEM);\n    }\n    ff_cavs_init_pic(h);\n    h->cur.poc = bitstream_read(&h->bc, 8) * 2;\n    if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {\n        h->dist[0] = (h->cur.poc - h->DPB[0].poc  + 512) % 512;\n    } else {\n        h->dist[0] = (h->DPB[0].poc  - h->cur.poc + 512) % 512;\n    }\n    h->dist[1] = (h->cur.poc - h->DPB[1].poc  + 512) % 512;\n    h->scale_den[0] = h->dist[0] ? 512/h->dist[0] : 0;\n    h->scale_den[1] = h->dist[1] ? 512/h->dist[1] : 0;\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_B) {\n        h->sym_factor = h->dist[0] * h->scale_den[1];\n    } else {\n        h->direct_den[0] = h->dist[0] ? 16384 / h->dist[0] : 0;\n        h->direct_den[1] = h->dist[1] ? 16384 / h->dist[1] : 0;\n    }\n    if (h->low_delay)\n        get_ue_golomb(&h->bc);\n    h->progressive   = bitstream_read_bit(&h->bc);\n    h->pic_structure = 1;\n    if (!h->progressive)\n        h->pic_structure = bitstream_read_bit(&h->bc);\n    if (!h->pic_structure && h->stc == PIC_PB_START_CODE)\n        bitstream_skip(&h->bc, 1);\n    bitstream_skip(&h->bc, 1);\n    bitstream_skip(&h->bc, 1);\n    h->qp_fixed = bitstream_read_bit(&h->bc);\n    h->qp       = bitstream_read(&h->bc, 6);\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {\n        if (!h->progressive && !h->pic_structure)\n            bitstream_skip(&h->bc, 1);\n        bitstream_skip(&h->bc, 4);\n    } else {\n        if (!(h->cur.f->pict_type == AV_PICTURE_TYPE_B && h->pic_structure == 1))\n            h->ref_flag        = bitstream_read_bit(&h->bc);\n        bitstream_skip(&h->bc, 4);\n        h->skip_mode_flag      = bitstream_read_bit(&h->bc);\n    }\n    h->loop_filter_disable     = bitstream_read_bit(&h->bc);\n    if (!h->loop_filter_disable && bitstream_read_bit(&h->bc)) {\n        h->alpha_offset        = get_se_golomb(&h->bc);\n        h->beta_offset         = get_se_golomb(&h->bc);\n    } else {\n        h->alpha_offset = h->beta_offset  = 0;\n    }\n    if (h->cur.f->pict_type == AV_PICTURE_TYPE_I) {\n        do {\n            check_for_slice(h);\n            decode_mb_i(h, 0);\n        } while (ff_cavs_next_mb(h));\n    } else if (h->cur.f->pict_type == AV_PICTURE_TYPE_P) {\n        do {\n            if (check_for_slice(h))\n                skip_count = -1;\n            if (h->skip_mode_flag && (skip_count < 0))\n                skip_count = get_ue_golomb(&h->bc);\n            if (h->skip_mode_flag && skip_count--) {\n                decode_mb_p(h, P_SKIP);\n            } else {\n                mb_type = get_ue_golomb(&h->bc) + P_SKIP + h->skip_mode_flag;\n                if (mb_type > P_8X8)\n                    decode_mb_i(h, mb_type - P_8X8 - 1);\n                else\n                    decode_mb_p(h, mb_type);\n            }\n        } while (ff_cavs_next_mb(h));\n    } else {\n        do {\n            if (check_for_slice(h))\n                skip_count = -1;\n            if (h->skip_mode_flag && (skip_count < 0))\n                skip_count = get_ue_golomb(&h->bc);\n            if (h->skip_mode_flag && skip_count--) {\n                decode_mb_b(h, B_SKIP);\n            } else {\n                mb_type = get_ue_golomb(&h->bc) + B_SKIP + h->skip_mode_flag;\n                if (mb_type > B_8X8)\n                    decode_mb_i(h, mb_type - B_8X8 - 1);\n                else\n                    decode_mb_b(h, mb_type);\n            }\n        } while (ff_cavs_next_mb(h));\n    }\n    if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {\n        av_frame_unref(h->DPB[1].f);\n        FFSWAP(AVSFrame, h->cur, h->DPB[1]);\n        FFSWAP(AVSFrame, h->DPB[0], h->DPB[1]);\n    }\n    return 0;\n}', 'static inline void bitstream_skip(BitstreamContext *bc, unsigned n)\n{\n    if (n < bc->bits_left)\n        skip_remaining(bc, n);\n    else {\n        n -= bc->bits_left;\n        bc->bits      = 0;\n        bc->bits_left = 0;\n        if (n >= 64) {\n            unsigned skip = n / 8;\n            n -= skip * 8;\n            bc->ptr += skip;\n        }\n        refill_64(bc);\n        if (n)\n            skip_remaining(bc, n);\n    }\n}']