libavformat/xmv.c:531: error: Integer Overflow L2
  ([8, +oo] - [8, 524292]):unsigned32.

libavformat/xmv.c:495:20: <LHS trace>
493. 
494.     /* Read the frame header */
495.     frame_header = avio_rl32(pb);
                        ^
496. 
497.     frame_size      = (frame_header & 0x1FFFF) * 4 + 4;

libavformat/xmv.c:495:20: Call
493. 
494.     /* Read the frame header */
495.     frame_header = avio_rl32(pb);
                        ^
496. 
497.     frame_size      = (frame_header & 0x1FFFF) * 4 + 4;

libavformat/aviobuf.c:561:11: Call
  559. {
  560.     unsigned int val;
  561.     val = avio_rl16(s);
                 ^
  562.     val |= avio_rl16(s) << 16;
  563.     return val;

libavformat/aviobuf.c:545:11: Call
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
                   ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:443:5: Assignment
      441.     if (s->buf_ptr < s->buf_end)
      442.         return *s->buf_ptr++;
      443.     return 0;
               ^
      444. }
      445. 

libavformat/aviobuf.c:545:5: Assignment
    543. {
    544.     unsigned int val;
    545.     val = avio_r8(s);
             ^
    546.     val |= avio_r8(s) << 8;
    547.     return val;

libavformat/aviobuf.c:546:5: Assignment
    544.     unsigned int val;
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
             ^
    547.     return val;
    548. }

libavformat/aviobuf.c:547:5: Assignment
    545.     val = avio_r8(s);
    546.     val |= avio_r8(s) << 8;
    547.     return val;
             ^
    548. }
    549. 

libavformat/aviobuf.c:561:5: Assignment
  559. {
  560.     unsigned int val;
  561.     val = avio_rl16(s);
           ^
  562.     val |= avio_rl16(s) << 16;
  563.     return val;

libavformat/aviobuf.c:562:5: Assignment
  560.     unsigned int val;
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
           ^
  563.     return val;
  564. }

libavformat/aviobuf.c:563:5: Assignment
  561.     val = avio_rl16(s);
  562.     val |= avio_rl16(s) << 16;
  563.     return val;
           ^
  564. }
  565. 

libavformat/xmv.c:495:5: Assignment
493. 
494.     /* Read the frame header */
495.     frame_header = avio_rl32(pb);
         ^
496. 
497.     frame_size      = (frame_header & 0x1FFFF) * 4 + 4;

libavformat/xmv.c:497:5: Assignment
495.     frame_header = avio_rl32(pb);
496. 
497.     frame_size      = (frame_header & 0x1FFFF) * 4 + 4;
         ^
498.     frame_timestamp = (frame_header >> 17);
499. 

libavformat/xmv.c:512:10: <RHS trace>
510.      * TODO: This manual swap is of course suboptimal.
511.      */
512.     for (i = 0; i < frame_size; i += 4)
              ^
513.         AV_WB32(pkt->data + i, avio_rl32(pb));
514. 

libavformat/xmv.c:512:10: Assignment
510.      * TODO: This manual swap is of course suboptimal.
511.      */
512.     for (i = 0; i < frame_size; i += 4)
              ^
513.         AV_WB32(pkt->data + i, avio_rl32(pb));
514. 

libavformat/xmv.c:531:5: Binary operation: ([8, +oo] - [8, 524292]):unsigned32
529. 
530.     /* Advance offset */
531.     video->data_size   -= frame_size + 4;
         ^
532.     video->data_offset += frame_size + 4;
533. 

static int xmv_fetch_video_packet(AVFormatContext *s,
                                  AVPacket *pkt)
{
    XMVDemuxContext *xmv   = s->priv_data;
    AVIOContext     *pb    = s->pb;
    XMVVideoPacket  *video = &xmv->video;
    int result;
    uint32_t frame_header;
    uint32_t frame_size, frame_timestamp;
    uint32_t i;
    if (avio_seek(pb, video->data_offset, SEEK_SET) != video->data_offset)
        return AVERROR(EIO);
    frame_header = avio_rl32(pb);
    frame_size      = (frame_header & 0x1FFFF) * 4 + 4;
    frame_timestamp = (frame_header >> 17);
    if ((frame_size + 4) > video->data_size)
        return AVERROR(EIO);
    result = av_new_packet(pkt, frame_size);
    if (result)
        return result;
    for (i = 0; i < frame_size; i += 4)
        AV_WB32(pkt->data + i, avio_rl32(pb));
    pkt->stream_index = video->stream_index;
    video->last_pts = frame_timestamp + video->pts;
    pkt->duration = 0;
    pkt->pts      = video->last_pts;
    pkt->dts      = AV_NOPTS_VALUE;
    video->pts += frame_timestamp;
    pkt->flags = (pkt->data[0] & 0x80) ? 0 : AV_PKT_FLAG_KEY;
    video->data_size   -= frame_size + 4;
    video->data_offset += frame_size + 4;
    return 0;
}
['static int xmv_fetch_video_packet(AVFormatContext *s,\n                                  AVPacket *pkt)\n{\n    XMVDemuxContext *xmv   = s->priv_data;\n    AVIOContext     *pb    = s->pb;\n    XMVVideoPacket  *video = &xmv->video;\n    int result;\n    uint32_t frame_header;\n    uint32_t frame_size, frame_timestamp;\n    uint32_t i;\n    if (avio_seek(pb, video->data_offset, SEEK_SET) != video->data_offset)\n        return AVERROR(EIO);\n    frame_header = avio_rl32(pb);\n    frame_size      = (frame_header & 0x1FFFF) * 4 + 4;\n    frame_timestamp = (frame_header >> 17);\n    if ((frame_size + 4) > video->data_size)\n        return AVERROR(EIO);\n    result = av_new_packet(pkt, frame_size);\n    if (result)\n        return result;\n    for (i = 0; i < frame_size; i += 4)\n        AV_WB32(pkt->data + i, avio_rl32(pb));\n    pkt->stream_index = video->stream_index;\n    video->last_pts = frame_timestamp + video->pts;\n    pkt->duration = 0;\n    pkt->pts      = video->last_pts;\n    pkt->dts      = AV_NOPTS_VALUE;\n    video->pts += frame_timestamp;\n    pkt->flags = (pkt->data[0] & 0x80) ? 0 : AV_PKT_FLAG_KEY;\n    video->data_size   -= frame_size + 4;\n    video->data_offset += frame_size + 4;\n    return 0;\n}', 'unsigned int avio_rl32(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_rl16(s);\n    val |= avio_rl16(s) << 16;\n    return val;\n}', 'unsigned int avio_rl16(AVIOContext *s)\n{\n    unsigned int val;\n    val = avio_r8(s);\n    val |= avio_r8(s) << 8;\n    return val;\n}', 'int avio_r8(AVIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}']