libavcodec/cavsdec.c:1188: error: Integer Overflow L2
  ([0, 64] - 1):unsigned32 by call to `decode_slice_header`.

libavcodec/cavsdec.c:1187:17: Call
1185.         default:
1186.             if (stc <= SLICE_MAX_START_CODE) {
1187.                 bitstream_init(&h->bc, buf_ptr, input_size);
                      ^
1188.                 decode_slice_header(h, &h->bc);
1189.             }

libavcodec/bitstream.h:85:9: Assignment
  83.         bc->buffer    =
  84.         bc->ptr       = NULL;
  85.         bc->bits_left = 0;
              ^
  86.         return AVERROR_INVALIDDATA;
  87.     }

libavcodec/cavsdec.c:1188:17: Call
1186.             if (stc <= SLICE_MAX_START_CODE) {
1187.                 bitstream_init(&h->bc, buf_ptr, input_size);
1188.                 decode_slice_header(h, &h->bc);
                      ^
1189.             }
1190.             break;

libavcodec/cavsdec.c:877:1: Parameter `bc->bits_left`
  875.  ****************************************************************************/
  876. 
  877. static inline int decode_slice_header(AVSContext *h, BitstreamContext *bc)
       ^
  878. {
  879.     if (h->stc > 0xAF)

libavcodec/cavsdec.c:887:23: Call
  885.     h->flags &= ~(B_AVAIL | C_AVAIL);
  886.     if ((h->mby == 0) && (!h->qp_fixed)) {
  887.         h->qp_fixed = bitstream_read_bit(bc);
                             ^
  888.         h->qp       = bitstream_read(bc, 6);
  889.     }

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([0, 64] - 1):unsigned32 by call to `decode_slice_header` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int cavs_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,\n                             AVPacket *avpkt)\n{\n    AVSContext *h      = avctx->priv_data;\n    const uint8_t *buf = avpkt->data;\n    int buf_size       = avpkt->size;\n    uint32_t stc       = -1;\n    int input_size, ret;\n    const uint8_t *buf_end;\n    const uint8_t *buf_ptr;\n    if (buf_size == 0) {\n        if (!h->low_delay && h->DPB[0].f->data[0]) {\n            *got_frame = 1;\n            av_frame_move_ref(data, h->DPB[0].f);\n        }\n        return 0;\n    }\n    buf_ptr = buf;\n    buf_end = buf + buf_size;\n    for(;;) {\n        buf_ptr = avpriv_find_start_code(buf_ptr, buf_end, &stc);\n        if ((stc & 0xFFFFFE00) || buf_ptr == buf_end)\n            return FFMAX(0, buf_ptr - buf);\n        input_size = (buf_end - buf_ptr) * 8;\n        switch (stc) {\n        case CAVS_START_CODE:\n            bitstream_init(&h->bc, buf_ptr, input_size);\n            decode_seq_header(h);\n            break;\n        case PIC_I_START_CODE:\n            if (!h->got_keyframe) {\n                av_frame_unref(h->DPB[0].f);\n                av_frame_unref(h->DPB[1].f);\n                h->got_keyframe = 1;\n            }\n        case PIC_PB_START_CODE:\n            *got_frame = 0;\n            if (!h->got_keyframe)\n                break;\n            bitstream_init(&h->bc, buf_ptr, input_size);\n            h->stc = stc;\n            if (decode_pic(h))\n                break;\n            *got_frame = 1;\n            if (h->cur.f->pict_type != AV_PICTURE_TYPE_B) {\n                if (h->DPB[1].f->data[0]) {\n                    if ((ret = av_frame_ref(data, h->DPB[1].f)) < 0)\n                        return ret;\n                } else {\n                    *got_frame = 0;\n                }\n            } else {\n                av_frame_move_ref(data, h->cur.f);\n            }\n            break;\n        case EXT_START_CODE:\n            break;\n        case USER_START_CODE:\n            break;\n        default:\n            if (stc <= SLICE_MAX_START_CODE) {\n                bitstream_init(&h->bc, buf_ptr, input_size);\n                decode_slice_header(h, &h->bc);\n            }\n            break;\n        }\n    }\n}', 'static inline int bitstream_init(BitstreamContext *bc, const uint8_t *buffer,\n                                 unsigned bit_size)\n{\n    unsigned buffer_size;\n    if (bit_size > INT_MAX - 7 || !buffer) {\n        buffer        =\n        bc->buffer    =\n        bc->ptr       = NULL;\n        bc->bits_left = 0;\n        return AVERROR_INVALIDDATA;\n    }\n    buffer_size = (bit_size + 7) >> 3;\n    bc->buffer       = buffer;\n    bc->buffer_end   = buffer + buffer_size;\n    bc->ptr          = bc->buffer;\n    bc->size_in_bits = bit_size;\n    bc->bits_left    = 0;\n    bc->bits         = 0;\n    refill_64(bc);\n    return 0;\n}', 'static inline int decode_slice_header(AVSContext *h, BitstreamContext *bc)\n{\n    if (h->stc > 0xAF)\n        av_log(h->avctx, AV_LOG_ERROR, "unexpected start code 0x%02x\\n", h->stc);\n    h->mby   = h->stc;\n    h->mbidx = h->mby * h->mb_width;\n    h->flags &= ~(B_AVAIL | C_AVAIL);\n    if ((h->mby == 0) && (!h->qp_fixed)) {\n        h->qp_fixed = bitstream_read_bit(bc);\n        h->qp       = bitstream_read(bc, 6);\n    }\n    if ((h->cur.f->pict_type != AV_PICTURE_TYPE_I) ||\n        (!h->pic_structure && h->mby >= h->mb_width / 2))\n        if (bitstream_read_bit(bc)) {\n            av_log(h->avctx, AV_LOG_ERROR,\n                   "weighted prediction not yet supported\\n");\n        }\n    return 0;\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']