libavformat/apetag.c:108: error: Integer Overflow L2
  ([32, +oo] - [-oo, 16777248]):unsigned32.

libavformat/apetag.c:69:21: <LHS trace>
67. {
68.     ByteIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
                        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/apetag.c:69:21: Call
67. {
68.     ByteIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
                        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/aviobuf.c:210:9: Assignment
  208. 
  209.     if(!s)
  210.         return AVERROR(EINVAL);
               ^
  211. 
  212.     if (!s->seek)

libavformat/apetag.c:69:5: Assignment
67. {
68.     ByteIOContext *pb = s->pb;
69.     int file_size = url_fsize(pb);
        ^
70.     uint32_t val, fields, tag_bytes;
71.     uint8_t buf[8];

libavformat/apetag.c:90:17: <RHS trace>
88.     }
89. 
90.     tag_bytes = get_le32(pb);  /* tag size */
                    ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:90:17: Call
88.     }
89. 
90.     tag_bytes = get_le32(pb);  /* tag size */
                    ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/aviobuf.c:498:11: Call
  496. {
  497.     unsigned int val;
  498.     val = get_le16(s);
                 ^
  499.     val |= get_le16(s) << 16;
  500.     return val;

libavformat/aviobuf.c:482:11: Call
    480. {
    481.     unsigned int val;
    482.     val = get_byte(s);
                   ^
    483.     val |= get_byte(s) << 8;
    484.     return val;

libavformat/aviobuf.c:397:5: Assignment
      395.     if (s->buf_ptr < s->buf_end)
      396.         return *s->buf_ptr++;
      397.     return 0;
               ^
      398. }
      399. 

libavformat/aviobuf.c:482:5: Assignment
    480. {
    481.     unsigned int val;
    482.     val = get_byte(s);
             ^
    483.     val |= get_byte(s) << 8;
    484.     return val;

libavformat/aviobuf.c:483:5: Assignment
    481.     unsigned int val;
    482.     val = get_byte(s);
    483.     val |= get_byte(s) << 8;
             ^
    484.     return val;
    485. }

libavformat/aviobuf.c:484:5: Assignment
    482.     val = get_byte(s);
    483.     val |= get_byte(s) << 8;
    484.     return val;
             ^
    485. }
    486. 

libavformat/aviobuf.c:498:5: Assignment
  496. {
  497.     unsigned int val;
  498.     val = get_le16(s);
           ^
  499.     val |= get_le16(s) << 16;
  500.     return val;

libavformat/aviobuf.c:499:5: Assignment
  497.     unsigned int val;
  498.     val = get_le16(s);
  499.     val |= get_le16(s) << 16;
           ^
  500.     return val;
  501. }

libavformat/aviobuf.c:500:5: Assignment
  498.     val = get_le16(s);
  499.     val |= get_le16(s) << 16;
  500.     return val;
           ^
  501. }
  502. 

libavformat/apetag.c:90:5: Assignment
88.     }
89. 
90.     tag_bytes = get_le32(pb);  /* tag size */
        ^
91.     if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
92.         av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");

libavformat/apetag.c:108:5: Binary operation: ([32, +oo] - [-oo, 16777248]):unsigned32
106.     }
107. 
108.     url_fseek(pb, file_size - tag_bytes, SEEK_SET);
         ^
109. 
110.     for (i=0; i<fields; i++)

void ff_ape_parse_tag(AVFormatContext *s)
{
    ByteIOContext *pb = s->pb;
    int file_size = url_fsize(pb);
    uint32_t val, fields, tag_bytes;
    uint8_t buf[8];
    int i;
    if (file_size < APE_TAG_FOOTER_BYTES)
        return;
    url_fseek(pb, file_size - APE_TAG_FOOTER_BYTES, SEEK_SET);
    get_buffer(pb, buf, 8);
    if (strncmp(buf, "APETAGEX", 8)) {
        return;
    }
    val = get_le32(pb);
    if (val > APE_TAG_VERSION) {
        av_log(s, AV_LOG_ERROR, "Unsupported tag version. (>=%d)\n", APE_TAG_VERSION);
        return;
    }
    tag_bytes = get_le32(pb);
    if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {
        av_log(s, AV_LOG_ERROR, "Tag size is way too big\n");
        return;
    }
    fields = get_le32(pb);
    if (fields > 65536) {
        av_log(s, AV_LOG_ERROR, "Too many tag fields (%d)\n", fields);
        return;
    }
    val = get_le32(pb);
    if (val & APE_TAG_FLAG_IS_HEADER) {
        av_log(s, AV_LOG_ERROR, "APE Tag is a header\n");
        return;
    }
    url_fseek(pb, file_size - tag_bytes, SEEK_SET);
    for (i=0; i<fields; i++)
        if (ape_tag_read_field(s) < 0) break;
}
['void ff_ape_parse_tag(AVFormatContext *s)\n{\n    ByteIOContext *pb = s->pb;\n    int file_size = url_fsize(pb);\n    uint32_t val, fields, tag_bytes;\n    uint8_t buf[8];\n    int i;\n    if (file_size < APE_TAG_FOOTER_BYTES)\n        return;\n    url_fseek(pb, file_size - APE_TAG_FOOTER_BYTES, SEEK_SET);\n    get_buffer(pb, buf, 8);\n    if (strncmp(buf, "APETAGEX", 8)) {\n        return;\n    }\n    val = get_le32(pb);\n    if (val > APE_TAG_VERSION) {\n        av_log(s, AV_LOG_ERROR, "Unsupported tag version. (>=%d)\\n", APE_TAG_VERSION);\n        return;\n    }\n    tag_bytes = get_le32(pb);\n    if (tag_bytes - APE_TAG_FOOTER_BYTES > (1024 * 1024 * 16)) {\n        av_log(s, AV_LOG_ERROR, "Tag size is way too big\\n");\n        return;\n    }\n    fields = get_le32(pb);\n    if (fields > 65536) {\n        av_log(s, AV_LOG_ERROR, "Too many tag fields (%d)\\n", fields);\n        return;\n    }\n    val = get_le32(pb);\n    if (val & APE_TAG_FLAG_IS_HEADER) {\n        av_log(s, AV_LOG_ERROR, "APE Tag is a header\\n");\n        return;\n    }\n    url_fseek(pb, file_size - tag_bytes, SEEK_SET);\n    for (i=0; i<fields; i++)\n        if (ape_tag_read_field(s) < 0) break;\n}', 'int64_t url_fsize(ByteIOContext *s)\n{\n    int64_t size;\n    if(!s)\n        return AVERROR(EINVAL);\n    if (!s->seek)\n        return AVERROR(ENOSYS);\n    size = s->seek(s->opaque, 0, AVSEEK_SIZE);\n    if(size<0){\n        if ((size = s->seek(s->opaque, -1, SEEK_END)) < 0)\n            return size;\n        size++;\n        s->seek(s->opaque, s->pos, SEEK_SET);\n    }\n    return size;\n}', 'unsigned int get_le32(ByteIOContext *s)\n{\n    unsigned int val;\n    val = get_le16(s);\n    val |= get_le16(s) << 16;\n    return val;\n}', 'unsigned int get_le16(ByteIOContext *s)\n{\n    unsigned int val;\n    val = get_byte(s);\n    val |= get_byte(s) << 8;\n    return val;\n}', 'int get_byte(ByteIOContext *s)\n{\n    if (s->buf_ptr >= s->buf_end)\n        fill_buffer(s);\n    if (s->buf_ptr < s->buf_end)\n        return *s->buf_ptr++;\n    return 0;\n}']