libavcodec/cllc.c:425: error: Integer Overflow L2
  ([0, +oo] - 16):unsigned32 by call to `decode_rgb24_frame`.

libavcodec/cllc.c:385:5: Call
383.                           data_size / 2);
384. 
385.     bitstream_init8(&bc, ctx->swapped_buf, data_size);
         ^
386. 
387.     /*

libavcodec/bitstream.h:103:1: Parameter `bc->bits_left`
  101. 
  102. /* Initialize BitstreamContext with buffer size in bytes instead of bits. */
  103. static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,
       ^
  104.                                   unsigned byte_size)
  105. {

libavcodec/cllc.c:425:15: Call
423.         }
424. 
425.         ret = decode_rgb24_frame(ctx, &bc, pic);
                   ^
426.         if (ret < 0)
427.             return ret;

libavcodec/cllc.c:240:1: Parameter `bc->bits_left`
  238. }
  239. 
  240. static int decode_rgb24_frame(CLLCContext *ctx, BitstreamContext *bc, AVFrame *pic)
       ^
  241. {
  242.     AVCodecContext *avctx = ctx->avctx;

libavcodec/cllc.c:255:5: Call
  253.     dst = pic->data[0];
  254. 
  255.     bitstream_skip(bc, 16);
           ^
  256. 
  257.     /* Read in code table for each plane */

libavcodec/bitstream.h:240:1: Parameter `n`
    238. 
    239. /* Skip n bits in the buffer. */
    240. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
         ^
    241. {
    242.     if (n < bc->bits_left)

libavcodec/bitstream.h:243:9: Call
    241. {
    242.     if (n < bc->bits_left)
    243.         skip_remaining(bc, n);
                 ^
    244.     else {
    245.         n -= bc->bits_left;

libavcodec/bitstream.h:229:1: <LHS trace>
227. }
228. 
229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
230. {
231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: Parameter `bc->bits_left`
      227. }
      228. 
      229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
           ^
      230. {
      231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: <RHS trace>
227. }
228. 
229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
230. {
231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:229:1: Parameter `n`
      227. }
      228. 
      229. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
           ^
      230. {
      231. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:236:5: Binary operation: ([0, +oo] - 16):unsigned32 by call to `decode_rgb24_frame` 
      234.     bc->bits <<= n;
      235. #endif
      236.     bc->bits_left -= n;
               ^
      237. }
      238. 

