libavformat/r3d.c:322: error: Integer Overflow L2
  ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv`.

libavformat/r3d.c:314:13: Call
312. 
313.     while (!err) {
314.         if (read_atom(s, &atom) < 0) {
                 ^
315.             err = -1;
316.             break;

libavformat/r3d.c:42:18: Call
  40. {
  41.     atom->offset = url_ftell(s->pb);
  42.     atom->size = get_be32(s->pb);
                       ^
  43.     if (atom->size < 8)
  44.         return -1;

libavformat/aviobuf.c:570:11: Call
    568. {
    569.     unsigned int val;
    570.     val = get_be16(s) << 16;
                   ^
    571.     val |= get_be16(s);
    572.     return val;

libavformat/aviobuf.c:555:11: Call
      553. {
      554.     unsigned int val;
      555.     val = get_byte(s) << 8;
                     ^
      556.     val |= get_byte(s);
      557.     return val;

libavformat/aviobuf.c:438:5: Assignment
        436.     if (s->buf_ptr < s->buf_end)
        437.         return *s->buf_ptr++;
        438.     return 0;
                 ^
        439. }
        440. 

libavformat/aviobuf.c:555:5: Assignment
      553. {
      554.     unsigned int val;
      555.     val = get_byte(s) << 8;
               ^
      556.     val |= get_byte(s);
      557.     return val;

libavformat/aviobuf.c:556:5: Assignment
      554.     unsigned int val;
      555.     val = get_byte(s) << 8;
      556.     val |= get_byte(s);
               ^
      557.     return val;
      558. }

libavformat/aviobuf.c:557:5: Assignment
      555.     val = get_byte(s) << 8;
      556.     val |= get_byte(s);
      557.     return val;
               ^
      558. }
      559. 

libavformat/aviobuf.c:570:5: Assignment
    568. {
    569.     unsigned int val;
    570.     val = get_be16(s) << 16;
             ^
    571.     val |= get_be16(s);
    572.     return val;

libavformat/aviobuf.c:571:5: Assignment
    569.     unsigned int val;
    570.     val = get_be16(s) << 16;
    571.     val |= get_be16(s);
             ^
    572.     return val;
    573. }

libavformat/aviobuf.c:572:5: Assignment
    570.     val = get_be16(s) << 16;
    571.     val |= get_be16(s);
    572.     return val;
             ^
    573. }
    574. 

libavformat/r3d.c:42:5: Assignment
  40. {
  41.     atom->offset = url_ftell(s->pb);
  42.     atom->size = get_be32(s->pb);
          ^
  43.     if (atom->size < 8)
  44.         return -1;

libavformat/r3d.c:322:25: Call
320.             if (s->streams[0]->discard == AVDISCARD_ALL)
321.                 goto skip;
322.             if (!(err = r3d_read_redv(s, pkt, &atom)))
                             ^
323.                 return 0;
324.             break;

libavformat/r3d.c:209:1: <LHS trace>
207. }
208. 
209. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
     ^
210. {
211.     AVStream *st = s->streams[0];

libavformat/r3d.c:209:1: Parameter `atom->size`
  207. }
  208. 
  209. static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
       ^
  210. {
  211.     AVStream *st = s->streams[0];

libavformat/r3d.c:244:5: Binary operation: ([0, +oo] - 8):unsigned32 by call to `r3d_read_redv` 
  242.         av_dlog(s, "metadata len %d\n", tmp);
  243.     }
  244.     tmp = atom->size - 8 - (url_ftell(s->pb) - pos);
           ^
  245.     if (tmp < 0)
  246.         return -1;

