libavcodec/aic.c:326: error: Integer Overflow L2
  ([-1, +oo] - 1):unsigned32 by call to `aic_decode_coeffs`.

libavcodec/aic.c:321:5: Call
319.         C[i] = ctx->frame->data[i + 1] + mb_x * 8
320.                + mb_y * 8 * ctx->frame->linesize[i + 1];
321.     bitstream_init8(&bc, src, src_size);
         ^
322. 
323.     memset(ctx->slice_data, 0,

libavcodec/bitstream.h:104:1: Parameter `bc->bits_left`
  102. 
  103. /* Initialize BitstreamContext with buffer size in bytes instead of bits. */
  104. static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,
       ^
  105.                                   unsigned byte_size)
  106. {

libavcodec/aic.c:326:20: Call
324.            sizeof(*ctx->slice_data) * slice_width * AIC_BAND_COEFFS);
325.     for (i = 0; i < NUM_BANDS; i++)
326.         if ((ret = aic_decode_coeffs(&bc, ctx->data_ptr[i],
                        ^
327.                                      i, slice_width,
328.                                      !ctx->interlaced)) < 0)

libavcodec/aic.c:201:1: Parameter `bc->bits_left`
  199.     } while (0)
  200. 
  201. static int aic_decode_coeffs(BitstreamContext *bc, int16_t *dst,
       ^
  202.                              int band, int slice_width, int force_chroma)
  203. {

libavcodec/aic.c:209:18: Call
  207.     int mb, idx, val;
  208. 
  209.     has_skips  = bitstream_read_bit(bc);
                        ^
  210.     coeff_type = bitstream_read_bit(bc);
  211.     coeff_bits = bitstream_read(bc, 3);

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

libavcodec/aic.c:210:18: Call
  208. 
  209.     has_skips  = bitstream_read_bit(bc);
  210.     coeff_type = bitstream_read_bit(bc);
                        ^
  211.     coeff_bits = bitstream_read(bc, 3);
  212. 

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
    143. 
    144. /* Return one bit from the buffer. */
    145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
         ^
    146. {
    147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
    148.         refill_64(bc);
    149. 
    150.     return get_val(bc, 1);
                    ^
    151. }
    152. 

libavcodec/bitstream.h:130:1: <LHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `bc->bits_left`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: <RHS trace>
128. }
129. 
130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
     ^
131. {
132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:130:1: Parameter `n`
      128. }
      129. 
      130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
           ^
      131. {
      132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Binary operation: ([-1, +oo] - 1):unsigned32 by call to `aic_decode_coeffs` 
      137.     bc->bits <<= n;
      138. #endif
      139.     bc->bits_left -= n;
               ^
      140. 
      141.     return ret;