static inline void skip_remaining(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    bc->bits >>= n;
#else
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
}
['static int cllc_decode_frame(AVCodecContext *avctx, void *data,\n                             int *got_picture_ptr, AVPacket *avpkt)\n{\n    CLLCContext *ctx = avctx->priv_data;\n    AVFrame *pic = data;\n    uint8_t *src = avpkt->data;\n    uint32_t info_tag, info_offset;\n    int data_size;\n    BitstreamContext bc;\n    int coding_type, ret;\n    if (avpkt->size < 4 + 4) {\n        av_log(avctx, AV_LOG_ERROR, "Frame is too small %d.\\n", avpkt->size);\n        return AVERROR_INVALIDDATA;\n    }\n    info_offset = 0;\n    info_tag    = AV_RL32(src);\n    if (info_tag == MKTAG(\'I\', \'N\', \'F\', \'O\')) {\n        info_offset = AV_RL32(src + 4);\n        if (info_offset > UINT32_MAX - 8 || info_offset + 8 > avpkt->size) {\n            av_log(avctx, AV_LOG_ERROR,\n                   "Invalid INFO header offset: 0x%08"PRIX32" is too large.\\n",\n                   info_offset);\n            return AVERROR_INVALIDDATA;\n        }\n        ff_canopus_parse_info_tag(avctx, src + 8, info_offset);\n        info_offset += 8;\n        src         += info_offset;\n    }\n    data_size = (avpkt->size - info_offset) & ~1;\n    av_fast_padded_malloc(&ctx->swapped_buf,\n                          &ctx->swapped_buf_size, data_size);\n    if (!ctx->swapped_buf) {\n        av_log(avctx, AV_LOG_ERROR, "Could not allocate swapped buffer.\\n");\n        return AVERROR(ENOMEM);\n    }\n    ctx->bdsp.bswap16_buf((uint16_t *) ctx->swapped_buf, (uint16_t *) src,\n                          data_size / 2);\n    bitstream_init8(&bc, ctx->swapped_buf, data_size);\n    coding_type = (AV_RL32(src) >> 8) & 0xFF;\n    av_log(avctx, AV_LOG_DEBUG, "Frame coding type: %d\\n", coding_type);\n    switch (coding_type) {\n    case 0:\n        avctx->pix_fmt             = AV_PIX_FMT_YUV422P;\n        avctx->bits_per_raw_sample = 8;\n        ret = ff_get_buffer(avctx, pic, 0);\n        if (ret < 0) {\n            av_log(avctx, AV_LOG_ERROR, "Could not allocate buffer.\\n");\n            return ret;\n        }\n        ret = decode_yuv_frame(ctx, &bc, pic);\n        if (ret < 0)\n            return ret;\n        break;\n    case 1:\n    case 2:\n        avctx->pix_fmt             = AV_PIX_FMT_RGB24;\n        avctx->bits_per_raw_sample = 8;\n        ret = ff_get_buffer(avctx, pic, 0);\n        if (ret < 0) {\n            av_log(avctx, AV_LOG_ERROR, "Could not allocate buffer.\\n");\n            return ret;\n        }\n        ret = decode_rgb24_frame(ctx, &bc, pic);\n        if (ret < 0)\n            return ret;\n        break;\n    case 3:\n        avctx->pix_fmt             = AV_PIX_FMT_ARGB;\n        avctx->bits_per_raw_sample = 8;\n        ret = ff_get_buffer(avctx, pic, 0);\n        if (ret < 0) {\n            av_log(avctx, AV_LOG_ERROR, "Could not allocate buffer.\\n");\n            return ret;\n        }\n        ret = decode_argb_frame(ctx, &bc, pic);\n        if (ret < 0)\n            return ret;\n        break;\n    default:\n        av_log(avctx, AV_LOG_ERROR, "Unknown coding type: %d.\\n", coding_type);\n        return AVERROR_INVALIDDATA;\n    }\n    pic->key_frame = 1;\n    pic->pict_type = AV_PICTURE_TYPE_I;\n    *got_picture_ptr = 1;\n    return avpkt->size;\n}', 'static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,\n                                  unsigned byte_size)\n{\n    if (byte_size > INT_MAX / 8)\n        return AVERROR_INVALIDDATA;\n    return bitstream_init(bc, buffer, byte_size * 8);\n}', 'static int decode_rgb24_frame(CLLCContext *ctx, BitstreamContext *bc, AVFrame *pic)\n{\n    AVCodecContext *avctx = ctx->avctx;\n    uint8_t *dst;\n    int pred[3];\n    int ret;\n    int i, j;\n    VLC vlc[3];\n    pred[0] = 0x80;\n    pred[1] = 0x80;\n    pred[2] = 0x80;\n    dst = pic->data[0];\n    bitstream_skip(bc, 16);\n    for (i = 0; i < 3; i++) {\n        ret = read_code_table(ctx, bc, &vlc[i]);\n        if (ret < 0) {\n            for (j = 0; j <= i; j++)\n                ff_free_vlc(&vlc[j]);\n            av_log(ctx->avctx, AV_LOG_ERROR,\n                   "Could not read code table %d.\\n", i);\n            return ret;\n        }\n    }\n    for (i = 0; i < avctx->height; i++) {\n        for (j = 0; j < 3; j++)\n            read_rgb24_component_line(ctx, bc, &pred[j], &vlc[j], &dst[j]);\n        dst += pic->linesize[0];\n    }\n    for (i = 0; i < 3; i++)\n        ff_free_vlc(&vlc[i]);\n    return 0;\n}', 'static inline void bitstream_skip(BitstreamContext *bc, unsigned n)\n{\n    if (n < bc->bits_left)\n        skip_remaining(bc, n);\n    else {\n        n -= bc->bits_left;\n        bc->bits      = 0;\n        bc->bits_left = 0;\n        if (n >= 64) {\n            unsigned skip = n / 8;\n            n -= skip * 8;\n            bc->ptr += skip;\n        }\n        refill_64(bc);\n        if (n)\n            skip_remaining(bc, n);\n    }\n}', 'static inline void skip_remaining(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    bc->bits >>= n;\n#else\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n}']