libavformat/rtpdec_qt.c:87: error: Integer Overflow L2
  ([0, +oo] - 23):unsigned32 by call to `bitstream_skip`.

libavformat/rtpdec_qt.c:82:27: Call
80. 
81.     bitstream_skip(&bc, 4); // version
82.     if ((packing_scheme = bitstream_read(&bc, 2)) == 0)
                              ^
83.         return AVERROR_INVALIDDATA;
84.     keyframe            = bitstream_read_bit(&bc);

libavcodec/bitstream.h:183:1: Parameter `bc->bits_left`
  181. 
  182. /* Return n bits from the buffer. n has to be in the 0-32 range. */
  183. static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)
       ^
  184. {
  185.     if (!n)

libavformat/rtpdec_qt.c:84:27: Call
82.     if ((packing_scheme = bitstream_read(&bc, 2)) == 0)
83.         return AVERROR_INVALIDDATA;
84.     keyframe            = bitstream_read_bit(&bc);
                              ^
85.     has_payload_desc    = bitstream_read_bit(&bc);
86.     has_packet_info     = bitstream_read_bit(&bc);

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
  143. 
  144. /* Return one bit from the buffer. */
  145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
       ^
  146. {
  147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
  148.         refill_64(bc);
  149. 
  150.     return get_val(bc, 1);
                  ^
  151. }
  152. 

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

libavformat/rtpdec_qt.c:85:27: Call
83.         return AVERROR_INVALIDDATA;
84.     keyframe            = bitstream_read_bit(&bc);
85.     has_payload_desc    = bitstream_read_bit(&bc);
                              ^
86.     has_packet_info     = bitstream_read_bit(&bc);
87.     bitstream_skip(&bc, 23); // reserved:7, cache payload info:1, payload ID:15

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
  143. 
  144. /* Return one bit from the buffer. */
  145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
       ^
  146. {
  147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
  148.         refill_64(bc);
  149. 
  150.     return get_val(bc, 1);
                  ^
  151. }
  152. 

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

libavformat/rtpdec_qt.c:86:27: Call
84.     keyframe            = bitstream_read_bit(&bc);
85.     has_payload_desc    = bitstream_read_bit(&bc);
86.     has_packet_info     = bitstream_read_bit(&bc);
                              ^
87.     bitstream_skip(&bc, 23); // reserved:7, cache payload info:1, payload ID:15
88. 

libavcodec/bitstream.h:145:1: Parameter `bc->bits_left`
  143. 
  144. /* Return one bit from the buffer. */
  145. static inline unsigned bitstream_read_bit(BitstreamContext *bc)
       ^
  146. {
  147.     if (!bc->bits_left)

libavcodec/bitstream.h:150:12: Call
  148.         refill_64(bc);
  149. 
  150.     return get_val(bc, 1);
                  ^
  151. }
  152. 

libavcodec/bitstream.h:130:1: Parameter `n`
    128. }
    129. 
    130. static inline uint64_t get_val(BitstreamContext *bc, unsigned n)
         ^
    131. {
    132. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:139:5: Assignment
    137.     bc->bits <<= n;
    138. #endif
    139.     bc->bits_left -= n;
             ^
    140. 
    141.     return ret;

libavformat/rtpdec_qt.c:87:5: Call
85.     has_payload_desc    = bitstream_read_bit(&bc);
86.     has_packet_info     = bitstream_read_bit(&bc);
87.     bitstream_skip(&bc, 23); // reserved:7, cache payload info:1, payload ID:15
        ^
88. 
89.     if (has_payload_desc) {

libavcodec/bitstream.h:241:1: Parameter `n`
  239. 
  240. /* Skip n bits in the buffer. */
  241. static inline void bitstream_skip(BitstreamContext *bc, unsigned n)
       ^
  242. {
  243.     if (n <= bc->bits_left)

libavcodec/bitstream.h:244:9: Call
  242. {
  243.     if (n <= bc->bits_left)
  244.         skip_remaining(bc, n);
               ^
  245.     else {
  246.         n -= bc->bits_left;

libavcodec/bitstream.h:230:1: <LHS trace>
228. }
229. 
230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
231. {
232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: Parameter `bc->bits_left`
    228. }
    229. 
    230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
         ^
    231. {
    232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: <RHS trace>
228. }
229. 
230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
     ^
231. {
232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:230:1: Parameter `n`
    228. }
    229. 
    230. static inline void skip_remaining(BitstreamContext *bc, unsigned n)
         ^
    231. {
    232. #ifdef BITSTREAM_READER_LE

libavcodec/bitstream.h:237:5: Binary operation: ([0, +oo] - 23):unsigned32 by call to `bitstream_skip` 
    235.     bc->bits <<= n;
    236. #endif
    237.     bc->bits_left -= n;
             ^
    238. }
    239. 