static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);
    bc->bits >>= n;
#else
    uint64_t ret = bc->bits >> (64 - n);
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
    return ret;
}
['static int aic_decode_slice(AICContext *ctx, int mb_x, int mb_y,\n                            const uint8_t *src, int src_size)\n{\n    BitstreamContext bc;\n    int ret, i, mb, blk;\n    int slice_width = FFMIN(ctx->slice_width, ctx->mb_width - mb_x);\n    uint8_t *Y, *C[2];\n    uint8_t *dst;\n    int16_t *base_y = ctx->data_ptr[COEFF_LUMA];\n    int16_t *base_c = ctx->data_ptr[COEFF_CHROMA];\n    int16_t *ext_y  = ctx->data_ptr[COEFF_LUMA_EXT];\n    int16_t *ext_c  = ctx->data_ptr[COEFF_CHROMA_EXT];\n    const int ystride = ctx->frame->linesize[0];\n    Y = ctx->frame->data[0] + mb_x * 16 + mb_y * 16 * ystride;\n    for (i = 0; i < 2; i++)\n        C[i] = ctx->frame->data[i + 1] + mb_x * 8\n               + mb_y * 8 * ctx->frame->linesize[i + 1];\n    bitstream_init8(&bc, src, src_size);\n    memset(ctx->slice_data, 0,\n           sizeof(*ctx->slice_data) * slice_width * AIC_BAND_COEFFS);\n    for (i = 0; i < NUM_BANDS; i++)\n        if ((ret = aic_decode_coeffs(&bc, ctx->data_ptr[i],\n                                     i, slice_width,\n                                     !ctx->interlaced)) < 0)\n            return ret;\n    for (mb = 0; mb < slice_width; mb++) {\n        for (blk = 0; blk < 4; blk++) {\n            if (!ctx->interlaced)\n                recombine_block(ctx->block, ctx->scantable.permutated,\n                                &base_y, &ext_y);\n            else\n                recombine_block_il(ctx->block, ctx->scantable.permutated,\n                                   &base_y, &ext_y, blk);\n            unquant_block(ctx->block, ctx->quant);\n            ctx->idsp.idct(ctx->block);\n            if (!ctx->interlaced) {\n                dst = Y + (blk >> 1) * 8 * ystride + (blk & 1) * 8;\n                ctx->idsp.put_signed_pixels_clamped(ctx->block, dst, ystride);\n            } else {\n                dst = Y + (blk & 1) * 8 + (blk >> 1) * ystride;\n                ctx->idsp.put_signed_pixels_clamped(ctx->block, dst,\n                                                    ystride * 2);\n            }\n        }\n        Y += 16;\n        for (blk = 0; blk < 2; blk++) {\n            recombine_block(ctx->block, ctx->scantable.permutated,\n                            &base_c, &ext_c);\n            unquant_block(ctx->block, ctx->quant);\n            ctx->idsp.idct(ctx->block);\n            ctx->idsp.put_signed_pixels_clamped(ctx->block, C[blk],\n                                                ctx->frame->linesize[blk + 1]);\n            C[blk] += 8;\n        }\n    }\n    return 0;\n}', 'static inline int bitstream_init8(BitstreamContext *bc, const uint8_t *buffer,\n                                  unsigned byte_size)\n{\n    if (byte_size > INT_MAX / 8)\n        return AVERROR_INVALIDDATA;\n    return bitstream_init(bc, buffer, byte_size * 8);\n}', 'static int aic_decode_coeffs(BitstreamContext *bc, int16_t *dst,\n                             int band, int slice_width, int force_chroma)\n{\n    int has_skips, coeff_type, coeff_bits, skip_type, skip_bits;\n    const int num_coeffs = aic_num_band_coeffs[band];\n    const uint8_t *scan = aic_scan[band | force_chroma];\n    int mb, idx, val;\n    has_skips  = bitstream_read_bit(bc);\n    coeff_type = bitstream_read_bit(bc);\n    coeff_bits = bitstream_read(bc, 3);\n    if (has_skips) {\n        skip_type = bitstream_read_bit(bc);\n        skip_bits = bitstream_read(bc, 3);\n        for (mb = 0; mb < slice_width; mb++) {\n            idx = -1;\n            do {\n                GET_CODE(val, skip_type, skip_bits);\n                if (val < 0)\n                    return AVERROR_INVALIDDATA;\n                idx += val + 1;\n                if (idx >= num_coeffs)\n                    break;\n                GET_CODE(val, coeff_type, coeff_bits);\n                val++;\n                if (val >= 0x10000 || val < 0)\n                    return AVERROR_INVALIDDATA;\n                dst[scan[idx]] = val;\n            } while (idx < num_coeffs - 1);\n            dst += num_coeffs;\n        }\n    } else {\n        for (mb = 0; mb < slice_width; mb++) {\n            for (idx = 0; idx < num_coeffs; idx++) {\n                GET_CODE(val, coeff_type, coeff_bits);\n                if (val >= 0x10000 || val < 0)\n                    return AVERROR_INVALIDDATA;\n                dst[scan[idx]] = val;\n            }\n            dst += num_coeffs;\n        }\n    }\n    return 0;\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}']