static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)
{
    AVStream *st = s->streams[0];
    int tmp, tmp2;
    uint64_t pos = url_ftell(s->pb);
    unsigned dts;
    int ret;
    dts = get_be32(s->pb);
    tmp = get_be32(s->pb);
    av_dlog(s, "frame num %d\n", tmp);
    tmp  = get_byte(s->pb);
    tmp2 = get_byte(s->pb);
    av_dlog(s, "version %d.%d\n", tmp, tmp2);
    tmp = get_be16(s->pb);
    av_dlog(s, "unknown %d\n", tmp);
    if (tmp > 4) {
        tmp = get_be16(s->pb);
        av_dlog(s, "unknown %d\n", tmp);
        tmp = get_be16(s->pb);
        av_dlog(s, "unknown %d\n", tmp);
        tmp = get_be32(s->pb);
        av_dlog(s, "width %d\n", tmp);
        tmp = get_be32(s->pb);
        av_dlog(s, "height %d\n", tmp);
        tmp = get_be32(s->pb);
        av_dlog(s, "metadata len %d\n", tmp);
    }
    tmp = atom->size - 8 - (url_ftell(s->pb) - pos);
    if (tmp < 0)
        return -1;
    ret = av_get_packet(s->pb, pkt, tmp);
    if (ret < 0) {
        av_log(s, AV_LOG_ERROR, "error reading video packet\n");
        return -1;
    }
    pkt->stream_index = 0;
    pkt->dts = dts;
    if (st->codec->time_base.den)
        pkt->duration = (uint64_t)st->time_base.den*
            st->codec->time_base.num/st->codec->time_base.den;
    av_dlog(s, "pkt dts %lld duration %d\n", pkt->dts, pkt->duration);
    return 0;
}
["static int r3d_read_packet(AVFormatContext *s, AVPacket *pkt)\n{\n    Atom atom;\n    int err = 0;\n    while (!err) {\n        if (read_atom(s, &atom) < 0) {\n            err = -1;\n            break;\n        }\n        switch (atom.tag) {\n        case MKTAG('R','E','D','V'):\n            if (s->streams[0]->discard == AVDISCARD_ALL)\n                goto skip;\n            if (!(err = r3d_read_redv(s, pkt, &atom)))\n                return 0;\n            break;\n        case MKTAG('R','E','D','A'):\n            if (s->nb_streams < 2)\n                return -1;\n            if (s->streams[1]->discard == AVDISCARD_ALL)\n                goto skip;\n            if (!(err = r3d_read_reda(s, pkt, &atom)))\n                return 0;\n            break;\n        default:\n        skip:\n            url_fskip(s->pb, atom.size-8);\n        }\n    }\n    return err;\n}", 'static int read_atom(AVFormatContext *s, Atom *atom)\n{\n    atom->offset = url_ftell(s->pb);\n    atom->size = get_be32(s->pb);\n    if (atom->size < 8)\n        return -1;\n    atom->tag = get_le32(s->pb);\n    av_dlog(s, "atom %d %.4s offset %#llx\\n",\n            atom->size, (char*)&atom->tag, atom->offset);\n    return atom->size;\n}', 'unsigned int get_be32(ByteIOContext *s)\n{\n    unsigned int val;\n    val = get_be16(s) << 16;\n    val |= get_be16(s);\n    return val;\n}', 'unsigned int get_be16(ByteIOContext *s)\n{\n    unsigned int val;\n    val = get_byte(s) << 8;\n    val |= get_byte(s);\n    return val;\n}', 'int get_byte(ByteIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}', 'static int r3d_read_redv(AVFormatContext *s, AVPacket *pkt, Atom *atom)\n{\n    AVStream *st = s->streams[0];\n    int tmp, tmp2;\n    uint64_t pos = url_ftell(s->pb);\n    unsigned dts;\n    int ret;\n    dts = get_be32(s->pb);\n    tmp = get_be32(s->pb);\n    av_dlog(s, "frame num %d\\n", tmp);\n    tmp  = get_byte(s->pb);\n    tmp2 = get_byte(s->pb);\n    av_dlog(s, "version %d.%d\\n", tmp, tmp2);\n    tmp = get_be16(s->pb);\n    av_dlog(s, "unknown %d\\n", tmp);\n    if (tmp > 4) {\n        tmp = get_be16(s->pb);\n        av_dlog(s, "unknown %d\\n", tmp);\n        tmp = get_be16(s->pb);\n        av_dlog(s, "unknown %d\\n", tmp);\n        tmp = get_be32(s->pb);\n        av_dlog(s, "width %d\\n", tmp);\n        tmp = get_be32(s->pb);\n        av_dlog(s, "height %d\\n", tmp);\n        tmp = get_be32(s->pb);\n        av_dlog(s, "metadata len %d\\n", tmp);\n    }\n    tmp = atom->size - 8 - (url_ftell(s->pb) - pos);\n    if (tmp < 0)\n        return -1;\n    ret = av_get_packet(s->pb, pkt, tmp);\n    if (ret < 0) {\n        av_log(s, AV_LOG_ERROR, "error reading video packet\\n");\n        return -1;\n    }\n    pkt->stream_index = 0;\n    pkt->dts = dts;\n    if (st->codec->time_base.den)\n        pkt->duration = (uint64_t)st->time_base.den*\n            st->codec->time_base.num/st->codec->time_base.den;\n    av_dlog(s, "pkt dts %lld duration %d\\n", pkt->dts, pkt->duration);\n    return 0;\n}']