static inline void skip_remaining(BitstreamContext *bc, unsigned n)
{
#ifdef BITSTREAM_READER_LE
    bc->bits >>= n;
#else
    bc->bits <<= n;
#endif
    bc->bits_left -= n;
}
['static int qt_rtp_parse_packet(AVFormatContext *s, PayloadContext *qt,\n                               AVStream *st, AVPacket *pkt,\n                               uint32_t *timestamp, const uint8_t *buf,\n                               int len, uint16_t seq, int flags)\n{\n    AVIOContext pb;\n    BitstreamContext bc;\n    int packing_scheme, has_payload_desc, has_packet_info, alen,\n        has_marker_bit = flags & RTP_FLAG_MARKER,\n        keyframe;\n    if (qt->remaining) {\n        int num = qt->pkt.size / qt->bytes_per_frame;\n        if (av_new_packet(pkt, qt->bytes_per_frame))\n            return AVERROR(ENOMEM);\n        pkt->stream_index = st->index;\n        pkt->flags        = qt->pkt.flags;\n        memcpy(pkt->data,\n               &qt->pkt.data[(num - qt->remaining) * qt->bytes_per_frame],\n               qt->bytes_per_frame);\n        if (--qt->remaining == 0) {\n            av_freep(&qt->pkt.data);\n            qt->pkt.size = 0;\n        }\n        return qt->remaining > 0;\n    }\n    bitstream_init(&bc, buf, len << 3);\n    ffio_init_context(&pb, buf, len, 0, NULL, NULL, NULL, NULL);\n    if (len < 4)\n        return AVERROR_INVALIDDATA;\n    bitstream_skip(&bc, 4);\n    if ((packing_scheme = bitstream_read(&bc, 2)) == 0)\n        return AVERROR_INVALIDDATA;\n    keyframe            = bitstream_read_bit(&bc);\n    has_payload_desc    = bitstream_read_bit(&bc);\n    has_packet_info     = bitstream_read_bit(&bc);\n    bitstream_skip(&bc, 23);\n    if (has_payload_desc) {\n        int data_len, pos, is_start, is_finish;\n        uint32_t tag;\n        pos = bitstream_tell(&bc) >> 3;\n        if (pos + 12 > len)\n            return AVERROR_INVALIDDATA;\n        bitstream_skip(&bc, 2);\n        is_start  = bitstream_read_bit(&bc);\n        is_finish = bitstream_read_bit(&bc);\n        if (!is_start || !is_finish) {\n            avpriv_request_sample(s, "RTP-X-QT with payload description "\n                                  "split over several packets");\n            return AVERROR_PATCHWELCOME;\n        }\n        bitstream_skip(&bc, 12);\n        data_len = bitstream_read(&bc, 16);\n        avio_seek(&pb, pos + 4, SEEK_SET);\n        tag = avio_rl32(&pb);\n        if ((st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO &&\n                 tag != MKTAG(\'v\',\'i\',\'d\',\'e\')) ||\n            (st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO &&\n                 tag != MKTAG(\'s\',\'o\',\'u\',\'n\')))\n            return AVERROR_INVALIDDATA;\n        avpriv_set_pts_info(st, 32, 1, avio_rb32(&pb));\n        if (pos + data_len > len)\n            return AVERROR_INVALIDDATA;\n        while (avio_tell(&pb) + 4 < pos + data_len) {\n            int tlv_len = avio_rb16(&pb);\n            tag = avio_rl16(&pb);\n            if (avio_tell(&pb) + tlv_len > pos + data_len)\n                return AVERROR_INVALIDDATA;\n#define MKTAG16(a,b) MKTAG(a,b,0,0)\n            switch (tag) {\n            case MKTAG16(\'s\',\'d\'): {\n                MOVStreamContext *msc;\n                void *priv_data = st->priv_data;\n                int nb_streams = s->nb_streams;\n                MOVContext *mc = av_mallocz(sizeof(*mc));\n                if (!mc)\n                    return AVERROR(ENOMEM);\n                mc->fc = s;\n                st->priv_data = msc = av_mallocz(sizeof(MOVStreamContext));\n                if (!msc) {\n                    av_free(mc);\n                    st->priv_data = priv_data;\n                    return AVERROR(ENOMEM);\n                }\n                s->nb_streams = st->index + 1;\n                ff_mov_read_stsd_entries(mc, &pb, 1);\n                qt->bytes_per_frame = msc->bytes_per_frame;\n                av_free(msc);\n                av_free(mc);\n                st->priv_data = priv_data;\n                s->nb_streams = nb_streams;\n                break;\n            }\n            default:\n                avio_skip(&pb, tlv_len);\n                break;\n            }\n        }\n        avio_skip(&pb, ((avio_tell(&pb) + 3) & ~3) - avio_tell(&pb));\n    } else\n        avio_seek(&pb, 4, SEEK_SET);\n    if (has_packet_info) {\n        avpriv_request_sample(s, "RTP-X-QT with packet-specific info");\n        return AVERROR_PATCHWELCOME;\n    }\n    alen = len - avio_tell(&pb);\n    if (alen <= 0)\n        return AVERROR_INVALIDDATA;\n    switch (packing_scheme) {\n    case 3:\n        if (qt->pkt.size > 0 && qt->timestamp == *timestamp) {\n            int err;\n            if ((err = av_reallocp(&qt->pkt.data, qt->pkt.size + alen +\n                                   AV_INPUT_BUFFER_PADDING_SIZE)) < 0) {\n                qt->pkt.size = 0;\n                return err;\n            }\n        } else {\n            av_freep(&qt->pkt.data);\n            av_init_packet(&qt->pkt);\n            qt->pkt.data = av_realloc(NULL, alen + AV_INPUT_BUFFER_PADDING_SIZE);\n            if (!qt->pkt.data)\n                return AVERROR(ENOMEM);\n            qt->pkt.size = 0;\n            qt->timestamp = *timestamp;\n        }\n        memcpy(qt->pkt.data + qt->pkt.size, buf + avio_tell(&pb), alen);\n        qt->pkt.size += alen;\n        if (has_marker_bit) {\n            int ret = av_packet_from_data(pkt, qt->pkt.data, qt->pkt.size);\n            if (ret < 0)\n                return ret;\n            qt->pkt.size = 0;\n            qt->pkt.data = NULL;\n            pkt->flags        = keyframe ? AV_PKT_FLAG_KEY : 0;\n            pkt->stream_index = st->index;\n            memset(pkt->data + pkt->size, 0, AV_INPUT_BUFFER_PADDING_SIZE);\n            return 0;\n        }\n        return AVERROR(EAGAIN);\n    case 1:\n        if (qt->bytes_per_frame == 0 ||\n            alen % qt->bytes_per_frame != 0)\n            return AVERROR_INVALIDDATA;\n        qt->remaining = (alen / qt->bytes_per_frame) - 1;\n        if (av_new_packet(pkt, qt->bytes_per_frame))\n            return AVERROR(ENOMEM);\n        memcpy(pkt->data, buf + avio_tell(&pb), qt->bytes_per_frame);\n        pkt->flags = keyframe ? AV_PKT_FLAG_KEY : 0;\n        pkt->stream_index = st->index;\n        if (qt->remaining > 0) {\n            av_freep(&qt->pkt.data);\n            qt->pkt.data = av_realloc(NULL, qt->remaining * qt->bytes_per_frame);\n            if (!qt->pkt.data) {\n                av_packet_unref(pkt);\n                return AVERROR(ENOMEM);\n            }\n            qt->pkt.size = qt->remaining * qt->bytes_per_frame;\n            memcpy(qt->pkt.data,\n                   buf + avio_tell(&pb) + qt->bytes_per_frame,\n                   qt->remaining * qt->bytes_per_frame);\n            qt->pkt.flags = pkt->flags;\n            return 1;\n        }\n        return 0;\n    default:\n        avpriv_request_sample(NULL, "RTP-X-QT with packing scheme 2");\n        return AVERROR_PATCHWELCOME;\n    }\n}', 'static inline uint32_t bitstream_read(BitstreamContext *bc, unsigned n)\n{\n    if (!n)\n        return 0;\n    if (n > bc->bits_left) {\n        refill_32(bc);\n        if (bc->bits_left < 32)\n            bc->bits_left = n;\n    }\n    return get_val(bc, n);\n}', 'static inline unsigned bitstream_read_bit(BitstreamContext *bc)\n{\n    if (!bc->bits_left)\n        refill_64(bc);\n    return get_val(bc, 1);\n}', 'static inline uint64_t get_val(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    uint64_t ret = bc->bits & ((UINT64_C(1) << n) - 1);\n    bc->bits >>= n;\n#else\n    uint64_t ret = bc->bits >> (64 - n);\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n    return ret;\n}', 'static inline void bitstream_skip(BitstreamContext *bc, unsigned n)\n{\n    if (n <= bc->bits_left)\n        skip_remaining(bc, n);\n    else {\n        n -= bc->bits_left;\n        skip_remaining(bc, bc->bits_left);\n        if (n >= 64) {\n            unsigned skip = n / 8;\n            n -= skip * 8;\n            bc->ptr += skip;\n        }\n        refill_64(bc);\n        if (n)\n            skip_remaining(bc, n);\n    }\n}', 'static inline void skip_remaining(BitstreamContext *bc, unsigned n)\n{\n#ifdef BITSTREAM_READER_LE\n    bc->bits >>= n;\n#else\n    bc->bits <<= n;\n#endif\n    bc->bits_left -= n;\n}']